@pixelbyte-software/pixcode 1.53.28 → 1.54.1

package/server/utils/port-access.js

@@ -2,7 +2,7 @@ import os from 'os';
 import fs from 'fs';
 import path from 'path';
 import readline from 'readline';
-import { execSync } from 'child_process';
+import { execSync, spawnSync } from 'child_process';
 
 import { c } from './colors.js';
 
@@ -65,7 +65,7 @@ function tryUfw(port) {
     const status = execSync('ufw status', { stdio: 'pipe', encoding: 'utf8' });
     // UFW inactive = no rule needed; the port is already reachable.
     if (!/active/i.test(status)) return 'inactive';
-    execSync(`sudo -n ufw allow ${port}/tcp`, { stdio: 'pipe' });
+    execSync('sudo -n ufw allow ' + String(port) + '/tcp', { stdio: 'pipe' });
     return 'applied';
   } catch {
     return null;
@@ -77,7 +77,7 @@ function tryFirewalld(port) {
     execSync('command -v firewall-cmd', { stdio: 'pipe' });
     const state = execSync('firewall-cmd --state', { stdio: 'pipe', encoding: 'utf8' });
     if (!/running/i.test(state)) return 'inactive';
-    execSync(`sudo -n firewall-cmd --add-port=${port}/tcp --permanent`, { stdio: 'pipe' });
+    execSync('sudo -n firewall-cmd --add-port=' + String(port) + '/tcp --permanent', { stdio: 'pipe' });
     execSync('sudo -n firewall-cmd --reload', { stdio: 'pipe' });
     return 'applied';
   } catch {
@@ -89,12 +89,19 @@ function tryFirewalld(port) {
 
 function applyWindowsRule(port) {
   const ruleName = `Pixcode-${port}`;
-  const cmd = `netsh advfirewall firewall add rule name="${ruleName}" dir=in action=allow protocol=TCP localport=${port}`;
+  // Use spawnSync with an argument array instead of execSync with a shell
+  // string to prevent command injection. Port is validated as an integer
+  // at the entry point, but this is defense-in-depth.
   try {
-    execSync(cmd, { stdio: 'pipe' });
-    return { ok: true, cmd, ruleName };
+    spawnSync('netsh', [
+      'advfirewall', 'firewall', 'add', 'rule',
+      `name=${ruleName}`,
+      'dir=in', 'action=allow', 'protocol=TCP',
+      `localport=${port}`,
+    ], { stdio: 'pipe', shell: false });
+    return { ok: true, ruleName };
   } catch (error) {
-    return { ok: false, cmd, ruleName, error: error.message };
+    return { ok: false, ruleName, error: error.message };
   }
 }
 
@@ -125,6 +132,16 @@ function macFirewallHint(port) {
  * without any firewall change.
  */
 export async function ensurePortOpen(port) {
+  // Validate port is a safe integer to prevent command injection via the
+  // firewall commands below. The caller passes SERVER_PORT which comes from
+  // env, so this is defense-in-depth against a tampered environment.
+  const safePort = Number.parseInt(port, 10);
+  if (!Number.isInteger(safePort) || safePort < 1 || safePort > 65535) {
+    console.log(`${c.dim('[INFO]')} Skipping firewall setup: invalid port value.`);
+    return;
+  }
+  port = safePort;
+
   const state = loadState();
   const key = `port:${port}`;
   const entry = state[key];
@@ -185,8 +202,9 @@ export async function ensurePortOpen(port) {
       console.log(`${c.ok('[OK]')}   Firewall rule "${result.ruleName}" added.`);
       saveState({ ...state, [key]: { decision: 'allow', status: 'applied', via: 'windows' } });
     } else {
+      const manualCmd = `netsh advfirewall firewall add rule name="Pixcode-${port}" dir=in action=allow protocol=TCP localport=${port}`;
       console.log(`${c.tip('[TIP]')}  Adding the rule needs Administrator. Run this in an elevated PowerShell:`);
-      console.log(`       ${c.bright(result.cmd)}`);
+      console.log(`       ${c.bright(manualCmd)}`);
       saveState({ ...state, [key]: { decision: 'allow', status: 'manual' } });
     }
     return;

package/server/utils/security-log.js

@@ -0,0 +1,84 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+
+const LOG_DIR = path.join(os.homedir(), '.pixcode', 'logs');
+const SECURITY_LOG_PATH = path.join(LOG_DIR, 'security.log');
+const MAX_LOG_SIZE = 10 * 1024 * 1024;
+const MAX_LOG_FILES = 5;
+
+function ensureLogDir() {
+    try {
+        if (!fs.existsSync(LOG_DIR)) {
+            fs.mkdirSync(LOG_DIR, { recursive: true, mode: 0o700 });
+        }
+    } catch {
+        // Non-fatal: if we can't create the log dir, we fall back to console
+    }
+}
+
+function sanitizeForLog(value) {
+    if (typeof value !== 'string') {
+        try {
+            value = String(value ?? '');
+        } catch {
+            return '[unserializable]';
+        }
+    }
+    return value
+        .replace(/[\r\n\t]/g, ' ')
+        .replace(/\x1b\[[0-9;]*m/g, '')
+        .slice(0, 500);
+}
+
+function rotateLogIfNeeded() {
+    try {
+        if (!fs.existsSync(SECURITY_LOG_PATH)) return;
+        const stats = fs.statSync(SECURITY_LOG_PATH);
+        if (stats.size < MAX_LOG_SIZE) return;
+        for (let i = MAX_LOG_FILES - 1; i >= 1; i--) {
+            const oldPath = `${SECURITY_LOG_PATH}.${i}`;
+            const newPath = `${SECURITY_LOG_PATH}.${i + 1}`;
+            if (fs.existsSync(oldPath)) {
+                try { fs.renameSync(oldPath, newPath); } catch { /* noop */ }
+            }
+        }
+        try { fs.renameSync(SECURITY_LOG_PATH, `${SECURITY_LOG_PATH}.1`); } catch { /* noop */ }
+    } catch {
+        // Non-fatal
+    }
+}
+
+export function securityLog(event, details = {}) {
+    const entry = {
+        timestamp: new Date().toISOString(),
+        event,
+        ip: sanitizeForLog(details.ip),
+        userId: details.userId != null ? String(details.userId) : null,
+        username: details.username ? sanitizeForLog(details.username) : null,
+        endpoint: details.endpoint ? sanitizeForLog(details.endpoint) : null,
+        method: details.method ? sanitizeForLog(details.method) : null,
+        statusCode: details.statusCode || null,
+        reason: details.reason ? sanitizeForLog(details.reason) : null,
+        userAgent: details.userAgent ? sanitizeForLog(details.userAgent) : null,
+    };
+
+    const line = JSON.stringify(entry);
+
+    try {
+        ensureLogDir();
+        rotateLogIfNeeded();
+        fs.appendFileSync(SECURITY_LOG_PATH, line + '\n', { mode: 0o600 });
+    } catch {
+        // Fall back to console if file logging fails
+        console.warn('[SECURITY]', line);
+    }
+}
+
+export function getClientIp(req) {
+    const forwarded = req?.headers?.['x-forwarded-for'];
+    if (typeof forwarded === 'string' && forwarded.trim()) {
+        return forwarded.split(',')[0].trim();
+    }
+    return req?.socket?.remoteAddress || req?.ip || 'unknown';
+}