@goodandready/dsh-plugin-notify 0.4.5 → 0.4.6

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.6] - 2026-10-22
+
+### Security
+- **Web Push Endpoint Allowlist & SSRF Protection** (#64): Enforce strict validation of subscription endpoints against canonical Web Push gateways (Google FCM, Mozilla Autopush, Apple Web Push, Microsoft WNS) with optional `webPush.allowedHosts`; reject loopback, private IPv4/IPv6, link-local, userinfo, and non-standard ports.
+- **Push Endpoint Masking in Logs** (#64): Mask subscription endpoint tokens in server logs (`maskEndpoint`) and delivery error messages to prevent token exfiltration.
+- **Subscription Capacity Bound** (#64): Constrain total stored subscriptions (max 100) to prevent state file exhaustion DoS.
+- **Dead & Disallowed Endpoint Pruning** (#64): Prune any invalid or unapproved endpoints during `deliverWebPush` without dispatching requests.
+
 ## [0.4.5] - 2026-10-19
 
 ### Fixed

package/README.md

@@ -151,6 +151,7 @@ Put each webhook URL into **Settings → Credentials**. In the plugin card, type
 | `webPush.onlyWhenAway` | boolean | `true` | Skip web push while a browser client is connected to the SSE stream. |
 | `webPush.subject` | string | `mailto:notify@localhost` | VAPID subject (mailto:/https: contact) advertised to push services. |
 | `webPush.stateFile` | string | empty | State file for VAPID keys and subscriptions (default `$DSH_HOME/plugin-notify-state.json`). |
+| `webPush.allowedHosts` | string[] | `[]` | Optional list of extra allowed push endpoint hostnames or wildcards (default allowlist covers Google FCM, Mozilla, Apple, Microsoft). |
 | `webhooks.*` | string | empty | Credential **name** whose value is the webhook URL. Empty disables the channel. |
 | `events` | string[] | `task_done`, `error`, `approval_requested` | Event whitelist. Empty restores the default three. |
 | `local` | boolean | `true` | macOS `osascript` popup; ignored on other platforms. |

package/README.ru.md

@@ -159,6 +159,7 @@ dsh plugin --profile web add @goodandready/dsh-plugin-notify
 | `webPush.onlyWhenAway` | boolean | `true` | Пропускать web push, пока подключён браузерный клиент. |
 | `webPush.subject` | string | `mailto:notify@localhost` | VAPID-контакт (mailto:/https:), передаваемый push-сервисам. |
 | `webPush.stateFile` | string | пусто | Файл состояния для VAPID-ключей и подписок (по умолчанию `$DSH_HOME/plugin-notify-state.json`). |
+| `webPush.allowedHosts` | string[] | `[]` | Дополнительные доверенные хосты/маски push-эндпоинтов (по умолчанию строго разрешены Google FCM, Mozilla, Apple, Microsoft). |
 
 Сырой `http(s)://` в `webhooks.*` всё ещё отправляется с предупреждением. Перенесите URL в Credentials.
 

package/README.zh.md

@@ -158,6 +158,7 @@ dsh plugin --profile web add @goodandready/dsh-plugin-notify
 | `webPush.onlyWhenAway` | boolean | `true` | 有浏览器客户端连接时跳过网页推送。 |
 | `webPush.subject` | string | `mailto:notify@localhost` | 向推送服务公示的 VAPID 联系方式（mailto:/https:）。 |
 | `webPush.stateFile` | string | 空 | VAPID 密钥与订阅的状态文件（默认 `$DSH_HOME/plugin-notify-state.json`）。 |
+| `webPush.allowedHosts` | string[] | `[]` | 额外允许的推送端点域名或通配符列表（默认严格仅允许 Google FCM、Mozilla、Apple、Microsoft）。 |
 
 `webhooks.*` 中残留的原始 `http(s)://` 仍会发送，但会给出弃用警告。请迁移到凭据。
 

package/lib/index.js

@@ -1,5 +1,6 @@
 import { spawn } from 'node:child_process';
 import crypto from 'node:crypto';
+import net from 'node:net';
 import fs from 'node:fs';
 import fsp from 'node:fs/promises';
 import os from 'node:os';
@@ -62,6 +63,8 @@ export const Config = Schema.object({
             .description('VAPID subject (mailto: or https: contact URL) advertised to push services'),
         stateFile: Schema.string().default('').volatile()
             .description('State file for VAPID keys and push subscriptions (default: $DSH_HOME/plugin-notify-state.json)'),
+        allowedHosts: Schema.array(Schema.string()).default([]).volatile()
+            .description('Optional list of additional custom push endpoint hostnames or wildcards (e.g. push.mycorp.internal)'),
     }).description('Web Push (PWA) channel configuration'),
 });
 
@@ -398,25 +401,118 @@ export async function getVapidKeys(ctx, webPushConfig = {}) {
     return keys;
 }
 
-function isValidSubscription(sub) {
+export const DEFAULT_ALLOWED_PUSH_HOST_PATTERNS = [
+    // Google FCM / Android
+    /^fcm\.googleapis\.com$/i,
+    /^[a-z0-9-]+\.fcm\.googleapis\.com$/i,
+    /^android\.googleapis\.com$/i,
+    // Mozilla Firefox
+    /^updates\.push\.services\.mozilla\.com$/i,
+    /^(?:[a-z0-9-]+\.)*push\.services\.mozilla\.com$/i,
+    /^(?:[a-z0-9-]+\.)*autopush\.services\.mozilla\.com$/i,
+    // Apple Safari (macOS / iOS)
+    /^web\.push\.apple\.com$/i,
+    /^(?:[a-z0-9-]+\.)*push\.apple\.com$/i,
+    // Microsoft Windows / Edge WNS
+    /^(?:[a-z0-9-]+\.)*notify\.windows\.com$/i,
+    /^(?:[a-z0-9-]+\.)*wns\.windows\.com$/i,
+];
+
+let testAllowedPushHosts = null;
+/** Test seam: temporarily allow extra test push hosts or wildcards (e.g. push.example). */
+export function setAllowedPushHosts(hosts) {
+    testAllowedPushHosts = Array.isArray(hosts) ? hosts : (hosts ? [hosts] : null);
+}
+export function resetAllowedPushHosts() {
+    testAllowedPushHosts = null;
+}
+
+export function maskEndpoint(endpoint) {
+    if (typeof endpoint !== 'string') return '';
+    try {
+        const u = new URL(endpoint);
+        const parts = u.pathname.split('/').filter(Boolean);
+        const prefix = parts.slice(0, 2).join('/');
+        return `${u.protocol}//${u.host}/${prefix}${parts.length > 2 ? '/[masked]' : ''}`;
+    } catch {
+        return '[invalid-endpoint]';
+    }
+}
+
+export function isAllowedPushEndpoint(endpoint, customAllowedHosts = []) {
+    if (typeof endpoint !== 'string' || endpoint.length === 0 || endpoint.length > 2048) return false;
+    let url;
+    try {
+        url = new URL(endpoint);
+    } catch {
+        return false;
+    }
+    if (url.protocol !== 'https:') return false;
+    if (url.username || url.password) return false;
+    if (url.port && url.port !== '443') return false;
+
+    const host = url.hostname.toLowerCase().trim();
+    if (!host || host.length > 253) return false;
+    if (/[\s\x00-\x1f]/.test(host)) return false;
+
+    // Reject IP addresses (IPv4, IPv6, numeric, hex, octal, bracketed)
+    if (net.isIP(host) !== 0) return false;
+    if (/^(\d+|0x[0-9a-f]+)(\.(\d+|0x[0-9a-f]+)){0,3}$/i.test(host)) return false;
+    if (/^\[?[0-9a-f:]+\]?$/i.test(host)) return false;
+
+    const combinedCustom = [
+        ...(Array.isArray(customAllowedHosts) ? customAllowedHosts : []),
+        ...(Array.isArray(testAllowedPushHosts) ? testAllowedPushHosts : []),
+    ];
+
+    // Reject local / private TLDs unless explicitly permitted in custom allowed hosts
+    const blockedSuffixes = ['.localhost', '.local', '.internal', '.lan', '.home.arpa', '.invalid', '.test', '.example'];
+    if (host === 'localhost' || blockedSuffixes.some((s) => host.endsWith(s))) {
+        const explicitlyAllowed = combinedCustom.some((c) => typeof c === 'string' && c.toLowerCase().trim() === host);
+        if (!explicitlyAllowed) return false;
+    }
+
+    if (DEFAULT_ALLOWED_PUSH_HOST_PATTERNS.some((re) => re.test(host))) return true;
+
+    for (const pattern of combinedCustom) {
+        if (!pattern || typeof pattern !== 'string') continue;
+        const p = pattern.toLowerCase().trim();
+        if (p.startsWith('*.')) {
+            const root = p.slice(2);
+            if (host === root || host.endsWith('.' + root)) return true;
+        } else if (host === p) {
+            return true;
+        }
+    }
+
+    return false;
+}
+
+export function isValidSubscription(sub, customAllowedHosts = []) {
     return Boolean(
         sub
         && typeof sub.endpoint === 'string'
-        && /^https:\/\//i.test(sub.endpoint)
+        && isAllowedPushEndpoint(sub.endpoint, customAllowedHosts)
         && sub.keys
         && typeof sub.keys.p256dh === 'string' && sub.keys.p256dh.length > 0
         && typeof sub.keys.auth === 'string' && sub.keys.auth.length > 0,
     );
 }
 
-export async function addSubscription(statePath, sub) {
-    if (!isValidSubscription(sub))
-        throw new Error('invalid push subscription (need https endpoint and keys.p256dh/auth)');
+export async function addSubscription(statePath, sub, allowedHosts = [], maxSubscriptions = 100) {
+    if (!isValidSubscription(sub, allowedHosts))
+        throw new Error('invalid push subscription (need https endpoint from allowed push service and keys.p256dh/auth)');
     const state = await loadState(statePath);
     const clean = { endpoint: sub.endpoint, keys: { p256dh: sub.keys.p256dh, auth: sub.keys.auth }, addedAt: Date.now() };
     const existing = state.subscriptions.findIndex((s) => s.endpoint === clean.endpoint);
-    if (existing >= 0) state.subscriptions[existing] = clean;
-    else state.subscriptions.push(clean);
+    if (existing >= 0) {
+        state.subscriptions[existing] = clean;
+    } else {
+        if (typeof maxSubscriptions === 'number' && maxSubscriptions > 0 && state.subscriptions.length >= maxSubscriptions) {
+            throw new Error(`push subscriptions limit reached (max ${maxSubscriptions})`);
+        }
+        state.subscriptions.push(clean);
+    }
     await saveState(statePath, state);
     return state.subscriptions.length;
 }
@@ -490,6 +586,11 @@ export function deliverWebPush(ctx, n, config = {}) {
         const payload = JSON.stringify(webPushPayload(n, config));
         let sent = 0;
         for (const sub of subscriptions) {
+            if (!isValidSubscription(sub, wp.allowedHosts)) {
+                await removeSubscription(statePath, sub.endpoint);
+                ctx?.logger?.warn?.(`[plugin-notify] pruned disallowed push subscription (${maskEndpoint(sub.endpoint)})`);
+                continue;
+            }
             try {
                 await webpush.sendNotification(sub, payload, {
                     vapidDetails: {
@@ -505,7 +606,8 @@ export function deliverWebPush(ctx, n, config = {}) {
                     await removeSubscription(statePath, sub.endpoint);
                     ctx?.logger?.info?.(`[plugin-notify] pruned dead push subscription (${error.statusCode})`);
                 } else {
-                    ctx?.logger?.warn?.(`[plugin-notify] web push send failed: ${String(error)}`);
+                    const maskedErr = String(error?.message || error).replace(/https:\/\/[^\s"'`]+/g, (m) => maskEndpoint(m));
+                    ctx?.logger?.warn?.(`[plugin-notify] web push send failed: ${maskedErr}`);
                 }
             }
         }
@@ -612,7 +714,7 @@ export async function handlePushSubscribe(req, res, targetCtx, getConfig) {
     }
     const statePath = resolveStatePath(cfg.webPush || {});
     try {
-        const count = await addSubscription(statePath, sub);
+        const count = await addSubscription(statePath, sub, cfg.webPush?.allowedHosts);
         targetCtx?.logger?.info?.(`[plugin-notify] push subscribed (${count} total)`);
         writeJson(res, 200, { ok: true, count });
     } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-plugin-notify",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "DSH plugin: audio chimes, cross-session toasts, desktop push, IM webhooks, and web push (PWA) for turn completion, errors, and approvals.",
   "license": "MIT",
   "type": "module",