@oneuptime/common 12.0.6 → 12.0.8

package/Server/Utils/SSRFProtection.ts

@@ -1,9 +1,7 @@
 import URL from "../../Types/API/URL";
 import BadDataException from "../../Types/Exception/BadDataException";
 import dns from "dns";
-
-const IPV4_LITERAL_REGEX: RegExp = /^(\d{1,3}\.){3}\d{1,3}$/;
-const IPV6_UNIQUE_LOCAL_REGEX: RegExp = /^f[cd][0-9a-f]{2}:/;
+import net from "net";
 
 /*
  * Guards outbound HTTP(S) requests whose target is (fully or partly)
@@ -28,14 +26,23 @@ export default class SSRFProtection {
    * (`http://169.254.169.254/?x=office.com`) and pins nothing.
    */
   public static getBareHostname(rawUrl: string | URL): string {
-    let parsed: URL;
+    /*
+     * WHATWG, not URL.fromString. OneUptime's parser takes everything before
+     * the first "/" as the authority and never terminates at "?" or "#", so it
+     * reads "https://169.254.169.254#.office.com" as the host
+     * "169.254.169.254#.office.com" - which ends with ".office.com" and
+     * satisfied the allowlist, while axios re-parsed the same string per WHATWG
+     * and dialled 169.254.169.254. A pin is only worth anything if it parses
+     * the host the same way the HTTP client will.
+     */
+    let parsed: globalThis.URL;
     try {
-      parsed = URL.fromString(rawUrl.toString());
+      parsed = new globalThis.URL(rawUrl.toString());
     } catch {
       return "";
     }
 
-    return SSRFProtection.extractHost(parsed.hostname.hostname.toLowerCase());
+    return SSRFProtection.extractHost(parsed.hostname.toLowerCase());
   }
 
   /*
@@ -47,14 +54,15 @@ export default class SSRFProtection {
     rawUrl: string | URL,
     allowedDomains: Array<string>,
   ): boolean {
-    let parsed: URL;
+    let parsed: globalThis.URL;
     try {
-      parsed = URL.fromString(rawUrl.toString());
+      parsed = new globalThis.URL(rawUrl.toString());
     } catch {
       return false;
     }
 
-    if (parsed.protocol.toString().toLowerCase() !== "https://") {
+    // Scheme and host must come from the SAME parser, or they can disagree.
+    if (parsed.protocol.toLowerCase() !== "https:") {
       return false;
     }
 
@@ -73,6 +81,30 @@ export default class SSRFProtection {
   public static async validateWebhookTargetIsSafe(
     rawUrl: string | URL,
   ): Promise<void> {
+    /*
+     * URL.fromString only knows http/https/ws/wss/mongodb/mailto and silently
+     * DEFAULTS anything else to https - "file:///etc/passwd" comes back as
+     * host "file", not as a file: URL - so the protocol check below never sees
+     * the scheme the caller actually wrote. Read it off the raw string first.
+     *
+     * The ":" must be followed by "/" or this would treat the host in a
+     * scheme-less "example.com:8080/hook" as a scheme and reject it.
+     */
+    const schemeMatch: RegExpMatchArray | null = rawUrl
+      .toString()
+      .trim()
+      .match(/^([a-z][a-z0-9+.-]*):\//i);
+
+    if (
+      schemeMatch &&
+      schemeMatch[1] &&
+      !["http", "https"].includes(schemeMatch[1].toLowerCase())
+    ) {
+      throw new BadDataException(
+        "Webhook URL must use http or https protocol.",
+      );
+    }
+
     let parsed: URL;
     try {
       parsed = URL.fromString(rawUrl.toString());
@@ -164,72 +196,253 @@ export default class SSRFProtection {
     return host;
   }
 
+  /*
+   * An IP literal needs no DNS lookup - but "looks like it has a colon" is not
+   * the same question, and getting it wrong is a bypass in both directions.
+   * net.isIP is the authority: it rejects "2852039166" and "0177.0.0.1"
+   * (which then go to DNS, where getaddrinfo decodes them and the resolved
+   * address gets checked) and accepts every real IPv6 spelling.
+   */
   private static isIpLiteral(hostname: string): boolean {
-    return IPV4_LITERAL_REGEX.test(hostname) || hostname.includes(":");
+    return net.isIP(SSRFProtection.stripZoneId(hostname)) !== 0;
+  }
+
+  private static stripZoneId(address: string): string {
+    const zoneIndex: number = address.indexOf("%");
+    return zoneIndex === -1 ? address : address.substring(0, zoneIndex);
+  }
+
+  /*
+   * Expands an IPv6 address into its eight 16-bit groups, folding an embedded
+   * IPv4 tail ("::ffff:127.0.0.1") into two hex groups on the way, so that
+   * every spelling of one address produces one canonical answer. Returns null
+   * if the address is not parseable as IPv6.
+   *
+   * This exists because the checks below CANNOT be string prefix matches:
+   * "::1", "0:0:0:0:0:0:0:1" and "0000:...:0001" are the same host, and
+   * "::ffff:169.254.169.254" is the cloud metadata endpoint wearing a hat.
+   */
+  private static expandIpv6(address: string): Array<number> | null {
+    let ip: string = SSRFProtection.stripZoneId(address.toLowerCase());
+
+    if (net.isIPv6(ip) === false) {
+      return null;
+    }
+
+    // Fold a dotted-quad tail into the two hex groups it stands for.
+    const lastColonIndex: number = ip.lastIndexOf(":");
+    const tail: string = ip.substring(lastColonIndex + 1);
+    if (tail.includes(".")) {
+      if (net.isIPv4(tail) === false) {
+        return null;
+      }
+      const octets: Array<number> = tail.split(".").map((part: string) => {
+        return parseInt(part, 10);
+      });
+      const high: string = (
+        ((octets[0] as number) << 8) |
+        (octets[1] as number)
+      ).toString(16);
+      const low: string = (
+        ((octets[2] as number) << 8) |
+        (octets[3] as number)
+      ).toString(16);
+      ip = `${ip.substring(0, lastColonIndex)}:${high}:${low}`;
+    }
+
+    const halves: Array<string> = ip.split("::");
+    if (halves.length > 2) {
+      return null;
+    }
+
+    const head: Array<string> =
+      halves[0] === undefined || halves[0] === "" ? [] : halves[0].split(":");
+    const rear: Array<string> =
+      halves.length === 2 && halves[1] !== undefined && halves[1] !== ""
+        ? halves[1].split(":")
+        : [];
+
+    let groups: Array<string>;
+    if (halves.length === 2) {
+      const zeroFill: number = 8 - head.length - rear.length;
+      if (zeroFill < 0) {
+        return null;
+      }
+      groups = [...head, ...new Array(zeroFill).fill("0"), ...rear];
+    } else {
+      groups = head;
+    }
+
+    if (groups.length !== 8) {
+      return null;
+    }
+
+    const parsed: Array<number> = groups.map((group: string) => {
+      return parseInt(group || "0", 16);
+    });
+
+    if (
+      parsed.some((group: number) => {
+        return Number.isNaN(group) || group < 0 || group > 0xffff;
+      })
+    ) {
+      return null;
+    }
+
+    return parsed;
+  }
+
+  /*
+   * True when an IPv6 literal points somewhere the server must never be made
+   * to reach. Ranges, not spellings: loopback, unspecified, link-local
+   * (fe80::/10), unique-local (fc00::/7) and multicast (ff00::/8), plus the
+   * three ways IPv6 can carry an IPv4 destination - IPv4-mapped
+   * (::ffff:0:0/96), IPv4-compatible (::/96) and the NAT64 well-known prefix
+   * (64:ff9b::/96) - which are handed to the IPv4 blocklist.
+   */
+  private static isBlockedIpv6(address: string): boolean {
+    const groups: Array<number> | null = SSRFProtection.expandIpv6(address);
+
+    if (!groups) {
+      // Not parseable as IPv6; the caller's other checks decide.
+      return false;
+    }
+
+    const isZeroThrough: (endExclusive: number) => boolean = (
+      endExclusive: number,
+    ): boolean => {
+      return groups.slice(0, endExclusive).every((group: number) => {
+        return group === 0;
+      });
+    };
+
+    const embeddedIpv4: () => string = (): string => {
+      const high: number = groups[6] as number;
+      const low: number = groups[7] as number;
+      return `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`;
+    };
+
+    // ::  — unspecified. Connecting here lands on the local host.
+    if (isZeroThrough(8)) {
+      return true;
+    }
+
+    // ::1 — loopback.
+    if (isZeroThrough(7) && groups[7] === 1) {
+      return true;
+    }
+
+    // ::ffff:0:0/96 — IPv4-mapped.
+    if (isZeroThrough(5) && groups[5] === 0xffff) {
+      return SSRFProtection.isBlockedIpv4(embeddedIpv4());
+    }
+
+    // 64:ff9b::/96 — NAT64 well-known prefix.
+    if (
+      groups[0] === 0x0064 &&
+      groups[1] === 0xff9b &&
+      groups[2] === 0 &&
+      groups[3] === 0 &&
+      groups[4] === 0 &&
+      groups[5] === 0
+    ) {
+      return SSRFProtection.isBlockedIpv4(embeddedIpv4());
+    }
+
+    // ::/96 — IPv4-compatible (deprecated, still routable by some stacks).
+    if (isZeroThrough(6)) {
+      return SSRFProtection.isBlockedIpv4(embeddedIpv4());
+    }
+
+    const first: number = groups[0] as number;
+
+    // fe80::/10 — link-local.
+    if ((first & 0xffc0) === 0xfe80) {
+      return true;
+    }
+
+    // fc00::/7 — unique-local.
+    if ((first & 0xfe00) === 0xfc00) {
+      return true;
+    }
+
+    // fec0::/10 — site-local. Deprecated by RFC 3879, still routed on some networks.
+    if ((first & 0xffc0) === 0xfec0) {
+      return true;
+    }
+
+    // ff00::/8 — multicast.
+    if ((first & 0xff00) === 0xff00) {
+      return true;
+    }
+
+    return false;
+  }
+
+  private static isBlockedIpv4(address: string): boolean {
+    const octets: Array<number> = address.split(".").map((part: string) => {
+      return Number(part);
+    });
+
+    if (
+      octets.length !== 4 ||
+      octets.some((octet: number) => {
+        return Number.isNaN(octet) || octet < 0 || octet > 255;
+      })
+    ) {
+      return true;
+    }
+
+    const [first, second] = octets as [number, number, number, number];
+
+    if (first === 0) {
+      return true; // 0.0.0.0/8 — "this host".
+    }
+    if (first === 127) {
+      return true; // loopback
+    }
+    if (first === 10) {
+      return true; // RFC-1918
+    }
+    if (first === 172 && (second & 0xf0) === 16) {
+      return true; // RFC-1918 172.16/12
+    }
+    if (first === 192 && second === 168) {
+      return true; // RFC-1918
+    }
+    if (first === 169 && second === 254) {
+      return true; // link-local, incl. the 169.254.169.254 metadata endpoint
+    }
+    if (first === 100 && (second & 0xc0) === 64) {
+      return true; // CGNAT 100.64/10
+    }
+    if (first >= 224) {
+      return true; // multicast, reserved, and 255.255.255.255
+    }
+
+    return false;
   }
 
   private static isBlockedHostnameLiteral(hostname: string): boolean {
     if (
       hostname === "localhost" ||
+      hostname === "localhost." ||
       hostname.endsWith(".localhost") ||
       hostname === "metadata.google.internal"
     ) {
       return true;
     }
 
-    const ipv4Match: RegExpMatchArray | null = hostname.match(
-      /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/,
+    const address: string = SSRFProtection.stripZoneId(
+      hostname.replace(/^\[|\]$/g, ""),
     );
-    if (ipv4Match) {
-      const octets: Array<number> = [
-        Number(ipv4Match[1]),
-        Number(ipv4Match[2]),
-        Number(ipv4Match[3]),
-        Number(ipv4Match[4]),
-      ];
-
-      if (
-        octets.some((o: number) => {
-          return o < 0 || o > 255;
-        })
-      ) {
-        return true;
-      }
-      if (octets[0] === 0) {
-        return true;
-      }
-      if (octets[0] === 127) {
-        return true;
-      }
-      if (octets[0] === 10) {
-        return true;
-      }
-      if (octets[0] === 172 && (octets[1]! & 0xf0) === 16) {
-        return true;
-      }
-      if (octets[0] === 192 && octets[1] === 168) {
-        return true;
-      }
-      if (octets[0] === 169 && octets[1] === 254) {
-        return true;
-      }
-      if (octets[0] === 100 && (octets[1]! & 0xc0) === 64) {
-        return true;
-      }
-      return false;
+
+    if (net.isIPv4(address)) {
+      return SSRFProtection.isBlockedIpv4(address);
     }
 
-    if (hostname.includes(":")) {
-      const stripped: string = hostname.replace(/^\[|\]$/g, "");
-      if (stripped === "::1" || stripped === "::") {
-        return true;
-      }
-      if (stripped.startsWith("fe80:") || stripped.startsWith("fe80::")) {
-        return true;
-      }
-      if (IPV6_UNIQUE_LOCAL_REGEX.test(stripped)) {
-        return true;
-      }
+    if (net.isIPv6(address)) {
+      return SSRFProtection.isBlockedIpv6(address);
     }
 
     return false;

package/Server/Utils/StartServer.ts

@@ -127,6 +127,14 @@ const setDefaultHeaders: RequestHandler = (
 
   res.header("Access-Control-Expose-Headers", CORS_EXPOSED_HEADERS.join(", "));
 
+  /*
+   * Content sniffing turns "the server declared a boring type" into "the
+   * browser guessed an interesting one", which is how an upload becomes a
+   * document. nginx sets this on the static app locations but not on /api or
+   * /file, so set it here for everything the app itself serves.
+   */
+  res.header("X-Content-Type-Options", "nosniff");
+
   next();
 };