@k2b/cloud 0.33.0 → 0.35.0

package/src/shared/network-address.ts

@@ -32,22 +32,12 @@ const UNSAFE_IPV4_RANGES: ReadonlyArray<readonly [string, number]> = [
   ["240.0.0.0", 4],
 ];
 
-const ipv6ToBigInt = (rawAddress: string): bigint | null => {
-  let address = rawAddress.toLowerCase().split("%")[0] ?? "";
-  if (address.includes(".")) {
-    const separator = address.lastIndexOf(":");
-    const ipv4 = ipv4ToNumber(address.slice(separator + 1));
-    if (separator < 0 || ipv4 === null) return null;
-    address = `${address.slice(0, separator)}:${(ipv4 >>> 16).toString(16)}:${(ipv4 & 0xffff).toString(16)}`;
-  }
+// Only canonical IPv6 from the WHATWG parser reaches this conversion.
+const ipv6ToBigInt = (address: string): bigint => {
   const halves = address.split("::");
-  if (halves.length > 2) return null;
   const left = halves[0] ? halves[0].split(":") : [];
   const right = halves[1] ? halves[1].split(":") : [];
-  const missing = halves.length === 2 ? 8 - left.length - right.length : 0;
-  if (missing < 0 || (halves.length === 1 && left.length !== 8)) return null;
-  const groups = [...left, ...Array.from({ length: missing }, () => "0"), ...right];
-  if (groups.length !== 8 || groups.some((group) => !/^[0-9a-f]{1,4}$/.test(group))) return null;
+  const groups = [...left, ...Array.from({ length: 8 - left.length - right.length }, () => "0"), ...right];
   return groups.reduce((value, group) => (value << 16n) | BigInt(`0x${group}`), 0n);
 };
 
@@ -57,51 +47,62 @@ const ipv6InRange = (address: bigint, base: bigint, bits: number): boolean => {
 };
 
 const UNSAFE_IPV6_RANGES: ReadonlyArray<readonly [bigint, number]> = [
-  [ipv6ToBigInt("::")!, 96],
-  [ipv6ToBigInt("64:ff9b::")!, 96],
-  [ipv6ToBigInt("64:ff9b:1::")!, 48],
-  [ipv6ToBigInt("100::")!, 64],
-  [ipv6ToBigInt("2001::")!, 32],
-  [ipv6ToBigInt("2001:2::")!, 48],
-  [ipv6ToBigInt("2001:db8::")!, 32],
-  [ipv6ToBigInt("2002::")!, 16],
-  [ipv6ToBigInt("3fff::")!, 20],
-  [ipv6ToBigInt("fc00::")!, 7],
-  [ipv6ToBigInt("fe80::")!, 10],
-  [ipv6ToBigInt("fec0::")!, 10],
-  [ipv6ToBigInt("ff00::")!, 8],
+  [ipv6ToBigInt("2001::"), 23],
+  [ipv6ToBigInt("2001:db8::"), 32],
+  [ipv6ToBigInt("2002::"), 16],
+  [ipv6ToBigInt("3fff::"), 20],
 ];
 
-export const normalizeNetworkHostname = (hostname: string): string =>
-  hostname
-    .toLowerCase()
-    .replace(/^\[|\]$/g, "")
-    .replace(/\.$/, "");
+export const normalizeNetworkHostname = (hostname: string): string => {
+  const lower = hostname.toLowerCase();
+  if (lower.startsWith("[") && lower.endsWith("]") && lower.includes(":")) return lower.slice(1, -1);
+  return lower.includes(":") ? lower : lower.replace(/\.$/, "");
+};
+
+// WHATWG's "ends in a number" rule: these hosts must parse as IPv4,
+// rather than falling back to DNS (including invalid octal and overflow).
+const endsInNumber = (hostname: string): boolean => {
+  const last = hostname.split(".").at(-1) ?? "";
+  return /^\d+$/.test(last) || /^0x[0-9a-f]*$/i.test(last);
+};
 
-export const networkAddressFamily = (rawAddress: string): 4 | 6 | null => {
+/** Parse all URL IP literal forms without DNS or server-only dependencies. */
+export const parseNetworkAddress = (rawAddress: string): { address: string; family: 4 | 6 } | null => {
   const address = normalizeNetworkHostname(rawAddress);
-  if (ipv4ToNumber(address) !== null) return 4;
-  return ipv6ToBigInt(address) !== null ? 6 : null;
+  const ipv6 = address.includes(":");
+  if (!address || /[\s/@\\?#%\[\]]/.test(address) || (!ipv6 && !endsInNumber(address))) return null;
+  try {
+    // URL implements legacy IPv4 (decimal, octal, hex and shortened forms),
+    // as well as IPv6 compression and dotted tails. Reject zone IDs above.
+    const parsed = new URL(`http://${ipv6 ? `[${address}]` : address}/`).hostname;
+    if (ipv6) return { address: normalizeNetworkHostname(parsed), family: 6 };
+    return ipv4ToNumber(parsed) !== null ? { address: parsed, family: 4 } : null;
+  } catch {
+    return null;
+  }
 };
 
+export const networkAddressFamily = (rawAddress: string): 4 | 6 | null => parseNetworkAddress(rawAddress)?.family ?? null;
+
 export const isUnsafeNetworkAddress = (rawAddress: string): boolean => {
-  const address = normalizeNetworkHostname(rawAddress);
-  const family = networkAddressFamily(address);
-  if (family === 4) return UNSAFE_IPV4_RANGES.some(([base, bits]) => ipv4InRange(address, base, bits));
-  if (family !== 6) return true;
-  const value = ipv6ToBigInt(address);
-  if (value === null) return true;
-  if (value >> 32n === 0xffffn) {
+  const literal = parseNetworkAddress(rawAddress);
+  if (!literal) return true;
+  if (literal.family === 4) return UNSAFE_IPV4_RANGES.some(([base, bits]) => ipv4InRange(literal.address, base, bits));
+  const value = ipv6ToBigInt(literal.address);
+  if (value >> 32n === 0xffffn || ipv6InRange(value, ipv6ToBigInt("64:ff9b::"), 96)) {
     const mapped = Number(value & 0xffffffffn);
-    const ipv4 = [mapped >>> 24, (mapped >>> 16) & 255, (mapped >>> 8) & 255, mapped & 255].join(".");
-    return isUnsafeNetworkAddress(ipv4);
+    return isUnsafeNetworkAddress([mapped >>> 24, (mapped >>> 16) & 255, (mapped >>> 8) & 255, mapped & 255].join("."));
   }
-  return UNSAFE_IPV6_RANGES.some(([base, bits]) => ipv6InRange(value, base, bits));
+  return !ipv6InRange(value, ipv6ToBigInt("2000::"), 3) || UNSAFE_IPV6_RANGES.some(([base, bits]) => ipv6InRange(value, base, bits));
 };
 
 export const isUnsafeNetworkHostname = (rawHostname: string): boolean => {
   const hostname = normalizeNetworkHostname(rawHostname);
   return (
-    hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "metadata.google.internal" || hostname.endsWith(".internal")
+    !hostname ||
+    ["localhost", "localhost.localdomain", "metadata", "metadata.google.internal", "instance-data"].includes(hostname) ||
+    [".localhost", ".internal", ".local", ".home.arpa"].some((suffix) => hostname.endsWith(suffix)) ||
+    /[%\[\]]/.test(hostname) ||
+    ((endsInNumber(hostname) || hostname.includes(":")) && !parseNetworkAddress(hostname))
   );
 };

package/src/ssr/Layout.tsx

@@ -11,9 +11,8 @@ import { getDateConfig } from "../server/time";
 import { dates } from "../shared";
 import { readThemePreferenceFromCookieHeader } from "../shared/theme";
 import AnnouncementBanners from "./AnnouncementBanners";
-import { appAppearanceStyle } from "./app-appearance";
+import { appAppearanceStyle, resolveCurrentApp } from "./app-appearance";
 import { resolveRuntimeRoute, visibleNavigationApps } from "./app-navigation";
-import type { GlobalSearchHelpApp } from "./GlobalSearchHelpDialog";
 import { getLayoutHelp } from "./help";
 import LayoutFooter from "./LayoutFooter";
 import LayoutHeader from "./LayoutHeader";
@@ -151,7 +150,7 @@ export default function Layout(props: LayoutProps) {
   const user = c.get("user");
   const pathname = new URL(c.req.raw.url).pathname;
   const currentRoute = resolveRuntimeRoute(runtime.apps, pathname);
-  const currentApp = currentRoute?.app;
+  const currentApp = resolveCurrentApp(runtime.apps, pathname);
   const registeredHelp = getLayoutHelp(c);
   const runtimeHelp = registeredHelp ? { documents: registeredHelp.documents, pageBase: registeredHelp.pageBase } : undefined;
   const workspaceLayout = resolveAppWorkspaceLayoutForSidebar(
@@ -164,17 +163,6 @@ export default function Layout(props: LayoutProps) {
   const searchLinks = Object.fromEntries(
     runtime.apps.flatMap((app) => (visibleAppIds.has(app.id) && app.searchLinks?.length ? [[app.id, app.searchLinks] as const] : [])),
   );
-  const searchHelpApps: GlobalSearchHelpApp[] = runtime.apps
-    .filter((app) => (app.searchTags?.length ?? 0) > 0)
-    .map((app) => ({
-      appId: app.id,
-      appName: app.name,
-      appIcon: app.icon,
-      help: app.searchHelp,
-      tags: [...new Set((app.searchTags ?? []).map((tag) => tag.toLowerCase()))],
-      tagHelp: [...(app.searchTagHelp ?? [])],
-    }))
-    .sort((a, b) => a.appName.localeCompare(b.appName));
   const settings = c.get("settings");
   const announcements = c.get("announcements");
   const appName = settings?.app?.name || "Cloud";
@@ -223,7 +211,7 @@ export default function Layout(props: LayoutProps) {
     theme,
     accent: currentApp?.appearance?.accent,
     searchLinks,
-    searchHelpApps,
+    appId: currentApp?.id,
   };
   if (focusMode) {
     return (

package/src/ssr/LayoutHelp.browser-harness.tsx

@@ -0,0 +1,43 @@
+import { LocaleProvider } from "@k2b/ui";
+import { render } from "solid-js/web";
+import type { HelpDocumentManifest, HelpDocumentPayload } from "../shared/help";
+import { LayoutHelpPage } from "./LayoutHelp";
+
+const documents: HelpDocumentManifest[] = Array.from({ length: 8 }, (_, index) => ({
+  id: `topic-${index}`,
+  title: `Topic ${index}`,
+  description: "Help browser fixture",
+  order: index,
+  url: `/api/help/topic-${index}`,
+  searchUrl: "/api/help/search",
+}));
+const html = Array.from(
+  { length: 8 },
+  (_, index) =>
+    `<h2 id="section-${index}" class="help-section-title" data-help-icon="ti ti-point">Section ${index}</h2>${Array.from({ length: 18 }, () => "<p>Read this guidance to finish the task and understand how the app works.</p>").join("")}`,
+).join("");
+window.fetch = Object.assign(
+  async (input: URL | RequestInfo) => {
+    await new Promise((resolve) => setTimeout(resolve, 80));
+    const path = String(input);
+    if (path.includes("/search")) return Response.json({ locale: "en", ids: ["topic-0", "topic-1"] });
+    const id = path.split("/").at(-1) ?? "topic-0";
+    const payload: HelpDocumentPayload = { id, locale: "en", title: id, markdown: "Help", html };
+    return Response.json(payload);
+  },
+  { preconnect: () => {} },
+);
+const main = document.querySelector<HTMLElement>(".layout-content-main");
+if (!main) throw new Error("Missing Layout main");
+const embedded = new URL(location.href).searchParams.has("embedded");
+const host = document.createElement("div");
+if (embedded) host.style.cssText = "width:360px;height:700px";
+main.append(host);
+render(
+  () => (
+    <LocaleProvider locale="en">
+      <LayoutHelpPage documents={documents} embedded={embedded} pageBase="/app/spaces/help" />
+    </LocaleProvider>
+  ),
+  host,
+);