@miraj181/ipingyou 2.1.6 → 2.1.15

package/src/lib/ssh.js

@@ -1,11 +1,26 @@
 import crypto from 'node:crypto';
 
+const SAFE_HOSTNAME_PATTERN = /^(?=.{1,253}$)(?!.*\.\.)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+
+export function assertSafeHostname(hostname, label = 'hostname') {
+  const normalized = String(hostname || '').trim().replace(/\.$/, '').toLowerCase();
+  if (!normalized || !SAFE_HOSTNAME_PATTERN.test(normalized)) {
+    throw new Error(`Invalid ${label}`);
+  }
+  return normalized;
+}
+
 export function extractHostname(url) {
+  let parsed;
   try {
-    return new URL(url).hostname;
+    parsed = new URL(url);
   } catch {
-    return url.replace(/^https?:\/\//, '').replace(/\/$/, '');
+    throw new Error('Invalid tunnel URL');
   }
+  if (parsed.protocol !== 'https:') {
+    throw new Error('Tunnel URL must use HTTPS');
+  }
+  return assertSafeHostname(parsed.hostname, 'tunnel hostname');
 }
 
 export function quoteRemoteShell(value) {
@@ -25,8 +40,9 @@ export function formatScpRemotePath(remotePath) {
 }
 
 export function getSshControlOptions(hostname) {
+  const safeHostname = assertSafeHostname(hostname, 'ssh hostname');
   if (process.platform === 'win32') return [];
-  const hash = crypto.createHash('sha1').update(hostname).digest('hex').slice(0, 10);
+  const hash = crypto.createHash('sha256').update(safeHostname).digest('hex').slice(0, 10);
   return [
     '-o', 'ControlMaster=auto',
     '-o', 'ControlPersist=5m',
@@ -34,6 +50,11 @@ export function getSshControlOptions(hostname) {
   ];
 }
 
+export function buildProxyCommandOption(hostname) {
+  const safeHostname = assertSafeHostname(hostname, 'tunnel hostname');
+  return ['-o', `ProxyCommand=cloudflared access tcp --hostname ${safeHostname}`];
+}
+
 export function getKnownHostsOptions(persistKnownHosts = true) {
   if (persistKnownHosts) {
     return ['-o', 'StrictHostKeyChecking=accept-new'];
@@ -48,9 +69,8 @@ export function getKnownHostsOptions(persistKnownHosts = true) {
 
 export function buildSshArgs(hostname, privateKeyPath, extraOptions = [], options = {}) {
   const { persistKnownHosts = true } = options;
-  const proxyCommand = `cloudflared access tcp --hostname ${hostname}`;
   const sshArgs = [
-    '-o', `ProxyCommand=${proxyCommand}`,
+    ...buildProxyCommandOption(hostname),
     ...getKnownHostsOptions(persistKnownHosts),
     '-o', 'IdentitiesOnly=yes',
     ...getSshControlOptions(hostname),

package/src/lib/tunnel.js

@@ -15,6 +15,7 @@ export async function spawnTunnelSupervised(targetUrl, onUrlGenerated) {
         activeChild = execa('cloudflared', ['tunnel', '--url', targetUrl], {
           reject: false,
           all: true,
+          buffer: false,
         });
 
         trackPID(activeChild.pid);

package/src/lib/worker-runtime.js

@@ -0,0 +1,81 @@
+import { Worker } from 'node:worker_threads';
+
+const workerUrl = new URL('./workers/crypto-checksum-worker.js', import.meta.url);
+const workersDisabled = process.env.IPINGYOU_DISABLE_WORKERS === '1';
+const MAX_PENDING_TASKS = 128;
+
+let worker = null;
+let requestCounter = 0;
+const pending = new Map();
+
+function resetWorker(err) {
+  for (const { reject } of pending.values()) {
+    reject(err);
+  }
+  pending.clear();
+  worker = null;
+}
+
+function ensureWorker() {
+  if (worker || workersDisabled) return worker;
+
+  worker = new Worker(workerUrl, {
+    resourceLimits: {
+      maxOldGenerationSizeMb: 128,
+    },
+  });
+  worker.unref();
+
+  worker.on('message', (message) => {
+    const { id, ok, result, error } = message || {};
+    const entry = pending.get(id);
+    if (!entry) return;
+    pending.delete(id);
+    if (pending.size === 0) worker?.unref();
+    if (ok) {
+      entry.resolve(result);
+      return;
+    }
+    entry.reject(new Error(error || 'Worker task failed'));
+  });
+
+  worker.on('error', (err) => {
+    resetWorker(err);
+  });
+
+  worker.on('exit', (code) => {
+    if (code !== 0) {
+      resetWorker(new Error(`Worker exited with code ${code}`));
+    } else {
+      worker = null;
+    }
+  });
+
+  return worker;
+}
+
+export function canUseWorkers() {
+  return !workersDisabled;
+}
+
+export function runWorkerTask(type, payload) {
+  if (!canUseWorkers()) {
+    throw new Error('Worker threads are disabled');
+  }
+  const activeWorker = ensureWorker();
+  if (!activeWorker) {
+    throw new Error('Worker is not available');
+  }
+  if (pending.size >= MAX_PENDING_TASKS) {
+    const error = new Error('Worker task queue is at capacity');
+    error.code = 'WORKER_QUEUE_FULL';
+    throw error;
+  }
+
+  const id = ++requestCounter;
+  return new Promise((resolve, reject) => {
+    pending.set(id, { resolve, reject });
+    activeWorker.ref();
+    activeWorker.postMessage({ id, type, payload });
+  });
+}

package/src/lib/workers/crypto-checksum-worker.js

@@ -0,0 +1,70 @@
+import { parentPort } from 'node:worker_threads';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+
+function deriveKey(password, salt) {
+  return crypto.pbkdf2Sync(password, salt, 100000, 32, 'sha256');
+}
+
+function encryptPayload(plaintext, password) {
+  const salt = crypto.randomBytes(16);
+  const key = deriveKey(password, salt);
+  const iv = crypto.randomBytes(16);
+
+  const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);
+  let enc = cipher.update(plaintext, 'utf8', 'base64');
+  enc += cipher.final('base64');
+
+  return {
+    iv: iv.toString('hex'),
+    ciphertext: enc,
+    salt: salt.toString('hex'),
+  };
+}
+
+function decryptPayload(ivHex, cipherBase64, password, saltHex) {
+  const salt = Buffer.from(saltHex, 'hex');
+  const key = deriveKey(password, salt);
+  const iv = Buffer.from(ivHex, 'hex');
+  const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);
+  let dec = decipher.update(cipherBase64, 'base64', 'utf8');
+  dec += decipher.final('utf8');
+  return dec;
+}
+
+function checksumFile(filePath) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash('sha256');
+    const stream = fs.createReadStream(filePath);
+    stream.on('error', reject);
+    stream.on('data', (chunk) => hash.update(chunk));
+    stream.on('end', () => resolve(hash.digest('hex')));
+  });
+}
+
+async function executeTask(type, payload) {
+  switch (type) {
+    case 'encrypt':
+      return encryptPayload(payload.plaintext, payload.password);
+    case 'decrypt':
+      return {
+        plaintext: decryptPayload(payload.ivHex, payload.cipherBase64, payload.password, payload.saltHex),
+      };
+    case 'checksum':
+      return {
+        digest: await checksumFile(payload.filePath),
+      };
+    default:
+      throw new Error(`Unsupported worker task: ${type}`);
+  }
+}
+
+parentPort.on('message', async (message) => {
+  const { id, type, payload } = message || {};
+  try {
+    const result = await executeTask(type, payload || {});
+    parentPort.postMessage({ id, ok: true, result });
+  } catch (err) {
+    parentPort.postMessage({ id, ok: false, error: err.message });
+  }
+});

package/src/modes/ai.js

@@ -2,7 +2,8 @@
  * AI Mode — privacy-first local/remote task assistant powered by Groq.
  */
 
-import { execa, execaCommand } from 'execa';
+import { execa } from 'execa';
+import { parse as shellParse } from 'shell-quote';
 import chalk from 'chalk';
 import inquirer from 'inquirer';
 import fs from 'node:fs';
@@ -210,8 +211,13 @@ function showRateLimitWarnings(rateLimit) {
 }
 
 async function runLocalCommand(command) {
-  const result = await execaCommand(command, {
-    shell: true,
+  const parsed = shellParse(command);
+  // Filter out non-string tokens (shell operators like |, &&, ; etc.) to prevent injection
+  const args = parsed.filter(token => typeof token === 'string');
+  if (args.length === 0) {
+    return { exitCode: 1, stdout: '', stderr: 'Empty or unsafe command after parsing' };
+  }
+  const result = await execa(args[0], args.slice(1), {
     reject: false,
     timeout: 30000,
     maxBuffer: 1024 * 1024,
@@ -568,12 +574,10 @@ async function tryAITransfer(task, context) {
   if (context && context.scope === 'remote' && context.hostname && context.username) {
     console.log(chalk.dim(`  Using active remote session: ${context.username}@${context.hostname}`));
 
-    const { getSshControlOptions, formatScpRemotePath } = await import('../lib/ssh.js');
-
-    const proxyCommand = `cloudflared access tcp --hostname ${context.hostname}`;
+    const { buildProxyCommandOption, getSshControlOptions, formatScpRemotePath } = await import('../lib/ssh.js');
     const scpArgs = [
       '-r',
-      '-o', `ProxyCommand=${proxyCommand}`,
+      ...buildProxyCommandOption(context.hostname),
       '-o', 'StrictHostKeyChecking=accept-new',
       '-o', 'IdentitiesOnly=yes',
       ...getSshControlOptions(context.hostname),
@@ -624,4 +628,3 @@ async function tryAITransfer(task, context) {
     return true;
   }
 }
-

package/src/modes/client.js

@@ -24,9 +24,10 @@ import { getConfig, saveAlias } from '../lib/config.js';
 import { pushTelemetry, requestHostApproval, resolveUID, revokeUID, waitForApproval } from '../lib/broker.js';
 import { calculateChecksum } from '../lib/checksum.js';
 import { promptLocalPath, promptRemotePath } from '../lib/path-browser.js';
-import { buildSshArgs, extractHostname, formatScpRemotePath, getKnownHostsOptions, getSshControlOptions, quoteRemoteShell } from '../lib/ssh.js';
-import { buildTmuxSessionName, tmuxSocketCommand } from '../lib/tmux.js';
+import { buildProxyCommandOption, buildSshArgs, extractHostname, formatScpRemotePath, getKnownHostsOptions, getSshControlOptions, quoteRemoteShell } from '../lib/ssh.js';
+import { buildTmuxSessionName, TMUX_SOCKET_PATH } from '../lib/tmux.js';
 import open from 'open';
+import { secureSensitiveUrl } from '../lib/secure-print.js';
 import { cleanupSessionLog, initSessionLog, logSessionEvent, recordEvent } from '../lib/session-log.js';
 
 let BROKER_URL = process.env.BROKER_URL || 'https://ipingyou.onrender.com';
@@ -89,9 +90,13 @@ async function connectSSH(username, hostname, privateKeyPath, persistKnownHosts
 
     sshArgs.push(`${username}@${hostname}`);
     const tmuxSession = buildTmuxSessionName(username);
-    const tmuxPrepare = `${tmuxSocketCommand()} has-session -t ${tmuxSession} 2>/dev/null || ${tmuxSocketCommand()} new-session -d -s ${tmuxSession}`;
-    const tmuxAttach = `${tmuxSocketCommand()} attach -t ${tmuxSession}`;
-    sshArgs.push('-t', `${tmuxPrepare} && ${tmuxAttach} || exec $SHELL -l`);
+    const quotedSocket = quoteRemoteShell(TMUX_SOCKET_PATH);
+    const quotedSession = quoteRemoteShell(tmuxSession);
+    const tmuxSocketCmdStr = `tmux -S ${quotedSocket}`;
+    const tmuxPrepare = `${tmuxSocketCmdStr} has-session -t ${quotedSession} 2>/dev/null || ${tmuxSocketCmdStr} new-session -d -s ${quotedSession}`;
+    const tmuxAttach = `${tmuxSocketCmdStr} attach -t ${quotedSession}`;
+    const tmuxCommand = `if command -v tmux >/dev/null 2>&1; then (${tmuxPrepare} && ${tmuxAttach}) || exec $SHELL -l; else exec $SHELL -l; fi`;
+    sshArgs.push('-t', tmuxCommand);
 
     const child = execa('ssh', sshArgs, {
       stdio: 'inherit',
@@ -182,12 +187,10 @@ async function performSCP(username, hostname, direction, privateKeyPath, sharedD
 
   await showConnectionTrace('Local', 'Remote SCP');
 
-  const proxyCommand = `cloudflared access tcp --hostname ${hostname}`;
-
   // Construct SCP args
   const scpArgs = [
     '-r', // recursive just in case
-    '-o', `ProxyCommand=${proxyCommand}`,
+    ...buildProxyCommandOption(hostname),
     ...getKnownHostsOptions(persistKnownHosts),
     '-o', 'IdentitiesOnly=yes',
     ...getSshControlOptions(hostname)
@@ -218,6 +221,16 @@ async function performSCP(username, hostname, direction, privateKeyPath, sharedD
     const child = execa('scp', scpArgs, {
       stdio: ['inherit', 'pipe', 'pipe'],
       reject: false,
+      buffer: false,
+    });
+    const maxDiagnosticBytes = 64 * 1024;
+    let stderrOutput = Buffer.alloc(0);
+    child.stdout?.resume();
+    child.stderr?.on('data', (chunk) => {
+      const next = Buffer.concat([stderrOutput, Buffer.from(chunk)]);
+      stderrOutput = next.length > maxDiagnosticBytes
+        ? next.subarray(next.length - maxDiagnosticBytes)
+        : next;
     });
 
     trackPID(child.pid);
@@ -257,9 +270,10 @@ async function performSCP(username, hostname, direction, privateKeyPath, sharedD
       console.log(chalk.green(`  ✅ Transfer completed successfully!`));
       recordEvent('scp_transfer_success', { direction, localPath, remotePath, hostname });
     } else {
+      const stderr = stderrOutput.toString('utf8');
       console.error(chalk.red('  ❌ SCP transfer failed'));
-      if (result.stderr) console.error(chalk.dim(`     ${result.stderr.trim()}`));
-      recordEvent('scp_transfer_failed', { direction, localPath, remotePath, hostname, error: result.stderr });
+      if (stderr) console.error(chalk.dim(`     ${stderr.trim()}`));
+      recordEvent('scp_transfer_failed', { direction, localPath, remotePath, hostname, error: stderr });
     }
   } catch (err) {
     console.error(chalk.red(`  ❌ SCP error: ${err.message}`));
@@ -268,10 +282,9 @@ async function performSCP(username, hostname, direction, privateKeyPath, sharedD
 
 async function downloadSpecificRemotePath(username, hostname, privateKeyPath, remotePath, localPath, persistKnownHosts = true) {
   await showConnectionTrace('Local', 'Remote SCP');
-  const proxyCommand = `cloudflared access tcp --hostname ${hostname}`;
   const scpArgs = [
     '-r',
-    '-o', `ProxyCommand=${proxyCommand}`,
+    ...buildProxyCommandOption(hostname),
     ...getKnownHostsOptions(persistKnownHosts),
     '-o', 'IdentitiesOnly=yes',
     ...getSshControlOptions(hostname),
@@ -662,8 +675,7 @@ export async function performSCPNonInteractive(params = {}) {
   const privateKeyPath = payload.privateKey ? await writeEphemeralPrivateKey(payload.privateKey) : null;
 
   // Build scp args similar to performSCP
-  const proxyCommand = `cloudflared access tcp --hostname ${hostname}`;
-  const scpArgs = ['-r', '-o', `ProxyCommand=${proxyCommand}`, ...getKnownHostsOptions(persistKnownHosts), '-o', 'IdentitiesOnly=yes', ...getSshControlOptions(hostname)];
+  const scpArgs = ['-r', ...buildProxyCommandOption(hostname), ...getKnownHostsOptions(persistKnownHosts), '-o', 'IdentitiesOnly=yes', ...getSshControlOptions(hostname)];
   if (privateKeyPath) scpArgs.push('-i', privateKeyPath, '-o', 'IdentityAgent=none');
 
   const remoteSpec = `${username}@${hostname}:${formatScpRemotePath(remotePath)}`;
@@ -701,7 +713,7 @@ async function handleClientChat(uid, password, cachedChatUrl) {
       const fullUrl = `${chatUrl}#${password}`;
       await open(fullUrl);
     } catch {
-      console.log(chalk.cyan(`  👉 Please open: ${chatUrl}#${password}`));
+      console.log(chalk.cyan(`  👉 Please open: ${secureSensitiveUrl(chatUrl, password)}`));
     }
   } else {
     spinner.warn('The host has not started a chat room yet.');

package/src/modes/doctor.js

@@ -2,7 +2,7 @@
  * Doctor Mode — non-invasive diagnostics for iPingYou.
  */
 
-import { execa, execaCommand } from 'execa';
+import { execa } from 'execa';
 import chalk from 'chalk';
 import fs from 'node:fs';
 import os from 'node:os';
@@ -66,7 +66,7 @@ async function commandFound(command) {
 async function checkSshService() {
   const osInfo = detectOS();
   if (osInfo.isMac) {
-    const launchctl = await execaCommand('launchctl print-disabled system', { reject: false, timeout: 5000 });
+    const launchctl = await execa('launchctl', ['print-disabled', 'system'], { reject: false, timeout: 5000 });
     const launchctlOutput = `${launchctl.stdout || ''}\n${launchctl.stderr || ''}`.toLowerCase();
     const launchctlMatch = launchctlOutput.match(/"com\.openssh\.sshd"\s*=>\s*(enabled|disabled)/);
     if (launchctlMatch) {
@@ -78,7 +78,7 @@ async function checkSshService() {
       };
     }
 
-    const result = await execaCommand('systemsetup -getremotelogin', { reject: false, timeout: 5000 });
+    const result = await execa('systemsetup', ['-getremotelogin'], { reject: false, timeout: 5000 });
     const output = result.stdout || result.stderr || '';
     if (/on/i.test(output)) return { status: 'pass', detail: 'Remote Login is on' };
     if (/off/i.test(output)) {
@@ -96,8 +96,8 @@ async function checkSshService() {
   }
 
   if (osInfo.isLinux) {
-    const ssh = await execaCommand('systemctl is-active ssh', { reject: false, timeout: 5000 });
-    const sshd = ssh.exitCode === 0 ? ssh : await execaCommand('systemctl is-active sshd', { reject: false, timeout: 5000 });
+    const ssh = await execa('systemctl', ['is-active', 'ssh'], { reject: false, timeout: 5000 });
+    const sshd = ssh.exitCode === 0 ? ssh : await execa('systemctl', ['is-active', 'sshd'], { reject: false, timeout: 5000 });
     if (sshd.exitCode === 0) return { status: 'pass', detail: 'SSH service is active' };
     return {
       status: 'warn',
@@ -107,7 +107,7 @@ async function checkSshService() {
   }
 
   if (osInfo.isWindows) {
-    const result = await execaCommand('sc query sshd', { reject: false, timeout: 5000 });
+    const result = await execa('sc', ['query', 'sshd'], { reject: false, timeout: 5000 });
     if (/RUNNING/i.test(result.stdout)) return { status: 'pass', detail: 'OpenSSH Server is running' };
     return {
       status: 'warn',
@@ -196,7 +196,11 @@ function checkAiSafety() {
 }
 
 async function runProjectSelfTest(label, command) {
-  const result = await execaCommand(command, {
+  // Prefer splitting simple commands into args to avoid shell interpolation
+  const parts = String(command).split(' ').filter(Boolean);
+  const cmd = parts.shift();
+  const args = parts;
+  const result = await execa(cmd, args, {
     reject: false,
     timeout: 30000,
     maxBuffer: 1024 * 1024,