@reddb-io/mcp 1.23.2 → 1.23.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reddb-io/mcp",
-  "version": "1.23.2",
+  "version": "1.23.4",
   "description": "Zero-install npx launcher for the RedDB MCP surface — fetches the matching red binary and spawns `red mcp` over stdio.",
   "type": "module",
   "bin": {

package/src/internal/asset-fetcher/download.js

@@ -3,6 +3,71 @@ import { request as httpRequest } from 'node:http'
 
 const MAX_REDIRECTS = 5
 
+/**
+ * Hosts a release download may be served from. The postinstall script writes
+ * the response to disk and then executes it, so an unrestricted redirect
+ * chain (or a plain-http hop) turns any network position into code
+ * execution on the installing machine. GitHub serves release assets from
+ * `github.com` and redirects to its object storage.
+ */
+const ALLOWED_HOSTS = new Set([
+  'github.com',
+  'objects.githubusercontent.com',
+  'release-assets.githubusercontent.com',
+  'raw.githubusercontent.com',
+])
+
+/**
+ * Ceiling on a downloaded asset. The `red` binary is tens of megabytes; a
+ * response without this cap is buffered in full whatever its size.
+ */
+const MAX_BODY_BYTES = 512 * 1024 * 1024
+
+export class DisallowedHostError extends Error {
+  constructor(url) {
+    super(`refusing to download from a non-allowlisted host: ${url}`)
+    this.name = 'DisallowedHostError'
+    this.code = 'DISALLOWED_HOST'
+    this.url = url
+  }
+}
+
+export class ResponseTooLargeError extends Error {
+  constructor(url, limit) {
+    super(`response from ${url} exceeds the ${limit}-byte limit`)
+    this.name = 'ResponseTooLargeError'
+    this.code = 'RESPONSE_TOO_LARGE'
+    this.url = url
+    this.limit = limit
+  }
+}
+
+/**
+ * Reject anything that is not https on an allowlisted host. Applied to the
+ * initial URL and to every redirect target, since a redirect is exactly how
+ * an attacker would leave the allowlist.
+ *
+ * `allowedHosts` exists so the test suite can point the transport at a local
+ * server; production callers never pass it and get {@link ALLOWED_HOSTS}
+ * plus the https requirement.
+ */
+export function assertDownloadableUrl(url, allowedHosts = ALLOWED_HOSTS) {
+  let parsed
+  try {
+    parsed = new URL(url)
+  } catch {
+    throw new DisallowedHostError(url)
+  }
+  const isDefaultPolicy = allowedHosts === ALLOWED_HOSTS
+  if (isDefaultPolicy && parsed.protocol !== 'https:') {
+    throw new DisallowedHostError(url)
+  }
+  if (!allowedHosts.has(parsed.hostname)) {
+    throw new DisallowedHostError(url)
+  }
+  return parsed
+}
+
 export class AssetNotFoundError extends Error {
   constructor(url) {
     super(`asset not found (HTTP 404) at ${url}`)
@@ -31,21 +96,27 @@ export class TooManyRedirectsError extends Error {
   }
 }
 
-function pickRequest(url) {
-  return url.startsWith('http://') ? httpRequest : httpsRequest
-}
-
 function resolveLocation(currentUrl, location) {
   if (/^https?:\/\//i.test(location)) return location
   return new URL(location, currentUrl).toString()
 }
 
-export function downloadFollowingRedirects(url, { userAgent, originalUrl } = {}, depth = 0) {
+export function downloadFollowingRedirects(
+  url,
+  { userAgent, originalUrl, allowedHosts } = {},
+  depth = 0,
+) {
   const startUrl = originalUrl || url
   if (depth > MAX_REDIRECTS) {
     return Promise.reject(new TooManyRedirectsError(startUrl))
   }
-  const request = pickRequest(url)
+  let parsed
+  try {
+    parsed = assertDownloadableUrl(url, allowedHosts)
+  } catch (err) {
+    return Promise.reject(err)
+  }
+  const request = parsed.protocol === 'http:' ? httpRequest : httpsRequest
   return new Promise((resolve, reject) => {
     const req = request(
       url,
@@ -61,10 +132,11 @@ export function downloadFollowingRedirects(url, { userAgent, originalUrl } = {},
         if (status >= 300 && status < 400 && res.headers.location) {
           res.resume()
           const next = resolveLocation(url, res.headers.location)
-          downloadFollowingRedirects(next, { userAgent, originalUrl: startUrl }, depth + 1).then(
-            resolve,
-            reject,
-          )
+          downloadFollowingRedirects(
+            next,
+            { userAgent, originalUrl: startUrl, allowedHosts },
+            depth + 1,
+          ).then(resolve, reject)
           return
         }
         if (status === 404) {
@@ -78,7 +150,16 @@ export function downloadFollowingRedirects(url, { userAgent, originalUrl } = {},
           return
         }
         const chunks = []
-        res.on('data', (chunk) => chunks.push(chunk))
+        let received = 0
+        res.on('data', (chunk) => {
+          received += chunk.length
+          if (received > MAX_BODY_BYTES) {
+            res.destroy()
+            reject(new ResponseTooLargeError(startUrl, MAX_BODY_BYTES))
+            return
+          }
+          chunks.push(chunk)
+        })
         res.on('end', () => resolve(Buffer.concat(chunks)))
         res.on('error', reject)
       },

package/src/internal/asset-fetcher/index.js

@@ -26,7 +26,44 @@
 
 import { composeAssetName } from './asset-name.js'
 import { downloadFollowingRedirects } from './download.js'
-import { verifySha256 } from './checksum.js'
+import { sha256Hex, verifySha256, ChecksumMismatchError } from './checksum.js'
+
+/**
+ * A GitHub `owner/name` pair. `repo` reaches this function from
+ * `REDDB_POSTINSTALL_REPO` / `REDDB_MCP_REPO`, and is interpolated into the
+ * download URL, so a value containing a path or authority would point the
+ * download somewhere else entirely.
+ */
+const REPO_PATTERN = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/
+
+/** A release tag, as it appears in the download URL path. */
+const TAG_PATTERN = /^[A-Za-z0-9._+-]+$/
+
+export class ChecksumUnavailableError extends Error {
+  constructor(assetName) {
+    super(
+      `no SHA256SUMS entry for ${assetName}; refusing to install an unverified binary ` +
+        `(set REDDB_POSTINSTALL_ALLOW_UNVERIFIED=1 to override)`,
+    )
+    this.name = 'ChecksumUnavailableError'
+    this.code = 'CHECKSUM_UNAVAILABLE'
+    this.assetName = assetName
+  }
+}
+
+/**
+ * Parse a `SHA256SUMS` file (`<hex>  <filename>` per line) and return the
+ * digest recorded for `assetName`, or `null` when it is not listed.
+ */
+export function sha256FromSumsFile(text, assetName) {
+  for (const line of String(text).split('\n')) {
+    const match = line.trim().match(/^([0-9a-fA-F]{64})\s+\*?(.+)$/)
+    if (match && match[2].trim() === assetName) {
+      return match[1].toLowerCase()
+    }
+  }
+  return null
+}
 
 export async function fetchReleaseAsset({ repo, tag, platform, arch, binName, sha256 } = {}) {
   if (typeof repo !== 'string' || repo === '') {
@@ -42,11 +79,52 @@ export async function fetchReleaseAsset({ repo, tag, platform, arch, binName, sh
     throw new TypeError('fetchReleaseAsset: `arch` must be a non-empty string')
   }
 
+  if (!REPO_PATTERN.test(repo)) {
+    throw new TypeError(`fetchReleaseAsset: \`repo\` must be "owner/name", got ${JSON.stringify(repo)}`)
+  }
+  if (!TAG_PATTERN.test(tag)) {
+    throw new TypeError(`fetchReleaseAsset: \`tag\` contains unsupported characters: ${JSON.stringify(tag)}`)
+  }
+
   const assetName = composeAssetName({ platform, arch, binName })
-  const url = `https://github.com/${repo}/releases/download/${tag}/${assetName}`
-  const body = await downloadFollowingRedirects(url)
+  const base = `https://github.com/${repo}/releases/download/${tag}`
+  const body = await downloadFollowingRedirects(`${base}/${assetName}`)
+
+  // The caller may pin a digest; otherwise fall back to the `SHA256SUMS`
+  // file the release publishes beside the assets. The downloaded bytes are
+  // written to disk and executed, so installing them unverified is the one
+  // outcome worth failing the install over — `install.sh` has verified since
+  // it shipped, and this path had not.
   if (sha256) {
     verifySha256(body, sha256)
+    return body
+  }
+
+  let expected = null
+  try {
+    const sums = await downloadFollowingRedirects(`${base}/SHA256SUMS`)
+    expected = sha256FromSumsFile(sums.toString('utf8'), assetName)
+  } catch {
+    expected = null
   }
-  return body
+  if (expected) {
+    if (sha256Hex(body) !== expected) {
+      throw new ChecksumMismatchError(expected, sha256Hex(body))
+    }
+    return body
+  }
+  if (allowUnverified()) {
+    return body
+  }
+  throw new ChecksumUnavailableError(assetName)
+}
+
+/**
+ * Escape hatch for installing from a release that predates `SHA256SUMS`, or
+ * from a fork that does not publish one. Opt-in and loud rather than the
+ * silent default it used to be.
+ */
+function allowUnverified() {
+  const raw = process.env.REDDB_POSTINSTALL_ALLOW_UNVERIFIED
+  return raw === '1' || raw === 'true' || raw === 'yes'
 }