@saltcorn/server 1.6.0-beta.3 → 1.6.0-beta.5

package/routes/tenant.js

@@ -43,7 +43,7 @@ const {
 } = require("@saltcorn/markup/tags");
 const db = require("@saltcorn/data/db");
 
-const { loadAllPlugins, loadAndSaveNewPlugin } = require("../load_plugins");
+const Plugin = require("@saltcorn/data/models/plugin");
 const {
   isAdmin,
   error_catcher,
@@ -309,9 +309,9 @@ router.post(
 
         await create_tenant({
           t: subdomain,
-          plugin_loader: loadAllPlugins,
+          plugin_loader: Plugin.loadAllPlugins,
           noSignalOrDB: false,
-          loadAndSaveNewPlugin: loadAndSaveNewPlugin,
+          loadAndSaveNewPlugin: Plugin.loadAndSaveNewPlugin,
           tenant_template,
         });
         let new_url_create = newurl;

package/routes/utils.js

@@ -389,9 +389,41 @@ const addOnDoneRedirect = (oldPath, req) => {
   return oldPath;
 };
 
-//https://stackoverflow.com/a/38979205/19839414
 const is_relative_url = (url) => {
-  return typeof url === "string" && !url.includes(":/") && !url.includes("//");
+  if (typeof url !== "string") return false;
+
+  // Normalise backslashes to forward slashes (WHATWG treats \ as / in special schemes)
+  const normalised = url.replace(/\\/g, "/");
+
+  // Reject protocol-relative URLs (//example.com)
+  if (normalised.trimStart().startsWith("//")) return false;
+
+  // Reject any scheme: URIs (e.g. http:, javascript:, data:, vbscript:)
+  // A scheme is a letter followed by letters/digits/+/-/. then a colon (RFC 3986 §3.1)
+  if (/^[a-zA-Z][a-zA-Z0-9+\-.]*:/u.test(normalised.trimStart())) return false;
+
+  return true;
+};
+
+const normalize_relative_url = (url) => {
+  if (typeof url !== "string") return null;
+
+  const normalised = url.replace(/\\/g, "/").trimStart();
+
+  // Reject protocol-relative URLs
+  if (normalised.startsWith("//")) return null;
+
+  // Reject any scheme (RFC 3986 §3.1)
+  if (/^[a-zA-Z][a-zA-Z0-9+\-.]*:/.test(normalised)) return null;
+
+  return normalised;
+};
+
+const safe_redirect = (res, url, default_url) => {
+  if (!url) res.redirect(default_url);
+  const dest = normalize_relative_url(url);
+  if (dest !== null) res.redirect(dest);
+  else res.redirect(default_url);
 };
 
 /**
@@ -647,6 +679,8 @@ module.exports = {
   get_tenant_from_req,
   addOnDoneRedirect,
   is_relative_url,
+  normalize_relative_url,
+  safe_redirect,
   is_ip_address,
   get_sys_info,
   admin_config_route,

package/routes/viewedit.js

@@ -1019,7 +1019,7 @@ router.post(
   "/copilot-generate-layout",
   isAdminOrHasConfigMinRole(["min_role_edit_views", "min_role_edit_pages"]),
   error_catcher(async (req, res) => {
-    const { mode, table, prompt } = req.body;
+    const { mode, table, prompt, existing } = req.body;
     const f = getState().functions.copilot_generate_layout;
     if (!f) {
       res.json({
@@ -1027,7 +1027,7 @@ router.post(
       });
       return;
     }
-    const layout = await f.run(prompt, mode, table);
+    const layout = await f.run(prompt, mode, table, existing);
     res.json({ success: "ok", layout });
   })
 );

package/serve.js

@@ -24,11 +24,6 @@ const path = require("path");
 const getApp = require("./app");
 const Trigger = require("@saltcorn/data/models/trigger");
 const cluster = require("cluster");
-const {
-  loadAllPlugins,
-  loadAndSaveNewPlugin,
-  loadPlugin,
-} = require("./load_plugins");
 const { getConfig, setConfig } = require("@saltcorn/data/models/config");
 const { migrate } = require("@saltcorn/data/migrate");
 const socketio = require("socket.io");
@@ -255,7 +250,7 @@ const initMaster = async (
       async () => await migrate(db.connectObj.default_schema, true)
     );
   // load all plugins
-  await loadAllPlugins(true);
+  await Plugin.loadAllPlugins(true);
   // switch on sql logging - but it was initiated before???
   if (getState().getConfig("log_sql", false)) db.set_sql_logging();
 
@@ -265,7 +260,7 @@ const initMaster = async (
   if (db.is_it_multi_tenant()) {
     const tenants = await getAllTenants();
     await init_multi_tenant(
-      () => loadAllPlugins(true),
+      () => Plugin.loadAllPlugins(true),
       disableMigrate,
       tenants,
       db.connectObj.multi_node ? getMultiNodeListener : null
@@ -287,7 +282,7 @@ const workerDispatchMsg = ({ tenant, ...msg }) => {
 
   if (msg.refresh_plugin_cfg) {
     Plugin.findOne({ name: msg.refresh_plugin_cfg }).then((plugin) => {
-      if (plugin) loadPlugin(plugin);
+      if (plugin) Plugin.loadPlugin(plugin);
     });
   }
   if (!getState()) {
@@ -325,7 +320,7 @@ const workerDispatchMsg = ({ tenant, ...msg }) => {
   }
 
   if (msg.reload_plugins) {
-    loadAllPlugins(cluster.isPrimary, true);
+    Plugin.loadAllPlugins(cluster.isPrimary, true);
   }
   if (msg.refresh) {
     if (msg.refresh === "ephemeral_config")
@@ -337,7 +332,7 @@ const workerDispatchMsg = ({ tenant, ...msg }) => {
     add_tenant(msg.createTenant);
     create_tenant({
       t: msg.createTenant,
-      plugin_loader: loadAllPlugins,
+      plugin_loader: Plugin.loadAllPlugins,
       noSignalOrDB: true,
       tenant_template,
     });
@@ -346,9 +341,9 @@ const workerDispatchMsg = ({ tenant, ...msg }) => {
     });
   }
   if (msg.installPlugin) {
-    loadAndSaveNewPlugin(msg.installPlugin, msg.force, true);
+    Plugin.loadAndSaveNewPlugin(msg.installPlugin, msg.force, true);
   }
-  if (msg.restart_tenant) restart_tenant(loadAllPlugins);
+  if (msg.restart_tenant) restart_tenant(Plugin.loadAllPlugins);
   if (msg.removePlugin) getState().remove_plugin(msg.removePlugin, true);
 };
 
@@ -508,7 +503,7 @@ module.exports =
           4,
           "SIGHUP received: reloading plugins and state for all tenants"
         );
-        await loadAllPlugins(true, true);
+        await Plugin.loadAllPlugins(true, true);
         await getState().refresh_plugins(true);
         Object.entries(cluster.workers || {}).forEach(([wpid, w]) => {
           w.send({ reload_plugins: true });
@@ -516,7 +511,7 @@ module.exports =
         if (db.is_it_multi_tenant()) {
           for (const tenant of await getAllTenants()) {
             await db.runWithTenant(tenant, async () => {
-              await loadAllPlugins(true, true);
+              await Plugin.loadAllPlugins(true, true);
               await getState().refresh_plugins(true);
               Object.entries(cluster.workers || {}).forEach(([wpid, w]) => {
                 w.send({ tenant, reload_plugins: true });

package/tests/api.test.js

@@ -760,7 +760,7 @@ describe("API emit", () => {
     const app = await getApp({ disableCsrf: true });
     const token = await getAdminJwt();
     await request(app)
-      .post("/api/emit-event/event1")
+      .post("/api/emit-event/ReceiveMobileShareData")
       .set("Authorization", `jwt ${token}`)
       .send({ payload: { latitude: 20, longitude: 30 } })
       .expect(succeedJsonWith((success) => success === true));
@@ -770,12 +770,134 @@ describe("API emit", () => {
   it("denies an event without JWT", async () => {
     const app = await getApp({ disableCsrf: true });
     await request(app)
-      .post("/api/emit-event/event1")
+      .post("/api/emit-event/ReceiveMobileShareData")
       .send({ payload: { latitude: 20, longitude: 30 } })
       .expect(notAuthorized);
   });
 });
 
+describe("API emit-event access control", () => {
+  const getPublicJwt = async () => {
+    const app = await getApp({ disableCsrf: true });
+    const res = await request(app)
+      .post("/auth/login-with/jwt")
+      .set("X-Requested-With", "XMLHttpRequest")
+      .set("X-Saltcorn-Client", "mobile-app")
+      .send({});
+    return res.body;
+  };
+
+  let adminJwt;
+  beforeAll(async () => {
+    adminJwt = await getAdminJwt();
+  });
+
+  afterEach(async () => {
+    await getState().setConfig("mobile_emit_allowed_events", []);
+    await getState().setConfig("mobile_emit_public_events", []);
+  });
+
+  // --- authenticated user ---
+
+  it("allows authenticated user to emit ReceiveMobileShareData by default", async () => {
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/ReceiveMobileShareData")
+      .set("Authorization", `jwt ${adminJwt}`)
+      .send({ payload: {} })
+      .expect(succeedJsonWith((success) => success === true));
+  });
+
+  it("blocks authenticated user from emitting other events by default", async () => {
+    const app = await getApp({ disableCsrf: true });
+    for (const eventName of [
+      "AppChange",
+      "Login",
+      "Error",
+      "Startup",
+      "UserVerified",
+    ]) {
+      await request(app)
+        .post(`/api/emit-event/${eventName}`)
+        .set("Authorization", `jwt ${adminJwt}`)
+        .send({ payload: {} })
+        .expect(
+          respondJsonWith(403, (resp) => resp.error === "Event type not allowed")
+        );
+    }
+  });
+
+  it("allows authenticated user to emit event listed in mobile_emit_allowed_events config", async () => {
+    await getState().setConfig("mobile_emit_allowed_events", ["AppChange"]);
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/AppChange")
+      .set("Authorization", `jwt ${adminJwt}`)
+      .send({ payload: {} })
+      .expect(succeedJsonWith((success) => success === true));
+  });
+
+  it("blocks authenticated user from emitting event not listed in mobile_emit_allowed_events config", async () => {
+    await getState().setConfig("mobile_emit_allowed_events", ["AppChange"]);
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/Login")
+      .set("Authorization", `jwt ${adminJwt}`)
+      .send({ payload: {} })
+      .expect(
+        respondJsonWith(403, (resp) => resp.error === "Event type not allowed")
+      );
+  });
+
+  // --- public user ---
+
+  it("blocks public JWT user from emitting any event by default", async () => {
+    const publicJwt = await getPublicJwt();
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/ReceiveMobileShareData")
+      .set("Authorization", `jwt ${publicJwt}`)
+      .send({ payload: {} })
+      .expect(notAuthorized);
+  });
+
+  it("allows public JWT user to emit event listed in mobile_emit_public_events config", async () => {
+    await getState().setConfig("mobile_emit_public_events", [
+      "CustomerEnquiry",
+    ]);
+    const publicJwt = await getPublicJwt();
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/CustomerEnquiry")
+      .set("Authorization", `jwt ${publicJwt}`)
+      .send({ payload: {} })
+      .expect(succeedJsonWith((success) => success === true));
+  });
+
+  it("blocks public JWT user from emitting event not listed in mobile_emit_public_events config", async () => {
+    await getState().setConfig("mobile_emit_public_events", [
+      "CustomerEnquiry",
+    ]);
+    const publicJwt = await getPublicJwt();
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/OtherEvent")
+      .set("Authorization", `jwt ${publicJwt}`)
+      .send({ payload: {} })
+      .expect(notAuthorized);
+  });
+
+  // --- no token ---
+
+  it("blocks request with no JWT at all", async () => {
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/ReceiveMobileShareData")
+      .send({ payload: {} })
+      .expect(notAuthorized);
+  });
+});
+
 describe("test share handler", () => {
   beforeAll(async () => {
     const sharedData = await Table.create("shared_data");
@@ -885,3 +1007,147 @@ describe("API upload-files", () => {
       .expect(respondJsonWith(400, (resp) => resp.error === "No file found"));
   });
 });
+
+describe("API cross-table sub-select access control", () => {
+  it("should not allow probing restricted tables via sub-select query syntax", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // The patients table has min_role_read=40 (staff).
+    // A public user should not be able to learn anything about patients data.
+    // The books table is public (min_role_read=100).
+    // The sub-select syntax (e.g. ?id.patients->name=Kirk) constructs:
+    //   WHERE id IN (SELECT id FROM patients WHERE name ILIKE '%Kirk%')
+    // This leaks whether a patient named "Kirk" exists by observing
+    // whether any books are returned.
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    // Query WITH a name that exists in patients ("Kirk Douglas", id=1)
+    const resp1 = await request(app)
+      .get("/api/books/?id.patients->name=Kirk")
+      .expect(200);
+
+    // Query with a name that does NOT exist in patients
+    const resp2 = await request(app)
+      .get("/api/books/?id.patients->name=ZZZNONEXISTENT")
+      .expect(200);
+
+    // If the sub-select is allowed, resp1 returns books (because patient
+    // "Kirk Douglas" has id=1 which matches book id=1) while resp2
+    // returns nothing. The difference reveals that "Kirk" exists in the
+    // restricted patients table.
+    //
+    // The secure behavior is that both queries return the same results
+    // (the sub-select against a restricted table is ignored or blocked),
+    // OR the query with the sub-select is rejected entirely.
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
+
+  it("should not allow probing restricted tables via or parameter with inSelect", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // The patients table has min_role_read=40 (staff).
+    // The books table is public (min_role_read=100).
+    //
+    // The 'or' query parameter is passed directly through stateFieldsToWhere
+    // into the db where-clause without access control checks. An attacker
+    // can embed an inSelect subquery in 'or' to probe restricted tables:
+    //   ?or[0][id][inSelect][table]=patients&or[0][id][inSelect][field]=favbook
+    //    &or[0][id][inSelect][where][name]=Kirk Douglas
+    // This generates: WHERE (id IN (SELECT favbook FROM patients WHERE name='Kirk Douglas'))
+    // By observing which books are returned, the attacker can determine
+    // whether a patient with a given name exists — leaking data from the
+    // restricted patients table.
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    // Kirk Douglas exists in patients with favbook=1 (Herman Melville)
+    const resp1 = await request(app)
+      .get("/api/books/")
+      .query({
+        "or[0][id][inSelect][table]": "patients",
+        "or[0][id][inSelect][field]": "favbook",
+        "or[0][id][inSelect][where][name]": "Kirk Douglas",
+      })
+      .expect(200);
+
+    // Non-existent patient
+    const resp2 = await request(app)
+      .get("/api/books/")
+      .query({
+        "or[0][id][inSelect][table]": "patients",
+        "or[0][id][inSelect][field]": "favbook",
+        "or[0][id][inSelect][where][name]": "ZZZNONEXISTENT",
+      })
+      .expect(200);
+
+    // If the or+inSelect bypass works, resp1 returns only book id=1
+    // (Kirk Douglas's favbook) while resp2 returns nothing.
+    // Secure behavior: both return the same results (all books or error).
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
+
+  it("should not allow probing restricted tables via field object with inSelect", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // When a field value is an object, stateFieldsToWhere passes it through
+    // directly. An attacker can embed inSelect in a known field name:
+    //   ?id[inSelect][table]=patients&id[inSelect][field]=favbook&...
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    const resp1 = await request(app)
+      .get("/api/books/")
+      .query({
+        "id[inSelect][table]": "patients",
+        "id[inSelect][field]": "favbook",
+        "id[inSelect][where][name]": "Kirk Douglas",
+      })
+      .expect(200);
+
+    const resp2 = await request(app)
+      .get("/api/books/")
+      .query({
+        "id[inSelect][table]": "patients",
+        "id[inSelect][field]": "favbook",
+        "id[inSelect][where][name]": "ZZZNONEXISTENT",
+      })
+      .expect(200);
+
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
+
+  it("should not allow probing restricted tables via _not_ prefix with inSelect", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // The _not_ prefix passes user values into qstate.not[field].
+    // An attacker can embed inSelect to leak data:
+    //   ?_not_id[inSelect][table]=patients&_not_id[inSelect][field]=favbook&...
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    const resp1 = await request(app)
+      .get("/api/books/")
+      .query({
+        "_not_id[inSelect][table]": "patients",
+        "_not_id[inSelect][field]": "favbook",
+        "_not_id[inSelect][where][name]": "Kirk Douglas",
+      })
+      .expect(200);
+
+    const resp2 = await request(app)
+      .get("/api/books/")
+      .query({
+        "_not_id[inSelect][table]": "patients",
+        "_not_id[inSelect][field]": "favbook",
+        "_not_id[inSelect][where][name]": "ZZZNONEXISTENT",
+      })
+      .expect(200);
+
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
+});