@goodandready/dsh-subscriptions 0.6.54 → 0.6.55

package/lib/http.js

@@ -1,3 +1,5 @@
+import { timingSafeEqual } from 'node:crypto'
+
 export function writeJson(res, code, body) {
   try {
     res.writeHead(code, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' })
@@ -12,6 +14,14 @@ export function writeHtml(res, code, html) {
   } catch { /* socket closed */ }
 }
 
+export function timingSafeCompare(a, b) {
+  if (typeof a !== 'string' || typeof b !== 'string') return false
+  const bufA = Buffer.from(a, 'utf8')
+  const bufB = Buffer.from(b, 'utf8')
+  if (bufA.length !== bufB.length) return false
+  return timingSafeEqual(bufA, bufB)
+}
+
 export function readBody(req, maxBytes = 64 * 1024) {
   return new Promise((resolve, reject) => {
     const chunks = []
@@ -126,11 +136,11 @@ export function isTrustedSettingsRequest(request, targetCtx) {
   // 5. Loopback request (CLI, local daemon, localhost test)
   if (isLoopback(request)) return true
 
-  // 6. Verified server secret token with exact cookie matching (#374)
+  // 6. Verified server secret token with exact cookie matching (#374, #492)
   const expectedToken = process.env.DSH_AUTH_TOKEN
   if (expectedToken) {
     const auth = headers.authorization
-    if (typeof auth === 'string' && auth.startsWith('Bearer ') && auth.slice(7).trim() === expectedToken) {
+    if (typeof auth === 'string' && auth.startsWith('Bearer ') && timingSafeCompare(auth.slice(7).trim(), expectedToken)) {
       return true
     }
     const cookieHeader = headers.cookie
@@ -142,7 +152,7 @@ export function isTrustedSettingsRequest(request, targetCtx) {
           cookies[part.slice(0, eq).trim()] = part.slice(eq + 1).trim()
         }
       }
-      if (cookies.token === expectedToken || cookies.dsh_token === expectedToken) {
+      if (timingSafeCompare(cookies.token, expectedToken) || timingSafeCompare(cookies.dsh_token, expectedToken)) {
         return true
       }
     }
@@ -261,10 +271,12 @@ export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs =
       clearTimeout(timer)
       return res
     }
+    if (typeof timer?.unref === 'function') timer.unref()
     const origJson = typeof res.json === 'function' ? res.json.bind(res) : null
     const origText = typeof res.text === 'function' ? res.text.bind(res) : null
     if (origJson) {
       res.json = () => {
+        if (typeof timer?.ref === 'function') timer.ref()
         if (controller.signal.aborted) {
           return Promise.reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
         }
@@ -292,6 +304,7 @@ export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs =
     }
     if (origText) {
       res.text = () => {
+        if (typeof timer?.ref === 'function') timer.ref()
         if (controller.signal.aborted) {
           return Promise.reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
         }

package/lib/index.js

@@ -442,10 +442,8 @@ export function apply(ctx, rawConfig) {
       }
     }
     tick().catch(() => {})
-    const timer = setInterval
-    const clear = clearInterval
-    const id = timer(() => { tick().catch(() => {}) }, 60 * 1000)
-    return () => clear(id)
+    const id = setInterval(() => { tick().catch(() => {}) }, 60 * 1000)
+    return () => clearInterval(id)
   }, 'dsh-subscriptions: refresh ahead')
 
   // Background health-check probe loop

package/lib/routes/oauth.js

@@ -31,6 +31,10 @@ export function registerOauthRoutes(ctx, state) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
         return
       }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
       const q = queryOf(req)
       const provider = q.get('provider') || ''
       const index = Number(q.get('index') || '1')

package/lib/routes/status.js

@@ -354,7 +354,7 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'localhost only' } })
         return
       }
-      const limit = Math.min(Number(queryOf(req).get('limit') || '10'), 100)
+      const limit = Math.max(1, Math.min(Number(queryOf(req).get('limit') || '10'), 100))
       writeJson(res, 200, { ok: true, total: history.size(), items: history.recent(limit) })
     }),
   }), 'dsh-subscriptions: /history')
@@ -502,7 +502,7 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
         return
       }
-      const limit = Math.min(Number(queryOf(req).get('limit') || '50'), 100)
+      const limit = Math.max(1, Math.min(Number(queryOf(req).get('limit') || '50'), 100))
       writeJson(res, 200, { ok: true, alerts: getRecentAlerts(limit) })
     }),
   }), 'dsh-subscriptions: /alerts')

package/lib/subscriptions.js

@@ -18,9 +18,16 @@ export function isAllowed(provider, path) {
   let p = String(path || "")
   // strip query and hash
   p = p.split("?")[0].split("#")[0]
+  if (p.startsWith("//")) return false
   try {
-    if (p.startsWith("http://") || p.startsWith("https://")) p = new URL(p).pathname
-  } catch { /* ignore subscriptions error */ }
+    if (p.startsWith("http://") || p.startsWith("https://")) {
+      p = new URL(p).pathname
+    } else {
+      p = new URL(p.startsWith("/") ? p : "/" + p, "http://localhost").pathname
+    }
+  } catch {
+    return false
+  }
   if (!p.startsWith("/")) p = "/" + p
   for (const allowed of list) {
     const a = allowed.split("?")[0]
@@ -88,6 +95,11 @@ export function createSubscriptionsService(deps) {
         throw err
       }
       const rawPath = String(path || "")
+      if (rawPath.startsWith("//")) {
+        const err = new Error("protocol-relative URL rejected: " + rawPath)
+        err.code = "FORBIDDEN"
+        throw err
+      }
       if (rawPath.startsWith("http://") || rawPath.startsWith("https://")) {
         const initialCfg = typeof deps.vendorConfig === "function" ? deps.vendorConfig(provider) : {}
         const initialBase = baseFor(provider, initialCfg || {})
@@ -131,23 +143,57 @@ export function createSubscriptionsService(deps) {
           const blob = await deps.ensureFresh(provider, await deps.loadBlob(account.ref), account.ref)
           const cfg = deps.vendorConfig(provider)
           const base = baseFor(provider, cfg)
-          // normalize path
-          let p = String(path)
-          if (p.startsWith("http://") || p.startsWith("https://")) {
-            // #445: enforce provider origin policy before Bearer dispatch
-            let targetOrigin, baseOrigin
-            try { targetOrigin = new URL(p).origin } catch { /* ignore */ }
-            try { baseOrigin = new URL(base).origin } catch { /* ignore */ }
-            if (!targetOrigin || !baseOrigin || targetOrigin.toLowerCase() !== baseOrigin.toLowerCase()) {
-              const err = new Error("external origin rejected for provider " + provider + ": " + p)
+
+          // normalize path and resolve target URL (#487)
+          let targetUrl
+          let baseOrigin = ""
+          let basePath = ""
+          try {
+            const bUrl = new URL(base)
+            baseOrigin = bUrl.origin
+            basePath = bUrl.pathname.replace(/\/$/, "")
+          } catch { /* ignore */ }
+
+          const isAbsolute = rawPath.startsWith("http://") || rawPath.startsWith("https://")
+          try {
+            if (isAbsolute) {
+              targetUrl = new URL(rawPath)
+            } else {
+              const cleanRel = rawPath.startsWith("/") ? rawPath : "/" + rawPath
+              if (basePath && (cleanRel === basePath || cleanRel.startsWith(basePath + "/"))) {
+                targetUrl = new URL(baseOrigin + cleanRel)
+              } else {
+                const cleanBase = base.replace(/\/$/, "")
+                targetUrl = new URL(cleanBase + cleanRel)
+              }
+            }
+          } catch {
+            const err = new Error("invalid URL for " + provider + ": " + rawPath)
+            err.code = "FORBIDDEN"
+            throw err
+          }
+
+          if (!baseOrigin || targetUrl.origin.toLowerCase() !== baseOrigin.toLowerCase()) {
+            const err = new Error("external origin rejected for provider " + provider + ": " + rawPath)
+            err.code = "FORBIDDEN"
+            throw err
+          }
+
+          if (!isAbsolute) {
+            if (basePath && targetUrl.pathname !== basePath && !targetUrl.pathname.startsWith(basePath + "/")) {
+              const err = new Error("path traversal rejected for provider " + provider + ": " + rawPath)
               err.code = "FORBIDDEN"
               throw err
             }
-          } else {
-            if (!p.startsWith("/")) p = "/" + p
-            p = base + p
           }
-          const url = p
+
+          if (!isAllowed(provider, targetUrl.pathname)) {
+            const err = new Error("path not allowed for " + provider + ": " + targetUrl.pathname)
+            err.code = "FORBIDDEN"
+            throw err
+          }
+
+          const url = targetUrl.toString()
           const extraHeaders = headersFor(provider, blob, cfg)
           const fetchImpl = pickFetch(deps, account.ref)
           const requestTimeoutMs = Number(timeoutMs) > 0 ? Number(timeoutMs) : 30000

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.54",
+  "version": "0.6.55",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",