@nocobase/server 2.2.23 → 2.2.24

package/lib/app-supervisor/main-only-adapter.js

@@ -50,7 +50,10 @@ const _MainOnlyAdapter = class _MainOnlyAdapter {
     return this.apps[appName];
   }
   async bootstrapApp(appName) {
-    if (appName !== "main" || !this.apps[appName]) {
+    if (appName !== "main") {
+      return;
+    }
+    if (!this.apps[appName]) {
       this.setAppStatus(appName, "not_found");
       return;
     }
@@ -138,13 +141,16 @@ const _MainOnlyAdapter = class _MainOnlyAdapter {
     return this.removeApp("main");
   }
   setAppStatus(appName, status, options = {}) {
-    if (this.status === status) {
+    if (appName !== "main" || this.status === status) {
       return;
     }
     this.status = status;
     this.supervisor.emit("appStatusChanged", { appName, status, options });
   }
   getAppStatus(appName, defaultStatus) {
+    if (appName !== "main") {
+      return "not_found";
+    }
     return this.status ?? defaultStatus ?? null;
   }
   hasAppError(appName) {

package/lib/gateway/errors.d.ts

@@ -6,6 +6,11 @@
  * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
+/** Raised when a request resolves to an app name that could never name a real application. */
+export declare class InvalidAppNameError extends Error {
+    readonly appName: unknown;
+    constructor(appName: unknown);
+}
 interface AppError {
     status: number;
     message: any;

package/lib/gateway/errors.js

@@ -37,6 +37,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var errors_exports = {};
 __export(errors_exports, {
+  InvalidAppNameError: () => InvalidAppNameError,
   applyErrorWithArgs: () => applyErrorWithArgs,
   errors: () => errors,
   getErrorWithCode: () => getErrorWithCode
@@ -44,6 +45,15 @@ __export(errors_exports, {
 module.exports = __toCommonJS(errors_exports);
 var import_app_supervisor = require("../app-supervisor");
 var import_lodash = __toESM(require("lodash"));
+const _InvalidAppNameError = class _InvalidAppNameError extends Error {
+  constructor(appName) {
+    super("invalid application name");
+    this.appName = appName;
+    this.name = "InvalidAppNameError";
+  }
+};
+__name(_InvalidAppNameError, "InvalidAppNameError");
+let InvalidAppNameError = _InvalidAppNameError;
 function getMaintaining(app) {
   var _a;
   return (_a = app == null ? void 0 : app.getMaintaining) == null ? void 0 : _a.call(app);
@@ -54,6 +64,11 @@ function getAppName(app) {
 }
 __name(getAppName, "getAppName");
 const errors = {
+  INVALID_APP_NAME: {
+    status: 400,
+    message: "invalid application name",
+    maintaining: false
+  },
   APP_ENVIRONMENT_UNAVAILABLE: {
     status: 503,
     message: /* @__PURE__ */ __name(({ appName }) => `deployment environment for application ${appName} is unavailable`, "message"),
@@ -191,6 +206,7 @@ function applyErrorWithArgs(error, options) {
 __name(applyErrorWithArgs, "applyErrorWithArgs");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  InvalidAppNameError,
   applyErrorWithArgs,
   errors,
   getErrorWithCode

package/lib/gateway/index.d.ts

@@ -90,6 +90,7 @@ export declare class Gateway extends EventEmitter {
     requestHandler(req: IncomingMessage, res: ServerResponse): Promise<void>;
     getAppSelectorMiddlewares(): Toposort<AppSelectorMiddleware>;
     getRequestHandleAppName(req: IncomingMessage | IncomingRequest): Promise<string>;
+    private handleUpgrade;
     getCallback(): any;
     watch(): Promise<void>;
     run(options: RunOptions): Promise<void>;

package/lib/gateway/index.js

@@ -72,6 +72,15 @@ var import_node_worker_threads = require("node:worker_threads");
 var import_node_process = __toESM(require("node:process"));
 var import_utils4 = require("./utils");
 const compress = (0, import_node_util.promisify)((0, import_compression.default)());
+const APP_NAME_PATTERN = /^[A-Za-z0-9_][A-Za-z0-9_-]*$/;
+const MAX_APP_NAME_LENGTH = 255;
+function isValidAppName(name) {
+  if (typeof name !== "string" || name.length > MAX_APP_NAME_LENGTH || !APP_NAME_PATTERN.test(name)) {
+    return false;
+  }
+  return !(name in Object.prototype);
+}
+__name(isValidAppName, "isValidAppName");
 function normalizeBasePath(path = "") {
   const normalized = path.replace(/\/+/g, "/").replace(/\/$/, "");
   return normalized || "/";
@@ -261,6 +270,9 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
     this.emit("appSelectorChanged");
   }
   getLogger(appName, res) {
+    if (!isValidAppName(appName)) {
+      throw new Error("Invalid app name");
+    }
     const reqId = (0, import_crypto.randomUUID)();
     res.setHeader("X-Request-Id", reqId);
     let logger = this.loggers.get(appName);
@@ -284,7 +296,9 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
     res.end(JSON.stringify({ error }));
   }
   responseErrorWithCode(code, res, options) {
-    const log = this.getLogger(options.appName, res);
+    const appName = options == null ? void 0 : options.appName;
+    const loggerName = isValidAppName(appName) && import_app_supervisor.AppSupervisor.getInstance().hasApp(appName) ? appName : "main";
+    const log = this.getLogger(loggerName, res);
     const error = (0, import_errors.applyErrorWithArgs)((0, import_errors.getErrorWithCode)(code), options);
     log.error(error.message, {
       method: "responseErrorWithCode",
@@ -387,6 +401,10 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
     try {
       handleApp = await this.getRequestHandleAppName(req);
     } catch (error) {
+      if (error instanceof import_errors.InvalidAppNameError) {
+        this.responseErrorWithCode("INVALID_APP_NAME", res, {});
+        return;
+      }
       this.getLogger("main", res).error("Failed to get handle app name", { error });
       this.responseErrorWithCode("APP_INITIALIZING", res, { appName: handleApp });
       return;
@@ -538,8 +556,32 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
     if (!ctx.resolvedAppName) {
       ctx.resolvedAppName = "main";
     }
+    if (!isValidAppName(ctx.resolvedAppName)) {
+      throw new import_errors.InvalidAppNameError(ctx.resolvedAppName);
+    }
     return ctx.resolvedAppName;
   }
+  async handleUpgrade(request, socket, head) {
+    const isProxy = await import_app_supervisor.AppSupervisor.getInstance().proxyWs(request, socket, head);
+    if (isProxy) {
+      return;
+    }
+    const appInstance = await import_app_supervisor.AppSupervisor.getInstance().getApp("main");
+    for (const handle of _Gateway.wsServers) {
+      const result = await handle(request, socket, head, appInstance);
+      if (result !== false) {
+        return;
+      }
+    }
+    const { pathname } = (0, import_url.parse)(request.url);
+    if (pathname === import_node_process.default.env.WS_PATH) {
+      this.wsServer.wss.handleUpgrade(request, socket, head, (ws) => {
+        this.wsServer.wss.emit("connection", ws, request);
+      });
+    } else {
+      socket.destroy();
+    }
+  }
   getCallback() {
     return this.requestHandler.bind(this);
   }
@@ -656,26 +698,11 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
       this.getCallback()(req, res);
     });
     this.wsServer = new import_ws_server.WSServer();
-    this.server.on("upgrade", async (request, socket, head) => {
-      const isProxy = await import_app_supervisor.AppSupervisor.getInstance().proxyWs(request, socket, head);
-      if (isProxy) {
-        return;
-      }
-      const appInstance = await import_app_supervisor.AppSupervisor.getInstance().getApp("main");
-      for (const handle of _Gateway.wsServers) {
-        const result = await handle(request, socket, head, appInstance);
-        if (result !== false) {
-          return;
-        }
-      }
-      const { pathname } = (0, import_url.parse)(request.url);
-      if (pathname === import_node_process.default.env.WS_PATH) {
-        this.wsServer.wss.handleUpgrade(request, socket, head, (ws) => {
-          this.wsServer.wss.emit("connection", ws, request);
-        });
-      } else {
+    this.server.on("upgrade", (request, socket, head) => {
+      this.handleUpgrade(request, socket, head).catch((error) => {
+        import_app_supervisor.AppSupervisor.getInstance().logger.error("Failed to handle websocket upgrade", { error });
         socket.destroy();
-      }
+      });
     });
     this.server.listen(this.port, this.host, () => {
       console.log(`Gateway HTTP Server running at http://${this.host}:${this.port}/`);

package/lib/gateway/ws-server.d.ts

@@ -32,6 +32,11 @@ export declare class WSServer extends EventEmitter {
     addNewConnection(ws: WebSocketWithId, request: IncomingMessage): WebSocketClient;
     setClientTag(clientId: string, tagKey: string, tagValue: string): void;
     removeClientTag(clientId: string, tagKey: string): void;
+    /**
+     * Drop a connection whose url or headers resolve to an app name that can never exist. Closing beats tagging it with
+     * the raw value: the tag would end up as a map key and would bootstrap an app on every selector change.
+     */
+    private rejectInvalidAppName;
     setClientApp(client: WebSocketClient): Promise<void>;
     removeConnection(id: string): void;
     sendMessageToConnection(client: WebSocketClient, sendMessage: object): void;

package/lib/gateway/ws-server.js

@@ -80,10 +80,19 @@ const _WSServer = class _WSServer extends import_events.default {
     });
     import_gateway.Gateway.getInstance().on("appSelectorChanged", () => {
       this.loopThroughConnections(async (client) => {
-        const handleAppName = await import_gateway.Gateway.getInstance().getRequestHandleAppName({
-          url: client.url,
-          headers: client.headers
-        });
+        let handleAppName;
+        try {
+          handleAppName = await import_gateway.Gateway.getInstance().getRequestHandleAppName({
+            url: client.url,
+            headers: client.headers
+          });
+        } catch (error) {
+          if (!(error instanceof import_errors.InvalidAppNameError)) {
+            throw error;
+          }
+          this.rejectInvalidAppName(client);
+          return;
+        }
         for (const tag of client.tags) {
           if (tag.startsWith("app#")) {
             client.tags.delete(tag);
@@ -238,12 +247,29 @@ const _WSServer = class _WSServer extends import_events.default {
       }
     });
   }
+  /**
+   * Drop a connection whose url or headers resolve to an app name that can never exist. Closing beats tagging it with
+   * the raw value: the tag would end up as a map key and would bootstrap an app on every selector change.
+   */
+  rejectInvalidAppName(client) {
+    client.ws.close(1008, "INVALID_APP_NAME");
+    this.removeConnection(client.id);
+  }
   async setClientApp(client) {
     const req = {
       url: client.url,
       headers: client.headers
     };
-    const handleAppName = await import_gateway.Gateway.getInstance().getRequestHandleAppName(req);
+    let handleAppName;
+    try {
+      handleAppName = await import_gateway.Gateway.getInstance().getRequestHandleAppName(req);
+    } catch (error) {
+      if (!(error instanceof import_errors.InvalidAppNameError)) {
+        throw error;
+      }
+      this.rejectInvalidAppName(client);
+      return;
+    }
     client.app = handleAppName;
     console.log(`client tags: app#${handleAppName}`);
     client.tags.add(`app#${handleAppName}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/server",
-  "version": "2.2.23",
+  "version": "2.2.24",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
@@ -10,21 +10,21 @@
     "@koa/cors": "^5.0.0",
     "@koa/multer": "^3.1.0",
     "@koa/router": "^13.1.0",
-    "@nocobase/acl": "2.2.23",
-    "@nocobase/actions": "2.2.23",
-    "@nocobase/ai": "2.2.23",
-    "@nocobase/auth": "2.2.23",
-    "@nocobase/cache": "2.2.23",
-    "@nocobase/data-source-manager": "2.2.23",
-    "@nocobase/database": "2.2.23",
-    "@nocobase/evaluators": "2.2.23",
-    "@nocobase/lock-manager": "2.2.23",
-    "@nocobase/logger": "2.2.23",
-    "@nocobase/resourcer": "2.2.23",
-    "@nocobase/sdk": "2.2.23",
-    "@nocobase/snowflake-id": "2.2.23",
-    "@nocobase/telemetry": "2.2.23",
-    "@nocobase/utils": "2.2.23",
+    "@nocobase/acl": "2.2.24",
+    "@nocobase/actions": "2.2.24",
+    "@nocobase/ai": "2.2.24",
+    "@nocobase/auth": "2.2.24",
+    "@nocobase/cache": "2.2.24",
+    "@nocobase/data-source-manager": "2.2.24",
+    "@nocobase/database": "2.2.24",
+    "@nocobase/evaluators": "2.2.24",
+    "@nocobase/lock-manager": "2.2.24",
+    "@nocobase/logger": "2.2.24",
+    "@nocobase/resourcer": "2.2.24",
+    "@nocobase/sdk": "2.2.24",
+    "@nocobase/snowflake-id": "2.2.24",
+    "@nocobase/telemetry": "2.2.24",
+    "@nocobase/utils": "2.2.24",
     "@types/ini": "^1.3.31",
     "@types/koa-send": "^4.1.3",
     "@types/multer": "^1.4.12",
@@ -60,5 +60,5 @@
     "@types/serve-handler": "^6.1.1",
     "@types/ws": "^8.5.5"
   },
-  "gitHead": "71852bf1353c21818600ffe7b2a38aa68b5e47e6"
+  "gitHead": "b067d4c18834112e59bb72b2084e872c59d64f9c"
 }