@summerscar/dsh-mnemon-sync 0.1.8 → 0.1.10

package/index.js

@@ -123,7 +123,6 @@ export function archiveKey(at = new Date(), device = 'device') {
   const stamp = at.toISOString().replace(/:/gu, '-')
   return `${ARCHIVE_PREFIX}${device}-${stamp}.zip`
 }
-
 export function apply(ctx, config = {}) {
   const dataRoot = resolveDataRoot(config)
   // `<home>/data` → `<home>`: settings and work files sit beside the store.
@@ -487,14 +486,21 @@ export function apply(ctx, config = {}) {
       }))
     const restorable = requested.filter((component) => present.includes(component))
 
-    // Plan first, so a dry run and a real run describe the same work.
+    // Plan first, so a dry run and a real run describe the same work. Entries
+    // whose path does not resolve into a component directory (a foreign file
+    // smuggled into the archive) are rejected outright rather than skipped:
+    // a listing that silently drops entries would hide what a restore does.
     const plan = []
     for (const component of restorable) {
       for (const [relative, content] of files.entries()) {
         if (relative === 'manifest.json') continue
         const director = componentDirectoryOf(relative)
         if (director !== component) continue
-        plan.push({ component, relative, destination: destinationFor(home, relative), bytes: content.length })
+        const destination = destinationFor(home, relative)
+        if (destination === undefined) {
+          throw new Error(`archive entry cannot be restored safely: ${relative}`)
+        }
+        plan.push({ component, relative, destination, bytes: content.length })
       }
     }
 
@@ -594,20 +600,44 @@ function componentDirectoryOf(relative) {
 }
 
 /**
- * Where one archive path lands in the Mnemon home.
+ * Archive payload directories that a restore may write, mapped to the live
+ * directories they land in. `state/` is deliberately absent: it holds this
+ * plugin's credentials and dsh-mnemon's machine identity, and no backup
+ * component backs it up.
+ */
+const RESTORE_DIRECTORIES = {
+  data: 'data',
+  documents: 'documents',
+  runtime: 'runtime',
+}
+
+/**
+ * Where one archive path lands in the Mnemon home, or `undefined` when the
+ * path is not part of a restorable component.
  *
- * `payload/` is dropped and the component directories are the same names the
- * store itself uses, so a restored tree is byte-identical in layout to a live
- * one. The path is resolved and checked so a malformed archive cannot walk out
- * of the home directory.
+ * The check is deliberately stricter than "stays inside the home": a restore
+ * must only ever touch the three component directories (`data/`, `documents/`,
+ * `runtime/`). Everything else in the home — `state/` with this plugin's own
+ * credentials and dsh-mnemon's machine identity, `skills/`, the archive
+ * workroot — must be unreachable from an archive, because the archive is
+ * untrusted data. A zip entry like `payload/data/../state/mnemon-sync.json`
+ * resolves inside the home yet would overwrite the stored credentials, so the
+ * first path segment after `payload/` is matched exactly against the three
+ * component names and no `..` or nested separator survives.
  */
 function destinationFor(home, relative) {
-  const stripped = relative.replace(/^payload\//u, '')
-  const destination = resolve(home, stripped)
-  const root = resolve(home)
-  if (destination !== root && !destination.startsWith(`${root}/`)) {
-    throw new Error(`archive entry escapes the Mnemon home: ${relative}`)
-  }
+  if (!relative.startsWith('payload/')) return undefined
+  const stripped = relative.slice('payload/'.length)
+  const separator = stripped.indexOf('/')
+  if (separator <= 0) return undefined
+  const topDirectory = stripped.slice(0, separator)
+  const componentDirectory = RESTORE_DIRECTORIES[topDirectory]
+  if (componentDirectory === undefined) return undefined
+  const rest = stripped.slice(separator + 1)
+  if (rest === '' || rest.includes('\0') || rest.split('/').includes('..')) return undefined
+  const destination = resolve(home, componentDirectory, ...rest.split('/'))
+  const root = resolve(home, componentDirectory)
+  if (!destination.startsWith(`${root}/`)) return undefined
   return destination
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@summerscar/dsh-mnemon-sync",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Back up and restore dsh-mnemon memory components (memory spaces, project documents, runtime memory) to S3-compatible storage or WebDAV.",
   "type": "module",
   "main": "index.js",

package/targets.js

@@ -467,7 +467,10 @@ function encodeRfc3986(value) {
  * misconfigured, and paging the whole bucket would cost more than it explains.
  */
 async function listS3(target, signal) {
-  const url = new URL(s3Url(target, ''))
+  // ListObjectsV2 operates on the bucket: the path is the bucket alone and
+  // the prefix carries the folder. s3Url(target, '') would put remotePath in
+  // the path, and the store then answers 404 NoSuchKey for the missing object.
+  const url = new URL(s3Endpoint(target))
   url.searchParams.set('list-type', '2')
   url.searchParams.set('prefix', `${target.remotePath}/`)
   const { response } = await signedS3UrlRequest(target, 'GET', url, signal)
@@ -519,7 +522,13 @@ async function signedS3UrlRequest(target, method, url, signal) {
   const stringToSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256Hex(canonicalRequest)].join('\n')
   const signingKey = signatureKey(target.secretAccessKey, dateStamp, target.region)
   const signature = createHmac('sha256', signingKey).update(stringToSign).digest('hex')
-  const response = await fetch(url, {
+  // The signature covers the canonical (RFC 3986) query, but URLSearchParams
+  // re-encodes spaces as `+` when the URL stringifies, which would not match
+  // what was signed. Serialize the query for the wire with the same encoding.
+  const wireQuery = [...url.searchParams.entries()]
+    .map(([name, value]) => `${encodeRfc3986(name)}=${encodeRfc3986(value)}`)
+    .join('&')
+  const response = await fetch(`${url.origin}${url.pathname}?${wireQuery}`, {
     method,
     headers: {
       ...headers,