@spfn/notification 0.1.0-beta.21 → 0.1.0-beta.23

package/dist/server.js

@@ -206,7 +206,10 @@ var awsSesProvider = {
 };
 
 // src/tracking/token.ts
-import { createHmac } from "crypto";
+import { createHmac, createHash, timingSafeEqual } from "crypto";
+function hashClickUrl(url) {
+  return createHash("sha256").update(url).digest("hex").slice(0, 16);
+}
 function toBase64Url(buffer) {
   return buffer.toString("base64url");
 }
@@ -237,7 +240,9 @@ function verify(token) {
   const payload = fromBase64Url(payloadEncoded);
   const expectedHmac = createHmac("sha256", secret).update(payload).digest();
   const expectedHmacEncoded = toBase64Url(expectedHmac);
-  if (hmacEncoded !== expectedHmacEncoded) {
+  const provided = Buffer.from(hmacEncoded);
+  const expected = Buffer.from(expectedHmacEncoded);
+  if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {
     return { valid: false };
   }
   return { valid: true, payload };
@@ -245,8 +250,8 @@ function verify(token) {
 function generateOpenToken(notificationId) {
   return sign(`o:${notificationId}`);
 }
-function generateClickToken(notificationId, linkIndex) {
-  return sign(`c:${notificationId}:${linkIndex}`);
+function generateClickToken(notificationId, linkIndex, url) {
+  return sign(`c:${notificationId}:${linkIndex}:${hashClickUrl(url)}`);
 }
 function verifyOpenToken(token) {
   const result = verify(token);
@@ -264,14 +269,15 @@ function verifyClickToken(token) {
   if (!result.valid || !result.payload) {
     return { valid: false };
   }
-  const match = result.payload.match(/^c:(\d+):(\d+)$/);
+  const match = result.payload.match(/^c:(\d+):(\d+)(?::([0-9a-f]{16}))?$/);
   if (!match) {
     return { valid: false };
   }
   return {
     valid: true,
     notificationId: Number(match[1]),
-    linkIndex: Number(match[2])
+    linkIndex: Number(match[2]),
+    urlHash: match[3]
   };
 }
 
@@ -296,7 +302,7 @@ function processTrackingHtml(html, options) {
         return match;
       }
       const currentIndex = linkIndex++;
-      const clickToken = generateClickToken(notificationId, currentIndex);
+      const clickToken = generateClickToken(notificationId, currentIndex, url);
       const trackingUrl = `${baseUrl}/_noti/t/c/${clickToken}?url=${encodeURIComponent(url)}`;
       trackedLinks.push({ index: currentIndex, url });
       return `<a ${before}href="${trackingUrl}"${after}>`;
@@ -381,10 +387,24 @@ function parseExpression(expr) {
     arg: filterPart.slice(colonIndex + 1)
   };
 }
+var BLOCKED_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+var HTML_ESCAPES = {
+  "&": "&amp;",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;"
+};
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (ch) => HTML_ESCAPES[ch]);
+}
 function getValue(data, path) {
   const parts = path.split(".");
   let value = data;
   for (const part of parts) {
+    if (BLOCKED_PATH_SEGMENTS.has(part)) {
+      return void 0;
+    }
     if (value === null || value === void 0) {
       return void 0;
     }
@@ -392,17 +412,19 @@ function getValue(data, path) {
   }
   return value;
 }
-function render(template, data) {
+function render(template, data, options = {}) {
+  const escape = options.escape ?? false;
   return template.replace(/\{\{([^}]+)\}\}/g, (match, expr) => {
     const { variable, filter, arg } = parseExpression(expr.trim());
-    let value = getValue(data, variable);
+    const value = getValue(data, variable);
     if (value === void 0) {
       return match;
     }
-    if (filter && filters[filter]) {
-      return filters[filter](value, arg);
+    if (filter === "raw") {
+      return String(value);
     }
-    return String(value);
+    const rendered = filter && filters[filter] ? filters[filter](value, arg) : String(value);
+    return escape ? escapeHtml(rendered) : rendered;
   });
 }
 function registerFilter(name, fn) {
@@ -444,7 +466,8 @@ function renderTemplate(name, data, channel) {
 function renderEmailTemplate(template, data) {
   return {
     subject: render(template.subject, data),
-    html: template.html ? render(template.html, data) : void 0,
+    // Escape interpolated values on the HTML path (caller data → markup injection).
+    html: template.html ? render(template.html, data, { escape: true }) : void 0,
     text: template.text ? render(template.text, data) : void 0
   };
 }
@@ -4919,14 +4942,27 @@ var trackClick = route.get("/_noti/t/c/:token").input({
   const { params, query } = await c.data();
   const targetUrl = query.url;
   const result = verifyClickToken(params.token);
-  if (result.valid && result.notificationId != null && result.linkIndex != null) {
-    recordClickEvent(result.notificationId, result.linkIndex, targetUrl, {
-      ipAddress: c.raw.req.header("x-forwarded-for") ?? c.raw.req.header("x-real-ip"),
-      userAgent: c.raw.req.header("user-agent")
-    });
-  } else {
+  if (!result.valid || result.notificationId == null || result.linkIndex == null) {
     log8.warn("Invalid click tracking token");
+    return new Response("Not found", { status: 404 });
+  }
+  let parsed;
+  try {
+    parsed = new URL(targetUrl);
+  } catch {
+    return new Response("Not found", { status: 404 });
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return new Response("Not found", { status: 404 });
   }
+  if (result.urlHash && hashClickUrl(targetUrl) !== result.urlHash) {
+    log8.warn("Click URL does not match signed token");
+    return new Response("Not found", { status: 404 });
+  }
+  recordClickEvent(result.notificationId, result.linkIndex, targetUrl, {
+    ipAddress: c.raw.req.header("x-forwarded-for") ?? c.raw.req.header("x-real-ip"),
+    userAgent: c.raw.req.header("user-agent")
+  });
   return new Response(null, {
     status: 302,
     headers: {