@linxin666/dsh-remote-web-ui 0.3.13 → 0.3.15

package/src/loopback-proxy.ts

@@ -93,6 +93,17 @@ function pipeLoopbackHttp(
     }
     res.writeHead(upstreamRes.statusCode ?? 502, out)
     upstreamRes.pipe(res)
+    // Inner leg died mid-response (reset, truncation): tear the outer leg
+    // down instead of letting the truncated response raise an unhandled
+    // 'error' with no listener.
+    upstreamRes.on('error', () => { res.destroy() })
+    // Outer leg died before the response finished (phone left mid-request):
+    // reset the inner request so the loopback server stops working on a call
+    // nobody will read. Guarded so a normal completion never destroys a
+    // keep-alive socket the agent would reuse.
+    res.on('close', () => {
+      if (!upstreamRes.readableEnded) upstream.destroy()
+    })
   })
   upstream.on('error', () => {
     if (!res.headersSent) {
@@ -101,6 +112,10 @@ function pipeLoopbackHttp(
     }
     res.destroy()
   })
+  // The outer request aborted mid-body: reset the inner request instead of
+  // feeding it a truncated body that still gets processed (mirror of the
+  // upgrade path's two-leg teardown).
+  req.on('error', () => { upstream.destroy() })
   req.pipe(upstream)
 }
 

package/src/remote-api.ts

@@ -39,7 +39,6 @@ import {
 } from './remote-methods.ts'
 
 export {
-  DESKTOP_LAUNCHER_PATH,
   LOCAL_ONLY_PREFIXES,
   PLUGIN_MANAGER_PATH,
   REMOTE_API_PATHS,

package/src/remote-channel-boot.ts

@@ -59,7 +59,6 @@ export function buildRemoteChannelBootScript(rules: RemoteChannelRules = REMOTE_
     'function sf(p){' +
     'if(p.indexOf(R.pairPrefix)===0)return false;' +
     'if(p.indexOf(R.updatePrefix)===0)return false;' +
-    'if(p===R.desktopLauncherPrefix||p.indexOf(R.desktopLauncherPrefix+"/")===0)return false;' +
     'if(p===R.settingsBridgePrefix||p.indexOf(R.settingsBridgePrefix+"/")===0)return false;' +
     'if(p.indexOf(R.apiPrefix)===0)return true;' +
     'if(p.indexOf(R.sidebarPrefix)===0||p==="/sidebar")return true;' +

package/src/remote-channel-rules.ts

@@ -22,7 +22,6 @@ export interface RemoteChannelRules {
   readonly apiPrefix: string
   readonly pairPrefix: string
   readonly updatePrefix: string
-  readonly desktopLauncherPrefix: string
   readonly settingsBridgePrefix: string
   readonly sidebarPrefix: string
   readonly gitPrefix: string
@@ -42,7 +41,6 @@ export const REMOTE_CHANNEL_RULES: RemoteChannelRules = {
   apiPrefix: '/api/',
   pairPrefix: '/api/pair/',
   updatePrefix: '/api/update/',
-  desktopLauncherPrefix: '/api/dsh-desktop-launcher',
   settingsBridgePrefix: '/api/dsh-web-ui-settings',
   sidebarPrefix: '/sidebar/',
   gitPrefix: '/git/',

package/src/remote-methods.ts

@@ -45,9 +45,6 @@ export const REMOTE_UPGRADE_PATHS = [
 /** Plugin-manager HTTP prefix: install/remove stay physically local. */
 export const PLUGIN_MANAGER_PATH = '/api/plugin-manager'
 
-/** Desktop-launcher HTTP prefix: shortcut create and host shutdown stay physically local. */
-export const DESKTOP_LAUNCHER_PATH = '/api/dsh-desktop-launcher'
-
 /** Family settings-bridge HTTP prefix — re-exposed to paired devices (plain settings parity). */
 export const WEB_UI_SETTINGS_BRIDGE_PATH = '/api/dsh-web-ui-settings'
 
@@ -68,14 +65,12 @@ export const REMOTE_DEVICE_QUERY = 'device'
  * paired remote desktop may use the full host API (chat, sessions,
  * settings, credentials, presets — it is a full-control credential), but it
  * must not reach the machine-control planes: pairing control itself, the
- * dsh-web self-update installer, plugin install/remove, and desktop
- * launcher actions (host shutdown, shortcuts).
+ * dsh-web self-update installer, and plugin install/remove.
  */
 export const LOCAL_ONLY_PREFIXES: readonly string[] = [
   '/api/pair',
   '/api/update',
   PLUGIN_MANAGER_PATH,
-  DESKTOP_LAUNCHER_PATH,
 ] as const
 
 /**

package/src/routes.ts

@@ -66,6 +66,77 @@ export function isTrustedApiRequest(request: IncomingMessage, trustedHosts: read
   }
 }
 
+/**
+ * Test whether a hostname represents a private local-area network (RFC 1918 / ULA / mDNS / loopback).
+ * Supports pairing in container-bridged (Docker) or NAT-proxied topologies where the host
+ * machine's LAN IP or proxy domain differs from the container's internal sampled network interface.
+ */
+export function isPrivateOrLocalHostname(hostname: string): boolean {
+  const normalized = hostname.toLowerCase().trim()
+  if (
+    normalized === 'localhost' ||
+    normalized.endsWith('.local') ||
+    normalized.endsWith('.lan') ||
+    normalized.endsWith('.internal') ||
+    normalized.endsWith('.home.arpa')
+  ) {
+    return true
+  }
+  let ip = normalized
+  if (ip.startsWith('[') && ip.endsWith(']')) ip = ip.slice(1, -1)
+  if (ip === '::1' || ip === '127.0.0.1') return true
+  if (ip.startsWith('fc') || ip.startsWith('fd') || ip.startsWith('fe80')) return true
+  const parts = ip.split('.').map(Number)
+  if (parts.length === 4 && parts.every(n => Number.isInteger(n) && n >= 0 && n <= 255)) {
+    const [a, b] = parts
+    if (a === 10) return true
+    if (a === 127) return true
+    if (a === 169 && b === 254) return true
+    if (a === 172 && b >= 16 && b <= 31) return true
+    if (a === 192 && b === 168) return true
+  }
+  return false
+}
+
+/**
+ * Validates that an incoming request is non-cross-site (rejects cross-site fetch metadata
+ * and ensures Origin matches Host when present).
+ */
+export function isNonCrossSite(request: IncomingMessage): boolean {
+  if (request.headers['sec-fetch-site'] === 'cross-site') return false
+  const host = request.headers.host
+  if (typeof host !== 'string') return false
+  const origin = request.headers.origin
+  if (origin === undefined) return true
+  try {
+    const originUrl = new URL(origin)
+    const hostUrl = new URL(`http://${host}`)
+    return originUrl.host === hostUrl.host
+  } catch {
+    return false
+  }
+}
+
+/**
+ * The private-LAN fallback authority of a request: its Host header when the
+ * hostname is private/local (RFC 1918 / ULA / mDNS / loopback) and the
+ * browser markers are non-cross-site, else undefined. The accept paths and
+ * the lanFence fallback use this to serve container-bridged and reverse-proxy
+ * topologies whose Host is not among the advertised or configured authorities.
+ */
+function privateLanHostOf(request: IncomingMessage): string | undefined {
+  const host = request.headers.host
+  if (typeof host !== 'string') return undefined
+  let hostName = ''
+  try {
+    hostName = new URL(`http://${host}`).hostname
+  } catch {
+    return undefined
+  }
+  if (hostName === '' || !isPrivateOrLocalHostname(hostName) || !isNonCrossSite(request)) return undefined
+  return host
+}
+
 /** Cap on pairing request bodies (tokens and workspace ids are tiny). */
 const MAX_BODY_BYTES = 4096
 
@@ -85,6 +156,28 @@ export function acceptLimitKey(socketIp: string, forwarded: string | undefined,
   return `${bucket}|${socketIp}`
 }
 
+/**
+ * Cap on the dynamically trusted hosts (see {@link addBounded}): room for
+ * every legitimate router/proxy aliasing shape, small enough that a flood of
+ * distinct private Host headers cannot grow the table unboundedly.
+ */
+export const MAX_DYNAMIC_TRUSTED_HOSTS = 64
+
+/**
+ * FIFO-bounded Set insert: past `max` entries the oldest one is evicted
+ * (a Set iterates in insertion order). The dynamic trusted-host table is fed
+ * by caller-controlled Host headers, so it must stay bounded; an evicted
+ * legitimate host re-adds itself on that device's next gated request.
+ */
+export function addBounded(set: Set<string>, value: string, max: number): void {
+  if (set.has(value)) return
+  if (set.size >= max) {
+    const oldest = set.values().next().value
+    if (oldest !== undefined) set.delete(oldest)
+  }
+  set.add(value)
+}
+
 /**
  * The host authority of a configured public base URL, e.g. `foo.trycloudflare.com`
  * from `https://foo.trycloudflare.com`. Undefined when the URL does not parse —
@@ -339,8 +432,6 @@ export class PairingEventsStream {
 export interface PairRoutesDeps {
   /** The pairing service. */
   service: PairingService
-  /** The LAN IP literals the fence accepts (derived from the bind host). */
-  lanAddresses: readonly string[]
   /** Current desktop gate policy, re-read for every status response. */
   requirePairingForLan?: boolean | (() => boolean)
   /**
@@ -359,6 +450,8 @@ export interface PairRoutesDeps {
    * cookieless header/query credential). Undefined drops the route (tests).
    */
   indexDocument?: (deviceId: string) => Promise<string | undefined>
+  /** Extra trusted non-loopback hosts (from config or environment). */
+  trustedHosts?: readonly string[] | (() => readonly string[])
 }
 
 /**
@@ -367,21 +460,45 @@ export interface PairRoutesDeps {
  * @returns the exact routes to register on webServer.
  */
 export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
-  const { service, lanAddresses, requirePairingForLan = true } = deps
+  const { service, requirePairingForLan = true } = deps
   const pairingRequired = (): boolean => typeof requirePairingForLan === 'function'
     ? requirePairingForLan()
     : requirePairingForLan
   const events = new PairingEventsStream(service)
+  const dynamicTrustedHosts = new Set<string>()
 
   /** Loopback-only fence: the desktop panel's control endpoints. */
   const loopbackFence = (req: IncomingMessage): boolean => isTrustedApiRequest(req, [])
-  /** Phone-facing fence: loopback, the service's live LAN literals, or the configured public host. */
+  /** Phone-facing fence: loopback, the service's live LAN literals, configured public host, extra trusted hosts, or dynamically paired hosts. */
   const lanFence = (req: IncomingMessage): boolean => {
     const publicHost = publicHostOf(service.publicBaseUrl)
     // The service's LAN bases re-read per request: a hot rebind (the lan-bind
     // toggle) updates them mid-process, and the fence must follow.
     const bases = service.lanAddresses
-    return isTrustedApiRequest(req, publicHost === undefined ? bases : [...bases, publicHost])
+    const extraHosts = typeof deps.trustedHosts === 'function' ? deps.trustedHosts() : (deps.trustedHosts ?? [])
+    const combined = [
+      ...bases,
+      ...(publicHost !== undefined ? [publicHost] : []),
+      ...extraHosts,
+      ...dynamicTrustedHosts,
+    ]
+    if (isTrustedApiRequest(req, combined)) return true
+
+    // If request carries a valid paired device cookie from a private LAN host (e.g. after service restart), trust and remember it
+    const privateLanHost = privateLanHostOf(req)
+    if (privateLanHost !== undefined) {
+      const cookieDeviceId = readCookie(req.headers.cookie, service.config.cookieName)
+      let queryDeviceId: string | null = null
+      try {
+        queryDeviceId = new URL(req.url ?? '/', 'http://pair.invalid').searchParams.get('device')
+      } catch {}
+      const deviceId = cookieDeviceId ?? queryDeviceId ?? undefined
+      if (deviceId !== undefined && service.hasDevice(deviceId)) {
+        addBounded(dynamicTrustedHosts, privateLanHost, MAX_DYNAMIC_TRUSTED_HOSTS)
+        return true
+      }
+    }
+    return false
   }
 
   const requireMethod = (req: IncomingMessage, res: ServerResponse, method: string): boolean => {
@@ -476,7 +593,8 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
 
   const handleAccept = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
     if (!requireMethod(req, res, 'POST')) return
-    if (!lanFence(req)) {
+    const privateLanHost = privateLanHostOf(req)
+    if (!lanFence(req) && privateLanHost === undefined) {
       writeJson(res, 403, { ok: false, code: 'forbidden' })
       return
     }
@@ -493,9 +611,16 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
     const ua = req.headers['user-agent']
     const result = service.accept(payload.token, typeof ua === 'string' ? ua : undefined)
     if (!result.ok) {
+      if (!lanFence(req)) {
+        writeJson(res, 403, { ok: false, code: 'forbidden' })
+        return
+      }
       writeJson(res, result.code === 'used' ? 409 : 404, { ok: false, code: result.code })
       return
     }
+    if (privateLanHost !== undefined) {
+      addBounded(dynamicTrustedHosts, privateLanHost, MAX_DYNAMIC_TRUSTED_HOSTS)
+    }
     // No Secure attribute: LAN pairing runs over plain HTTP (the cookie must
     // work there), and the same cookie rides HTTPS on the tunnel. Lax keeps
     // top-level navigations working while blocking cross-site subrequests.
@@ -612,7 +737,8 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
    */
   const handleAcceptPage = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
     if (!requireMethod(req, res, 'GET')) return
-    if (!lanFence(req)) {
+    const privateLanHost = privateLanHostOf(req)
+    if (!lanFence(req) && privateLanHost === undefined) {
       res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8' })
       res.end('forbidden')
       return
@@ -627,6 +753,11 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
     const ua = req.headers['user-agent']
     const result = token === '' ? { ok: false as const, code: 'invalid' as const } : service.accept(token, typeof ua === 'string' ? ua : undefined)
     if (!result.ok) {
+      if (!lanFence(req)) {
+        res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8' })
+        res.end('forbidden')
+        return
+      }
       // accept() now refuses only expired/unknown/stopped tokens: a consumed
       // token stays re-usable until its expiry or replacement, so a mobile
       // flow that split across cookie contexts (camera preview, in-app
@@ -646,6 +777,9 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
       res.end(pairingFailurePage())
       return
     }
+    if (privateLanHost !== undefined) {
+      addBounded(dynamicTrustedHosts, privateLanHost, MAX_DYNAMIC_TRUSTED_HOSTS)
+    }
     // Land the paired device on the cookieless app page: the official shell
     // served by this plugin, with the device id in the URL. No harness index
     // gate, no browser-auth cookie hop - the channel gate accepts the device