@nocobase/utils 2.2.0-beta.8 → 2.3.0-alpha.1

package/lib/auth-cookie-name.d.ts

@@ -0,0 +1,10 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export type AuthCookieType = 'authToken' | 'authenticator' | 'role' | 'csrfToken';
+export declare function getAuthCookieName(type: AuthCookieType, appName?: string): string;

package/lib/auth-cookie-name.js

@@ -0,0 +1,46 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var auth_cookie_name_exports = {};
+__export(auth_cookie_name_exports, {
+  getAuthCookieName: () => getAuthCookieName
+});
+module.exports = __toCommonJS(auth_cookie_name_exports);
+const cookieNamePrefixes = {
+  authToken: "nb_auth_token",
+  authenticator: "nb_authenticator",
+  role: "nb_role",
+  csrfToken: "nb_csrf_token"
+};
+function getAuthCookieName(type, appName) {
+  return `${cookieNamePrefixes[type]}_${appName || "main"}`;
+}
+__name(getAuthCookieName, "getAuthCookieName");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getAuthCookieName
+});

package/lib/auth-cookie.d.ts

@@ -0,0 +1,21 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export type { AuthCookieType } from './auth-cookie-name';
+export { getAuthCookieName } from './auth-cookie-name';
+export declare function getAuthCookieOptions(ctx: {
+    protocol?: string;
+    headers?: Record<string, string | string[] | undefined>;
+}, httpOnly?: boolean, maxAge?: number): {
+    maxAge?: number;
+    secureProxy?: boolean;
+    httpOnly: boolean;
+    sameSite: "lax";
+    secure: boolean;
+    path: string;
+};

package/lib/auth-cookie.js

@@ -0,0 +1,62 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var auth_cookie_exports = {};
+__export(auth_cookie_exports, {
+  getAuthCookieName: () => import_auth_cookie_name.getAuthCookieName,
+  getAuthCookieOptions: () => getAuthCookieOptions
+});
+module.exports = __toCommonJS(auth_cookie_exports);
+var import_auth_cookie_name = require("./auth-cookie-name");
+function getFirstHeaderValue(value) {
+  var _a;
+  const header = Array.isArray(value) ? value[0] : value;
+  return (_a = header == null ? void 0 : header.split(",")[0]) == null ? void 0 : _a.trim().toLowerCase();
+}
+__name(getFirstHeaderValue, "getFirstHeaderValue");
+function getAuthCookieOptions(ctx, httpOnly = true, maxAge) {
+  var _a, _b;
+  const forwardedProto = (_a = ctx.headers) == null ? void 0 : _a["x-forwarded-proto"];
+  const forwardedProtocol = getFirstHeaderValue(forwardedProto);
+  const protocol = forwardedProtocol || ctx.protocol;
+  const publicPath = ((_b = process.env.APP_PUBLIC_PATH) == null ? void 0 : _b.replace(/\/+$/g, "")) || "/";
+  const secure = protocol === "https";
+  return {
+    httpOnly,
+    sameSite: "lax",
+    secure: secure && !forwardedProtocol,
+    path: publicPath || "/",
+    ...secure && forwardedProtocol ? { secureProxy: true } : {},
+    ...maxAge ? { maxAge } : {}
+  };
+}
+__name(getAuthCookieOptions, "getAuthCookieOptions");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getAuthCookieName,
+  getAuthCookieOptions
+});

package/lib/client.d.ts

@@ -11,6 +11,7 @@ import { dayjs } from './dayjs';
 import { getDayRangeByParams, getOffsetRangeByParams } from './dateRangeUtils';
 export * from './collections-graph';
 export * from './common';
+export * from './auth-cookie-name';
 export * from './date';
 export * from './forEach';
 export * from './getValuesByPath';

package/lib/client.js

@@ -48,6 +48,7 @@ var import_dayjs = require("./dayjs");
 var import_dateRangeUtils = require("./dateRangeUtils");
 __reExport(client_exports, require("./collections-graph"), module.exports);
 __reExport(client_exports, require("./common"), module.exports);
+__reExport(client_exports, require("./auth-cookie-name"), module.exports);
 __reExport(client_exports, require("./date"), module.exports);
 __reExport(client_exports, require("./forEach"), module.exports);
 __reExport(client_exports, require("./getValuesByPath"), module.exports);
@@ -79,6 +80,7 @@ __reExport(client_exports, require("./liquidjs"), module.exports);
   lodash,
   ...require("./collections-graph"),
   ...require("./common"),
+  ...require("./auth-cookie-name"),
   ...require("./date"),
   ...require("./forEach"),
   ...require("./getValuesByPath"),

package/lib/cors.d.ts

@@ -0,0 +1,19 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export interface OriginContext {
+    protocol?: string;
+    headers?: Record<string, string | string[] | undefined>;
+    get(name: string): string;
+}
+export declare function getFirstHeaderValue(value: string | string[] | undefined): string;
+export declare function getCorsWhitelist(): Set<string>;
+export declare function getRequestOrigin(ctx: OriginContext): string;
+export declare function getOrigin(value: string): string;
+export declare function isSameOrigin(ctx: OriginContext, origin: string): boolean;
+export declare function isTrustedOrigin(ctx: OriginContext, origin: string): boolean;

package/lib/cors.js

@@ -0,0 +1,89 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var cors_exports = {};
+__export(cors_exports, {
+  getCorsWhitelist: () => getCorsWhitelist,
+  getFirstHeaderValue: () => getFirstHeaderValue,
+  getOrigin: () => getOrigin,
+  getRequestOrigin: () => getRequestOrigin,
+  isSameOrigin: () => isSameOrigin,
+  isTrustedOrigin: () => isTrustedOrigin
+});
+module.exports = __toCommonJS(cors_exports);
+function getFirstHeaderValue(value) {
+  var _a;
+  const header = Array.isArray(value) ? value[0] : value;
+  return (_a = header == null ? void 0 : header.split(",")[0]) == null ? void 0 : _a.trim();
+}
+__name(getFirstHeaderValue, "getFirstHeaderValue");
+function getCorsWhitelist() {
+  const whitelistString = process.env.CORS_ORIGIN_WHITELIST;
+  if (!whitelistString) {
+    return null;
+  }
+  return new Set(
+    whitelistString.split(",").map((item) => item.trim()).filter(Boolean)
+  );
+}
+__name(getCorsWhitelist, "getCorsWhitelist");
+function getRequestOrigin(ctx) {
+  var _a, _b, _c;
+  const protocol = (_b = getFirstHeaderValue((_a = ctx.headers) == null ? void 0 : _a["x-forwarded-proto"]) || ctx.protocol) == null ? void 0 : _b.toLowerCase();
+  const host = getFirstHeaderValue((_c = ctx.headers) == null ? void 0 : _c["x-forwarded-host"]) || ctx.get("host");
+  return host ? `${protocol}://${host}` : void 0;
+}
+__name(getRequestOrigin, "getRequestOrigin");
+function getOrigin(value) {
+  try {
+    return new URL(value).origin;
+  } catch {
+    return null;
+  }
+}
+__name(getOrigin, "getOrigin");
+function isSameOrigin(ctx, origin) {
+  return origin === getRequestOrigin(ctx);
+}
+__name(isSameOrigin, "isSameOrigin");
+function isTrustedOrigin(ctx, origin) {
+  var _a;
+  if (isSameOrigin(ctx, origin)) {
+    return true;
+  }
+  return ((_a = getCorsWhitelist()) == null ? void 0 : _a.has(origin)) || false;
+}
+__name(isTrustedOrigin, "isTrustedOrigin");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getCorsWhitelist,
+  getFirstHeaderValue,
+  getOrigin,
+  getRequestOrigin,
+  isSameOrigin,
+  isTrustedOrigin
+});

package/lib/index.d.ts

@@ -9,8 +9,10 @@
 import lodash from 'lodash';
 export { Schema } from '@formily/json-schema';
 export * from './assign';
+export * from './auth-cookie';
 export * from './collections-graph';
 export * from './common';
+export * from './cors';
 export * from './crypto';
 export * from './date';
 export * from './dateRangeUtils';

package/lib/index.js

@@ -45,8 +45,10 @@ module.exports = __toCommonJS(src_exports);
 var import_lodash = __toESM(require("lodash"));
 var import_json_schema = require("@formily/json-schema");
 __reExport(src_exports, require("./assign"), module.exports);
+__reExport(src_exports, require("./auth-cookie"), module.exports);
 __reExport(src_exports, require("./collections-graph"), module.exports);
 __reExport(src_exports, require("./common"), module.exports);
+__reExport(src_exports, require("./cors"), module.exports);
 __reExport(src_exports, require("./crypto"), module.exports);
 __reExport(src_exports, require("./date"), module.exports);
 __reExport(src_exports, require("./dateRangeUtils"), module.exports);
@@ -88,8 +90,10 @@ __reExport(src_exports, require("./storage-path"), module.exports);
   dayjs,
   lodash,
   ...require("./assign"),
+  ...require("./auth-cookie"),
   ...require("./collections-graph"),
   ...require("./common"),
+  ...require("./cors"),
   ...require("./crypto"),
   ...require("./date"),
   ...require("./dateRangeUtils"),

package/lib/server-request.js

@@ -44,7 +44,12 @@ __export(server_request_exports, {
 module.exports = __toCommonJS(server_request_exports);
 var import_ipaddr = __toESM(require("ipaddr.js"));
 var import_axios = __toESM(require("axios"));
+var import_promises = require("dns/promises");
 const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+const SSRF_RISK_IP_RANGES = /* @__PURE__ */ new Set(["loopback", "private", "linkLocal", "uniqueLocal", "unspecified"]);
+const SSRF_RISK_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "metadata.google.internal"]);
+const DNS_LOOKUP_WARNING_TIMEOUT = 1e3;
+const warnedSsrfRiskTargets = /* @__PURE__ */ new Set();
 function matchesIpEntry(hostname, entry) {
   try {
     let addr = import_ipaddr.default.parse(hostname);
@@ -87,6 +92,88 @@ function matchesEntry(hostname, entry) {
   return import_ipaddr.default.isValid(hostname) ? matchesIpEntry(hostname, e) : matchesDomainPattern(hostname, e);
 }
 __name(matchesEntry, "matchesEntry");
+function getNormalizedHost(url) {
+  const { hostname } = url;
+  return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+__name(getNormalizedHost, "getNormalizedHost");
+function getSsrfRiskReason(hostname) {
+  const host = hostname.toLowerCase();
+  if (SSRF_RISK_HOSTNAMES.has(host)) {
+    return "known local or metadata hostname";
+  }
+  if (!import_ipaddr.default.isValid(host)) {
+    return;
+  }
+  try {
+    let addr = import_ipaddr.default.parse(host);
+    if (addr.kind() === "ipv6" && addr.isIPv4MappedAddress()) {
+      addr = addr.toIPv4Address();
+    }
+    const range = addr.range();
+    return SSRF_RISK_IP_RANGES.has(range) ? range : void 0;
+  } catch {
+    return;
+  }
+}
+__name(getSsrfRiskReason, "getSsrfRiskReason");
+function warnSsrfRiskTarget(host, reason, key = `${host}:${reason}`) {
+  if (warnedSsrfRiskTargets.has(key)) return;
+  warnedSsrfRiskTargets.add(key);
+  console.warn(
+    [
+      `Outbound request to "${host}" targets a potential SSRF risk target (${reason}) and is allowed because SERVER_REQUEST_WHITELIST is not configured.`,
+      "Configure SERVER_REQUEST_WHITELIST to explicitly allow required outbound targets.",
+      "A future version may block private, loopback, link-local, and metadata targets by default."
+    ].join(" ")
+  );
+}
+__name(warnSsrfRiskTarget, "warnSsrfRiskTarget");
+function warnIfSsrfRiskTarget(host) {
+  const reason = getSsrfRiskReason(host);
+  if (!reason) return;
+  warnSsrfRiskTarget(host, reason);
+}
+__name(warnIfSsrfRiskTarget, "warnIfSsrfRiskTarget");
+function hasServerRequestWhitelist() {
+  const whitelist = process.env.SERVER_REQUEST_WHITELIST;
+  return Boolean(whitelist && whitelist.trim());
+}
+__name(hasServerRequestWhitelist, "hasServerRequestWhitelist");
+async function resolveHostAddresses(host) {
+  try {
+    return await Promise.race([
+      (0, import_promises.lookup)(host, { all: true, verbatim: true }),
+      new Promise((resolve) => {
+        setTimeout(() => resolve([]), DNS_LOOKUP_WARNING_TIMEOUT);
+      })
+    ]);
+  } catch {
+    return [];
+  }
+}
+__name(resolveHostAddresses, "resolveHostAddresses");
+async function warnIfResolvedSsrfRiskTarget(url) {
+  if (!url || !url.includes("://") || hasServerRequestWhitelist()) return;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return;
+  }
+  if (!ALLOWED_PROTOCOLS.has(parsed.protocol)) return;
+  const host = getNormalizedHost(parsed);
+  if (getSsrfRiskReason(host) || import_ipaddr.default.isValid(host)) return;
+  const addresses = await resolveHostAddresses(host);
+  for (const address of addresses) {
+    const reason = getSsrfRiskReason(address.address);
+    if (reason) {
+      warnSsrfRiskTarget(host, `resolves to ${address.address} (${reason})`, `${host}:resolved-risk`);
+      return;
+    }
+  }
+}
+__name(warnIfResolvedSsrfRiskTarget, "warnIfResolvedSsrfRiskTarget");
 function checkUrlAgainstWhitelist(url) {
   if (!url) return;
   if (!url.includes("://")) return;
@@ -101,12 +188,14 @@ function checkUrlAgainstWhitelist(url) {
       `URL scheme "${parsed.protocol.replace(":", "")}" is not allowed. Only http and https are permitted.`
     );
   }
+  const host = getNormalizedHost(parsed);
   const whitelist = process.env.SERVER_REQUEST_WHITELIST;
-  if (!whitelist || !whitelist.trim()) return;
+  if (!whitelist || !whitelist.trim()) {
+    warnIfSsrfRiskTarget(host);
+    return;
+  }
   const entries = whitelist.split(",").map((e) => e.trim()).filter(Boolean);
   if (entries.length === 0) return;
-  const { hostname } = parsed;
-  const host = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
   for (const entry of entries) {
     if (matchesEntry(host, entry)) return;
   }
@@ -117,6 +206,7 @@ function checkUrlAgainstWhitelist(url) {
 __name(checkUrlAgainstWhitelist, "checkUrlAgainstWhitelist");
 async function serverRequest(config) {
   checkUrlAgainstWhitelist(config.url);
+  await warnIfResolvedSsrfRiskTarget(config.url);
   return import_axios.default.request(config);
 }
 __name(serverRequest, "serverRequest");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/utils",
-  "version": "2.2.0-beta.8",
+  "version": "2.3.0-alpha.1",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
@@ -21,5 +21,5 @@
     "object-path": "^0.11.8",
     "ses": "^1.14.0"
   },
-  "gitHead": "fa2502c1e9faf6d74b3f51b42dbc6546638d46af"
+  "gitHead": "2377df8ceb12549149017f7f14a61207bf6e49a2"
 }