@khanhcan148/mk 0.1.14 → 0.1.16

package/src/lib/download.js

@@ -17,15 +17,22 @@ const TARBALL_URL = `${GITHUB_API}/repos/${KIT_REPO}/tarball/${KIT_BRANCH}`;
  *  from crafted tarballs with large size fields. 50 MB is well above any kit file. */
 const MAX_ENTRY_SIZE = 50 * 1024 * 1024; // 52428800 bytes
 
+/** Hostnames allowed for kit downloads. Hoisted to module scope to avoid rebuilding on each call. */
+const ALLOWED_HOSTS = new Set(['github.com', 'api.github.com', 'codeload.github.com']);
+
+/** HTTP status codes that indicate a redirect. Hoisted to module scope alongside ALLOWED_HOSTS. */
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+
 /**
  * Validate that the download URL's hostname is a GitHub domain.
  * Prevents SSRF: caller-supplied URLs (e.g. tarballUrl from GitHub API JSON) could be
  * redirected to an attacker-controlled host, exfiltrating the Bearer token.
  * Allowed: api.github.com, *.github.com (e.g. codeload.github.com)
+ * Exported so that releases.js can validate tarball_url at the source.
  * @param {string} url
  * @throws {Error} if hostname is not a GitHub domain
  */
-function assertGitHubHostname(url) {
+export function assertGitHubHostname(url) {
   let parsed;
   try {
     parsed = new URL(url);
@@ -33,7 +40,6 @@ function assertGitHubHostname(url) {
     throw new Error(`SSRF guard: invalid URL "${url}"`);
   }
   const { hostname } = parsed;
-  const ALLOWED_HOSTS = new Set(['github.com', 'api.github.com', 'codeload.github.com']);
   if (!ALLOWED_HOSTS.has(hostname)) {
     throw new Error(
       `SSRF guard: URL hostname "${hostname}" is not allowed. ` +
@@ -289,12 +295,35 @@ export async function downloadAndExtractKit(token, opts = {}) {
         Authorization: `Bearer ${token}`,
         Accept: 'application/vnd.github.v3+json'
       },
-      redirect: 'follow'
+      // S1: Use redirect: 'manual' to prevent the Authorization header from being forwarded
+      // to the redirect target (e.g. codeload.github.com). We handle the redirect manually:
+      // validate the Location hostname, then re-fetch without the auth header.
+      redirect: 'manual'
     });
   } catch (err) {
     throw new Error(`Network connection failed: ${err.message}`);
   }
 
+  // Handle 3xx redirects: validate Location hostname, then re-fetch without auth header.
+  // This prevents the Bearer token from leaking to third-party servers via a compromised redirect.
+  if (REDIRECT_STATUSES.has(res.status)) {
+    const location = res.headers.get('location');
+    if (!location) {
+      throw new Error(`GitHub API redirect (${res.status}) had no Location header`);
+    }
+    // Validate the redirect target is a GitHub hostname before following
+    assertGitHubHostname(location);
+    try {
+      res = await fetch(location, {
+        // No Authorization header on the redirect target — the token is only for api.github.com
+        headers: { Accept: 'application/vnd.github.v3+json' },
+        redirect: 'follow'
+      });
+    } catch (err) {
+      throw new Error(`Network connection failed on redirect: ${err.message}`);
+    }
+  }
+
   if (!res.ok) {
     throw new Error(`GitHub API error: ${res.status} ${res.statusText}`);
   }

package/src/lib/releases.js

@@ -1,5 +1,6 @@
 import semver from 'semver';
 import { GITHUB_API, KIT_REPO } from './constants.js';
+import { assertGitHubHostname } from './download.js';
 
 // ---------------------------------------------------------------------------
 // GitHub Releases API helpers
@@ -53,6 +54,14 @@ export async function fetchLatestRelease(token) {
 
   const { tag_name: tag, body = null, tarball_url: tarballUrl } = data;
 
+  // S3: Validate tarball_url hostname before returning it to callers.
+  // A compromised GitHub API response could supply an attacker-controlled URL for SSRF.
+  try {
+    assertGitHubHostname(tarballUrl);
+  } catch {
+    return { available: false, reason: 'Tarball URL failed hostname validation' };
+  }
+
   // Parse version: try clean() first (handles v-prefix), then coerce() as fallback.
   // coerce('release-0.2.0') => '0.2.0', coerce('totally-not-semver') => null
   const version = semver.clean(tag) ?? (semver.coerce(tag) ? semver.coerce(tag).version : null);