@goodandready/dsh-subscriptions 0.6.21 → 0.6.23

package/lib/http.js

@@ -30,47 +30,94 @@ export function readBody(req, maxBytes = 64 * 1024) {
   })
 }
 
+function isLoopbackIPv4(address) {
+  if (!address.startsWith('127.')) return false
+  const parts = address.split('.')
+  if (parts.length !== 4) return false
+  return parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255)
+}
+
+function peerAddress(req) {
+  try {
+    const socket = req && req.socket
+    const address = socket && (socket.remoteAddress || (socket._peername && socket._peername.address))
+    return typeof address === 'string' ? address.toLowerCase() : ''
+  } catch {
+    return ''
+  }
+}
+
 export function isLoopback(value) {
-  const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
+  if (value && typeof value === 'object' && (value.socket || value.headers)) {
+    const address = peerAddress(value)
+    if (address) {
+      if (address === '::1' || address === 'localhost') return true
+      if (address.startsWith('::ffff:')) return isLoopbackIPv4(address.slice('::ffff:'.length))
+      return isLoopbackIPv4(address)
+    }
+    if (!value.socket) {
+      const host = (value.headers?.host || '').split(':')[0].toLowerCase()
+      if (host === 'localhost' || host === '127.0.0.1' || host === '::1') return true
+    }
+    return false
+  }
+  const address = String(value || '').toLowerCase().replace(/^\[|\]$/g, '')
   return address === 'localhost' || address === 'localhost.' || address === '::1'
-    || address?.startsWith('127.') === true
-    || address?.startsWith('::ffff:127.') === true
+    || address.startsWith('127.')
+    || address.startsWith('::ffff:127.')
 }
 
 /**
  * @param {import('node:http').IncomingMessage} request
  * @returns {boolean}
- * Reject cross-site writes. Do not require loopback: Web UI is used over LAN and reverse proxies. */
+ * Reject cross-site and untrusted writes and sensitive reads.
+ * Fail-closed: must be loopback, same-origin/same-site, or matching Origin/Referer.
+ */
 export function isTrustedSettingsRequest(request) {
   const headers = request?.headers || {}
-  const secFetchSite = headers['sec-fetch-site']
-  if (secFetchSite) {
-    return secFetchSite !== 'cross-site'
-  }
+
+  // 1. Explicit cross-site fetch is always rejected
+  const secFetchSite = String(headers['sec-fetch-site'] || '').toLowerCase()
+  if (secFetchSite === 'cross-site') return false
+
+  // 2. If origin header is present, it must match host
   const host = headers.host || headers['x-forwarded-host']
   const origin = headers.origin
   if (origin) {
     try {
       const u = new URL(origin)
-      if (host && u.host.toLowerCase() !== host.toLowerCase()) {
+      if (!host || u.host.toLowerCase() !== host.toLowerCase()) {
         return false
       }
     } catch {
       return false
     }
   }
+
+  // 3. If referer header is present and no origin, referer must match host
   const referer = headers.referer
   if (!origin && referer) {
     try {
       const u = new URL(referer)
-      if (host && u.host.toLowerCase() !== host.toLowerCase()) {
+      if (!host || u.host.toLowerCase() !== host.toLowerCase()) {
         return false
       }
     } catch {
       return false
     }
   }
-  return true
+
+  // 4. Same-origin or same-site browser fetch
+  if (secFetchSite === 'same-origin' || secFetchSite === 'same-site') return true
+
+  // 5. Origin or referer was present and matched host
+  if (origin || referer) return true
+
+  // 6. No origin headers: trust only if demonstrably loopback
+  if (isLoopback(request)) return true
+
+  // 7. Otherwise fail-closed
+  return false
 }
 
 export function queryOf(req) {