@pi-harness/pi-harness 0.1.22 → 0.1.23

package/packages/host-webserver/src/index.ts

@@ -33,15 +33,64 @@ function normalizePath(path: string): string {
   return path;
 }
 
+function sendError(response: ServerResponse, status: number, message: string): void {
+  response.writeHead(status, { "content-type": "application/json; charset=utf-8" });
+  response.end(JSON.stringify({ error: message }));
+}
+
 function notFound(response: ServerResponse): void {
-  response.writeHead(404, { "content-type": "application/json; charset=utf-8" });
-  response.end(JSON.stringify({ error: "Not found" }));
+  sendError(response, 404, "Not found");
 }
 
 function hostForUrl(host: string): string {
   return host.includes(":") && !host.startsWith("[") ? "[" + host + "]" : host;
 }
 
+const LOOPBACK_HOSTNAMES = new Set(["127.0.0.1", "localhost", "[::1]"]);
+const WILDCARD_HOSTS = new Set(["", "0.0.0.0", "::", "[::]"]);
+
+interface Authority {
+  readonly hostname: string;
+  readonly port: number;
+}
+
+// Parses an http authority (Host header value, or an Origin with its "http://" prefix removed) into its lowercase hostname (IPv6 stays bracketed, as WHATWG URL reports it) and effective port. Returns undefined for anything that is not a bare authority.
+function parseHttpAuthority(value: string): Authority | undefined {
+  let url: URL;
+  try {
+    url = new URL("http://" + value);
+  } catch {
+    return undefined;
+  }
+  if (url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.hostname === "") return undefined;
+  if (value.endsWith("/") || value.includes("?") || value.includes("#")) return undefined;
+  return { hostname: url.hostname, port: url.port === "" ? 80 : Number(url.port) };
+}
+
+// Browsers send the Origin header on every cross-origin request and on all non-GET/HEAD requests, so requiring it to match the (already validated) Host header blocks cross-site requests from pages the user visits. Requests without an Origin header (same-origin navigations, EventSource, curl, Node fetch) pass. The Host check defeats DNS rebinding: a page on attacker.example that resolves to 127.0.0.1 arrives with Host: attacker.example, which is neither loopback nor the configured bind host.
+function rejectForeignRequest(request: IncomingMessage, response: ServerResponse, configuredHost: string, boundPort: number): boolean {
+  const hostHeader = request.headers.host;
+  const authority = hostHeader === undefined ? undefined : parseHttpAuthority(hostHeader);
+  if (authority === undefined) {
+    sendError(response, 400, "Invalid Host header");
+    return true;
+  }
+  const hostnameAllowed =
+    WILDCARD_HOSTS.has(configuredHost) || LOOPBACK_HOSTNAMES.has(authority.hostname) || authority.hostname === hostForUrl(configuredHost).toLowerCase();
+  if (!hostnameAllowed || authority.port !== boundPort) {
+    sendError(response, 400, "Host header does not match the web server address");
+    return true;
+  }
+  const origin = request.headers.origin;
+  if (origin === undefined) return false;
+  const originAuthority = origin.startsWith("http://") ? parseHttpAuthority(origin.slice("http://".length)) : undefined;
+  if (originAuthority === undefined || originAuthority.hostname !== authority.hostname || originAuthority.port !== authority.port) {
+    sendError(response, 403, "Cross-origin requests are not allowed");
+    return true;
+  }
+  return false;
+}
+
 export default {
   name: "pi-webserver",
   async apply(context: Context, config: WebServerConfig) {
@@ -49,14 +98,18 @@ export default {
     const port = config.port ?? DEFAULT_WEB_SERVER_PORT;
     const routes = new Map<string, WebRoute["handler"]>();
     let fallback: WebRoute["handler"] | undefined;
+    // Assigned once listen() completes; tests bind port 0 so the configured port is not the one clients address.
+    let boundPort = 0;
     const server = createServer((request, response) => {
+      if (rejectForeignRequest(request, response, host, boundPort)) return;
       const path = new URL(request.url ?? "/", "http://" + hostForUrl(host)).pathname;
       const handler = routes.get(path) ?? fallback;
       if (handler === undefined) {
         notFound(response);
         return;
       }
-      void Promise.resolve(handler(request, response)).catch((error: unknown) => {
+      // Invoke inside an async function so a synchronous throw is routed into the same 500 path as an async rejection instead of escaping the request listener as an uncaught exception.
+      void (async () => handler(request, response))().catch((error: unknown) => {
         if (response.headersSent) {
           response.destroy(error instanceof Error ? error : new Error(String(error)));
           return;
@@ -74,6 +127,7 @@ export default {
     });
     const address = server.address();
     if (address === null || typeof address === "string") throw new Error("Web server did not expose a TCP address");
+    boundPort = address.port;
     const service: WebServer = {
       host,
       port: address.port,

package/packages/host-webserver/test/index.test.ts

@@ -1,6 +1,7 @@
 import { Context } from "@deepseek-ai/cordis";
+import { request as httpRequest } from "node:http";
 import { afterEach, describe, expect, test } from "vitest";
-import webServerPlugin, { DEFAULT_WEB_SERVER_PORT } from "../src/index.js";
+import webServerPlugin, { DEFAULT_WEB_SERVER_PORT, type WebServer } from "../src/index.js";
 
 const contexts: Context[] = [];
 
@@ -8,6 +9,42 @@ afterEach(async () => {
   await Promise.all(contexts.splice(0).map(async (context) => context.fiber.dispose()));
 });
 
+async function startServer(config: { host?: string; port: number }): Promise<WebServer> {
+  const context = new Context();
+  contexts.push(context);
+  await context.plugin(webServerPlugin, config);
+  return context.webServer;
+}
+
+// Node's fetch strips a caller-supplied Host header, so raw node:http is needed to emulate a DNS-rebinding request.
+function rawRequest(server: WebServer, headers: Record<string, string>, method = "GET"): Promise<{ status: number; body: string }> {
+  return new Promise((resolve, reject) => {
+    const request = httpRequest({ host: "127.0.0.1", port: server.port, path: "/health", method, headers }, (response) => {
+      let body = "";
+      response.setEncoding("utf8");
+      response.on("data", (chunk: string) => {
+        body += chunk;
+      });
+      response.on("end", () => resolve({ status: response.statusCode ?? 0, body }));
+    });
+    request.on("error", reject);
+    request.end();
+  });
+}
+
+function registerHealth(server: WebServer): { calls: number } {
+  const state = { calls: 0 };
+  server.register({
+    path: "/health",
+    handler(_request, response) {
+      state.calls += 1;
+      response.writeHead(200, { "content-type": "text/plain; charset=utf-8" });
+      response.end("ok");
+    },
+  });
+  return state;
+}
+
 describe("web server plugin", () => {
   test("uses the memorable Pi default port", () => {
     expect(DEFAULT_WEB_SERVER_PORT).toBe(3141);
@@ -47,4 +84,95 @@ describe("web server plugin", () => {
     expect(() => context.webServer.register({ path: "health", handler() {} })).toThrow(/absolute/);
     expect(() => context.webServer.register({ path: "/health/", handler() {} })).toThrow(/trailing slash/);
   });
+
+  test("turns a synchronous handler throw into a 500 response and keeps serving", async () => {
+    const server = await startServer({ host: "127.0.0.1", port: 0 });
+    server.register({
+      path: "/sync-throw",
+      handler() {
+        throw new Error("boom-sync");
+      },
+    });
+    server.register({
+      path: "/async-throw",
+      handler() {
+        return Promise.reject(new Error("boom-async"));
+      },
+    });
+    registerHealth(server);
+
+    await expect(
+      fetch(server.url + "/sync-throw").then(async (response) => ({ status: response.status, body: (await response.json()) as unknown })),
+    ).resolves.toEqual({
+      status: 500,
+      body: { error: "boom-sync" },
+    });
+    await expect(
+      fetch(server.url + "/async-throw").then(async (response) => ({ status: response.status, body: (await response.json()) as unknown })),
+    ).resolves.toEqual({
+      status: 500,
+      body: { error: "boom-async" },
+    });
+    await expect(fetch(server.url + "/health")).resolves.toMatchObject({ status: 200 });
+  });
+
+  test("rejects cross-origin requests with 403 before any handler or fallback runs", async () => {
+    const server = await startServer({ host: "127.0.0.1", port: 0 });
+    const health = registerHealth(server);
+    let fallbackCalls = 0;
+    server.registerFallback((_request, response) => {
+      fallbackCalls += 1;
+      response.end("fallback");
+    });
+
+    const crossOrigin = await fetch(server.url + "/health", { method: "POST", headers: { origin: "https://evil.example" }, body: "{}" });
+    expect(crossOrigin.status).toBe(403);
+    await expect(crossOrigin.json()).resolves.toEqual({ error: "Cross-origin requests are not allowed" });
+    await expect(fetch(server.url + "/anything", { method: "POST", headers: { origin: "https://evil.example" }, body: "{}" })).resolves.toMatchObject({
+      status: 403,
+    });
+    await expect(fetch(server.url + "/health", { headers: { origin: "null" } })).resolves.toMatchObject({ status: 403 });
+    await expect(fetch(server.url + "/health", { headers: { origin: "http://127.0.0.1:" + (server.port + 1) } })).resolves.toMatchObject({ status: 403 });
+    await expect(fetch(server.url + "/health", { headers: { origin: "https://127.0.0.1:" + server.port } })).resolves.toMatchObject({ status: 403 });
+    expect(health.calls).toBe(0);
+    expect(fallbackCalls).toBe(0);
+
+    await expect(fetch(server.url + "/health", { method: "POST", headers: { origin: server.url }, body: "{}" })).resolves.toMatchObject({ status: 200 });
+    expect(health.calls).toBe(1);
+  });
+
+  test("rejects requests whose Host header does not name the bound server", async () => {
+    const server = await startServer({ host: "127.0.0.1", port: 0 });
+    const health = registerHealth(server);
+
+    await expect(rawRequest(server, { host: "evil.example:" + server.port })).resolves.toEqual({
+      status: 400,
+      body: JSON.stringify({ error: "Host header does not match the web server address" }),
+    });
+    await expect(rawRequest(server, { host: "127.0.0.1:" + (server.port + 1) })).resolves.toMatchObject({ status: 400 });
+    await expect(rawRequest(server, { host: "127.0.0.1" })).resolves.toMatchObject({ status: 400 });
+    await expect(rawRequest(server, { host: "user@127.0.0.1:" + server.port })).resolves.toMatchObject({ status: 400 });
+    expect(health.calls).toBe(0);
+
+    await expect(rawRequest(server, { host: "localhost:" + server.port, origin: "http://localhost:" + server.port }, "POST")).resolves.toMatchObject({
+      status: 200,
+    });
+    await expect(rawRequest(server, { host: "LOCALHOST:" + server.port })).resolves.toMatchObject({ status: 200 });
+    await expect(rawRequest(server, { host: "[::1]:" + server.port })).resolves.toMatchObject({ status: 200 });
+    await expect(rawRequest(server, { host: "localhost:" + server.port, origin: "http://127.0.0.1:" + server.port })).resolves.toMatchObject({ status: 403 });
+    expect(health.calls).toBe(3);
+  });
+
+  test("accepts the configured non-loopback host and any hostname on a wildcard bind", async () => {
+    const wildcard = await startServer({ host: "0.0.0.0", port: 0 });
+    registerHealth(wildcard);
+    await expect(rawRequest(wildcard, { host: "workstation.lan:" + wildcard.port })).resolves.toMatchObject({ status: 200 });
+    await expect(rawRequest(wildcard, { host: "workstation.lan:" + (wildcard.port + 1) })).resolves.toMatchObject({ status: 400 });
+
+    const ipv6 = await startServer({ host: "::1", port: 0 });
+    registerHealth(ipv6);
+    expect(ipv6.url).toBe("http://[::1]:" + ipv6.port);
+    await expect(fetch(ipv6.url + "/health")).resolves.toMatchObject({ status: 200 });
+    await expect(fetch(ipv6.url + "/health", { headers: { origin: ipv6.url } })).resolves.toMatchObject({ status: 200 });
+  });
 });