@linxin666/dsh-remote-web-ui 0.3.18 → 0.3.19

package/lib/index.js

@@ -702,6 +702,27 @@ function writeJson(res, status, body, headers = {}) {
 * browser markers are same-origin.
 */
 function isTrustedApiRequest(request, trustedHosts) {
+	if (!isTrustedHost(request, trustedHosts)) return false;
+	if (request.headers["sec-fetch-site"] === "cross-site") return false;
+	const origin = request.headers.origin;
+	if (origin === void 0) return true;
+	try {
+		return new URL(origin).host === new URL(`http://${request.headers.host ?? ""}`).host;
+	} catch {
+		return false;
+	}
+}
+/**
+* Whether the request's Host is an authority this surface serves: loopback, or
+* a trusted entry (exact `host:port`, or port-less `host` matching any port).
+* The browser-marker checks stay in {@link isTrustedApiRequest}: a pairing
+* entry page is a navigation, and its authority is the token or device
+* credential it carries, not who linked to it.
+* @param request - the node HTTP request.
+* @param trustedHosts - non-loopback authorities this surface serves.
+* @returns true when the Host is ours.
+*/
+function isTrustedHost(request, trustedHosts) {
 	const host = request.headers.host;
 	if (typeof host !== "string") return false;
 	let hostUrl;
@@ -711,18 +732,24 @@ function isTrustedApiRequest(request, trustedHosts) {
 		return false;
 	}
 	const hostname = hostUrl.hostname;
-	if (!(isLoopbackClient(request) || trustedHosts.some((entry) => {
+	return isLoopbackClient(request) || trustedHosts.some((entry) => {
 		const entryUrl = new URL(`http://${entry}`);
 		return entryUrl.port === "" ? entryUrl.hostname === hostname : entryUrl.host === hostUrl.host;
-	}))) return false;
-	if (request.headers["sec-fetch-site"] === "cross-site") return false;
-	const origin = request.headers.origin;
-	if (origin === void 0) return true;
-	try {
-		return new URL(origin).host === hostUrl.host;
-	} catch {
-		return false;
-	}
+	});
+}
+/**
+* Whether the request is a top-level document navigation — the shape every
+* phone uses to open a pairing link. Browsers label it `Sec-Fetch-Mode:
+* navigate` with `Sec-Fetch-Dest: document`; in-app browsers (WeChat, and
+* anything else wrapping a WKWebView) additionally attach `Sec-Fetch-Site:
+* cross-site` or an opaque `Origin: null`, which the API fence must keep
+* refusing but which says nothing about a document navigation: the pairing
+* token or the device id in the URL is what authorizes it.
+* @param request - the node HTTP request.
+* @returns true for a top-level document navigation.
+*/
+function isTopLevelDocumentNavigation(request) {
+	return request.headers["sec-fetch-mode"] === "navigate" && request.headers["sec-fetch-dest"] === "document";
 }
 /**
 * Test whether a hostname represents a private local-area network (RFC 1918 / ULA / mDNS / loopback).
@@ -772,7 +799,7 @@ function isNonCrossSite(request) {
 * the lanFence fallback use this to serve container-bridged and reverse-proxy
 * topologies whose Host is not among the advertised or configured authorities.
 */
-function privateLanHostOf(request) {
+function privateLanHostOf(request, navigation = false) {
 	const host = request.headers.host;
 	if (typeof host !== "string") return void 0;
 	let hostName = "";
@@ -781,7 +808,8 @@ function privateLanHostOf(request) {
 	} catch {
 		return;
 	}
-	if (hostName === "" || !isPrivateOrLocalHostname(hostName) || !isNonCrossSite(request)) return void 0;
+	if (hostName === "" || !isPrivateOrLocalHostname(hostName)) return void 0;
+	if (!(navigation && isTopLevelDocumentNavigation(request)) && !isNonCrossSite(request)) return void 0;
 	return host;
 }
 /** Cap on pairing request bodies (tokens and workspace ids are tiny). */
@@ -800,6 +828,31 @@ function acceptLimitKey(socketIp, forwarded, bucket) {
 	return `${bucket}|${socketIp}`;
 }
 /**
+* Reasons a phone-facing entry page refused a request, logged once per shape
+* so a real device failure is diagnosable from the host console without a
+* debug build. Keyed by `reason|host|path`; bounded by construction (a handful
+* of reasons, and only the first occurrence of each is printed).
+*/
+const loggedEntryRefusals = /* @__PURE__ */ new Set();
+/**
+* Log one entry-page refusal (first occurrence per shape) and cap the set.
+* @param request - the refused request.
+* @param path - the entry path that refused it.
+* @param reason - why the fence refused.
+*/
+function logEntryRefusal(request, path, reason) {
+	const key = `${reason}|${request.headers.host ?? ""}|${path}`;
+	if (loggedEntryRefusals.has(key) || loggedEntryRefusals.size >= 64) return;
+	loggedEntryRefusals.add(key);
+	const markers = [
+		`sec-fetch-site=${request.headers["sec-fetch-site"] ?? "-"}`,
+		`sec-fetch-mode=${request.headers["sec-fetch-mode"] ?? "-"}`,
+		`sec-fetch-dest=${request.headers["sec-fetch-dest"] ?? "-"}`,
+		`origin=${request.headers.origin ?? "-"}`
+	].join(" ");
+	console.log(`remote-web-ui: refused ${path} from host ${request.headers.host ?? "-"} (${reason}; ${markers})`);
+}
+/**
 * FIFO-bounded Set insert: past `max` entries the oldest one is evicted
 * (a Set iterates in insertion order). The dynamic trusted-host table is fed
 * by caller-controlled Host headers, so it must stay bounded; an evicted
@@ -1053,18 +1106,24 @@ function makeRoutes(deps) {
 	const dynamicTrustedHosts = /* @__PURE__ */ new Set();
 	/** Loopback-only fence: the desktop panel's control endpoints. */
 	const loopbackFence = (req) => isTrustedApiRequest(req, []);
-	/** Phone-facing fence: loopback, the service's live LAN literals, configured public host, extra trusted hosts, or dynamically paired hosts. */
-	const lanFence = (req) => {
+	/**
+	* Phone-facing fence: loopback, the service's live LAN literals, configured
+	* public host, extra trusted hosts, or dynamically paired hosts. `navigation`
+	* relaxes the browser-marker checks for a top-level document navigation (the
+	* pairing entry pages), never for an API or subresource request.
+	*/
+	const lanFence = (req, navigation = false) => {
 		const publicHost = publicHostOf(service.publicBaseUrl);
 		const bases = service.lanAddresses;
 		const extraHosts = typeof deps.trustedHosts === "function" ? deps.trustedHosts() : deps.trustedHosts ?? [];
-		if (isTrustedApiRequest(req, [
+		const combined = [
 			...bases,
 			...publicHost !== void 0 ? [publicHost] : [],
 			...extraHosts,
 			...dynamicTrustedHosts
-		])) return true;
-		const privateLanHost = privateLanHostOf(req);
+		];
+		if (navigation && isTopLevelDocumentNavigation(req) ? isTrustedHost(req, combined) : isTrustedApiRequest(req, combined)) return true;
+		const privateLanHost = privateLanHostOf(req, navigation);
 		if (privateLanHost !== void 0) {
 			const cookieDeviceId = readCookie(req.headers.cookie, service.config.cookieName);
 			let queryDeviceId = null;
@@ -1349,8 +1408,9 @@ function makeRoutes(deps) {
 	*/
 	const handleAcceptPage = async (req, res) => {
 		if (!requireMethod(req, res, "GET")) return;
-		const privateLanHost = privateLanHostOf(req);
-		if (!lanFence(req) && privateLanHost === void 0) {
+		const privateLanHost = privateLanHostOf(req, true);
+		if (!lanFence(req, true) && privateLanHost === void 0) {
+			logEntryRefusal(req, PAIR_PATHS.acceptPage, "untrusted-host");
 			res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
 			res.end("forbidden");
 			return;
@@ -1367,7 +1427,8 @@ function makeRoutes(deps) {
 			code: "invalid"
 		} : service.accept(token, typeof ua === "string" ? ua : void 0);
 		if (!result.ok) {
-			if (!lanFence(req)) {
+			if (!lanFence(req, true)) {
+				logEntryRefusal(req, PAIR_PATHS.acceptPage, "untrusted-host-after-invalid-token");
 				res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
 				res.end("forbidden");
 				return;
@@ -1407,7 +1468,8 @@ function makeRoutes(deps) {
 	*/
 	const handleAppPage = async (req, res) => {
 		if (!requireMethod(req, res, "GET")) return;
-		if (!lanFence(req)) {
+		if (!lanFence(req, true)) {
+			logEntryRefusal(req, PAIR_PATHS.appPage, "untrusted-host");
 			res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
 			res.end("forbidden");
 			return;
@@ -1455,7 +1517,7 @@ function makeRoutes(deps) {
 	*/
 	const handleAppServiceWorker = (req, res) => {
 		if (!requireMethod(req, res, "GET")) return;
-		if (!lanFence(req)) {
+		if (!lanFence(req, true)) {
 			res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
 			res.end("forbidden");
 			return;
@@ -2885,10 +2947,28 @@ function quickTunnelFlags(originHostHeader) {
 		"--http-host-header": originHostHeader
 	};
 }
+/**
+* Command-line arguments for a named tunnel with a persistent Cloudflare token.
+* Note: `--no-autoupdate` and `--protocol` are flags for the `tunnel` command
+* and must appear BEFORE the `run` subcommand. Putting them after `run` causes
+* cloudflared to exit immediately with "flag provided but not defined: -no-autoupdate"
+* (issues #1432, #1433).
+*/
+function namedTunnelArgs(token) {
+	return [
+		"tunnel",
+		"--no-autoupdate",
+		"--protocol",
+		"http2",
+		"run",
+		"--token",
+		token
+	];
+}
 /** Default factory: the cloudflared package's quick and named tunnels. */
 function defaultFactory(target) {
 	if (target.kind === "quick") return Tunnel.quick(target.targetUrl, quickTunnelFlags(target.originHostHeader));
-	return namedTunnelHandle(Tunnel.withToken(target.token, { ...SHARED_TUNNEL_FLAGS }), target.publicUrl);
+	return namedTunnelHandle(new Tunnel(namedTunnelArgs(target.token)), target.publicUrl);
 }
 /** Node timers. */
 const nodeTimer = {
@@ -3424,10 +3504,27 @@ async function checkUpdates(deps) {
 const OUTPUT_CAP = 16 * 1024;
 /**
 * Windows cmd command-not-found stderr. With shell:true a missing shim
-* exits with code 1 (cmd cannot report ENOENT), so the fallback chain
-* detects this message instead of the spawn error event.
+* exits with code 1 or 9009 (cmd cannot report ENOENT), so the fallback chain
+* detects this message instead of the spawn error event. Supports both English
+* and localized (e.g. Chinese) cmd error messages.
 */
-const WIN_CMD_MISSING_RE = /not recognized as an internal or external command/i;
+const WIN_CMD_MISSING_RE = /not recognized as an internal or external command|不是内部或外部命令/i;
+/**
+* Decode process output with tolerant decoding:
+* Defaults to UTF-8; if invalid byte sequences are encountered (common on
+* Windows consoles using code page 936/GBK), falls back to GBK via TextDecoder.
+*/
+function decodeProcessChunk(chunk) {
+	try {
+		return new TextDecoder("utf-8", { fatal: true }).decode(chunk);
+	} catch {
+		try {
+			return new TextDecoder("gbk").decode(chunk);
+		} catch {
+			return chunk.toString("utf8");
+		}
+	}
+}
 /**
 * Bypass for pnpm 11's supply-chain gate: `minimumReleaseAge` (default 24 h)
 * silently skips same-day releases — `pnpm update --latest` then exits 0
@@ -3494,9 +3591,10 @@ function runUpdate(deps) {
 		let output = "";
 		let currentOutput = "";
 		const append = (chunk) => {
-			output += chunk.toString("utf8");
+			const text = decodeProcessChunk(chunk);
+			output += text;
 			if (output.length > OUTPUT_CAP) output = output.slice(output.length - OUTPUT_CAP);
-			currentOutput += chunk.toString("utf8");
+			currentOutput += text;
 			if (currentOutput.length > OUTPUT_CAP) currentOutput = currentOutput.slice(currentOutput.length - OUTPUT_CAP);
 		};
 		let currentChild;
@@ -3566,7 +3664,7 @@ function runUpdate(deps) {
 			});
 			child.on("close", (code) => {
 				if (settled || finished) return;
-				if (platform === "win32" && code !== 0 && WIN_CMD_MISSING_RE.test(currentOutput)) {
+				if (platform === "win32" && (code === 9009 || code !== 0 && WIN_CMD_MISSING_RE.test(currentOutput))) {
 					runCandidate(index + 1);
 					return;
 				}
@@ -3575,7 +3673,7 @@ function runUpdate(deps) {
 					ok: code === 0,
 					exitCode: code,
 					output,
-					error: code === 0 ? void 0 : "pnpm exited with code " + String(code),
+					error: code === 0 ? void 0 : `${candidate.command} exited with code ` + String(code),
 					...code === 0 ? {} : { errorCode: "pnpm-failed" }
 				});
 			});

package/lib/types/client/mobile-adapt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mobile-adapt.d.ts","sourceRoot":"","sources":["../../../src/client/mobile-adapt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAE7C,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,IAAI,CAAA;IACpB,yDAAyD;IACzD,aAAa,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAClC,yDAAyD;IACzD,YAAY,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IACjC;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,KAAK,MAAM,CAAC,GAAG,IAAI,CAAA;IAC9C,wEAAwE;IACxE,UAAU,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7B,4GAA4G;IAC5G,iBAAiB,IAAI,IAAI,CAAA;CAC1B;AA+ND;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAqqBvC"}
+{"version":3,"file":"mobile-adapt.d.ts","sourceRoot":"","sources":["../../../src/client/mobile-adapt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAE7C,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,IAAI,CAAA;IACpB,yDAAyD;IACzD,aAAa,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAClC,yDAAyD;IACzD,YAAY,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IACjC;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,KAAK,MAAM,CAAC,GAAG,IAAI,CAAA;IAC9C,wEAAwE;IACxE,UAAU,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7B,4GAA4G;IAC5G,iBAAiB,IAAI,IAAI,CAAA;CAC1B;AA+PD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CA0zBvC"}