@tishlang/tish-lint 2.12.0 → 2.35.0

package/crates/tish_runtime/src/http_fetch.rs

@@ -201,7 +201,7 @@ impl HttpBody {
         };
         Box::pin(async move {
             match resp {
-                Ok(r) => r.text().await.map_err(|e| e.to_string()),
+                Ok(r) => read_text_capped(r, fetch_max_body()).await,
                 Err(e) => Err(e),
             }
         })
@@ -373,12 +373,116 @@ fn fetch_client() -> &'static reqwest::Client {
     })
 }
 
+/// Maximum outbound-`fetch` response body we will buffer, in bytes. `reqwest::Response::text()`
+/// reads the whole body with no bound, so a compromised or hostile upstream (or a
+/// compression-amplified response) could OOM the worker (#383). Override with `TISH_FETCH_MAX_BODY`;
+/// default 100 MiB — generous enough for normal API responses and moderate downloads, low enough to
+/// stop a pathological body. Set it higher for legitimately large downloads.
+fn fetch_max_body() -> usize {
+    use std::sync::OnceLock;
+    static MAX: OnceLock<usize> = OnceLock::new();
+    *MAX.get_or_init(|| parse_max_body(std::env::var("TISH_FETCH_MAX_BODY").ok()))
+}
+
+/// Pure `TISH_FETCH_MAX_BODY` parse: a valid byte count, else the 100 MiB default. Split out so it is
+/// testable without touching process-global env / the `OnceLock` cache.
+fn parse_max_body(env: Option<String>) -> usize {
+    env.and_then(|v| v.parse().ok()).unwrap_or(100 * 1024 * 1024)
+}
+
+/// Read a response body to a `String`, streaming with a byte budget so it can never buffer more than
+/// `max` bytes (#383). Rejects early on a `Content-Length` that already exceeds the cap, and again mid
+/// stream for chunked/lying responses. Decodes UTF-8 lossily (matching `reqwest::text()` for the
+/// UTF-8 responses that dominate `fetch`).
+async fn read_text_capped(mut resp: reqwest::Response, max: usize) -> Result<String, String> {
+    if let Some(len) = resp.content_length() {
+        if len as usize > max {
+            return Err(format!(
+                "fetch: response body ({len} bytes, Content-Length) exceeds the {max}-byte cap (set TISH_FETCH_MAX_BODY to raise it)"
+            ));
+        }
+    }
+    let mut buf: Vec<u8> = Vec::new();
+    while let Some(chunk) = resp.chunk().await.map_err(|e| e.to_string())? {
+        if buf.len() + chunk.len() > max {
+            return Err(format!(
+                "fetch: response body exceeds the {max}-byte cap (set TISH_FETCH_MAX_BODY to raise it)"
+            ));
+        }
+        buf.extend_from_slice(&chunk);
+    }
+    Ok(String::from_utf8_lossy(&buf).into_owned())
+}
+
+/// Opt-in SSRF guard (#383): when `TISH_FETCH_BLOCK_PRIVATE_IPS=1`, `fetch()` refuses to connect to a
+/// loopback / private / link-local / unique-local address. Off by default so localhost development is
+/// unaffected; enable it when the request URL can derive from untrusted input (metadata-endpoint /
+/// internal-service pivots). NOTE: this is a pre-flight resolution check, so a DNS-rebinding attacker
+/// could in principle change the record between this check and reqwest's own resolution — a follow-up
+/// could move the filter into a custom `reqwest` resolver to close that window.
+fn fetch_block_private() -> bool {
+    use std::sync::OnceLock;
+    static ON: OnceLock<bool> = OnceLock::new();
+    *ON.get_or_init(|| std::env::var("TISH_FETCH_BLOCK_PRIVATE_IPS").as_deref() == Ok("1"))
+}
+
+/// True for addresses a hardened `fetch()` must not reach: loopback, RFC1918 private, link-local
+/// (incl. the `169.254.169.254` cloud-metadata endpoint), unspecified/broadcast, `0.0.0.0/8`, IPv6
+/// unique-local (`fc00::/7`) and link-local (`fe80::/10`), and IPv4-mapped forms of all the above.
+fn is_blocked_ip(ip: std::net::IpAddr) -> bool {
+    use std::net::IpAddr;
+    match ip {
+        IpAddr::V4(v4) => {
+            v4.is_loopback()
+                || v4.is_private()
+                || v4.is_link_local()
+                || v4.is_broadcast()
+                || v4.is_unspecified()
+                || v4.octets()[0] == 0 // 0.0.0.0/8 "this network"
+        }
+        IpAddr::V6(v6) => {
+            v6.is_loopback()
+                || v6.is_unspecified()
+                || (v6.segments()[0] & 0xfe00) == 0xfc00 // unique-local fc00::/7
+                || (v6.segments()[0] & 0xffc0) == 0xfe80 // link-local fe80::/10
+                || v6
+                    .to_ipv4_mapped()
+                    .is_some_and(|m| is_blocked_ip(IpAddr::V4(m)))
+        }
+    }
+}
+
+/// Reject the request if the URL's host resolves to a blocked address (only when the opt-in policy is
+/// enabled). `tokio::net::lookup_host` handles both literal IPs and hostnames.
+async fn ssrf_preflight(url: &str) -> Result<(), String> {
+    let parsed = reqwest::Url::parse(url).map_err(|e| format!("fetch: invalid URL: {e}"))?;
+    let host = parsed
+        .host_str()
+        .ok_or_else(|| "fetch: URL has no host".to_string())?;
+    let port = parsed.port_or_known_default().unwrap_or(80);
+    let addrs = tokio::net::lookup_host((host, port))
+        .await
+        .map_err(|e| format!("fetch: cannot resolve {host}: {e}"))?;
+    for addr in addrs {
+        if is_blocked_ip(addr.ip()) {
+            return Err(format!(
+                "fetch: blocked by SSRF policy — host {host} resolves to internal address {}",
+                addr.ip()
+            ));
+        }
+    }
+    Ok(())
+}
+
 async fn send_request_parts(
     url: String,
     method: String,
     headers: Vec<(String, String)>,
     body: Option<String>,
 ) -> Result<reqwest::Response, String> {
+    if fetch_block_private() {
+        ssrf_preflight(&url).await?;
+    }
     let client = fetch_client();
     let mut req = match method.as_str() {
         "GET" => client.get(&url),
@@ -490,3 +594,48 @@ pub fn fetch_all_promise_from_args(args: Vec<Value>) -> Value {
         rx: Mutex::new(Some(rx)),
     }))
 }
+
+#[cfg(test)]
+mod fetch_cap_tests_383 {
+    use super::{is_blocked_ip, parse_max_body};
+    use std::net::IpAddr;
+
+    #[test]
+    fn default_cap_is_100_mib() {
+        assert_eq!(parse_max_body(None), 100 * 1024 * 1024);
+        assert_eq!(parse_max_body(Some("not-a-number".into())), 100 * 1024 * 1024);
+    }
+
+    #[test]
+    fn env_override_parses() {
+        assert_eq!(parse_max_body(Some("1048576".into())), 1024 * 1024);
+        assert_eq!(parse_max_body(Some("0".into())), 0);
+    }
+
+    #[test]
+    fn ssrf_blocks_internal_addresses() {
+        for s in [
+            "127.0.0.1",         // loopback
+            "10.0.0.5",          // RFC1918
+            "172.16.9.9",        // RFC1918
+            "192.168.1.1",       // RFC1918
+            "169.254.169.254",   // link-local / cloud metadata
+            "0.0.0.0",           // unspecified
+            "::1",               // IPv6 loopback
+            "fc00::1",           // IPv6 unique-local
+            "fe80::1",           // IPv6 link-local
+            "::ffff:127.0.0.1",  // IPv4-mapped loopback
+        ] {
+            let ip: IpAddr = s.parse().unwrap();
+            assert!(is_blocked_ip(ip), "{s} must be blocked");
+        }
+    }
+
+    #[test]
+    fn ssrf_allows_public_addresses() {
+        for s in ["8.8.8.8", "1.1.1.1", "93.184.216.34", "2606:2800:220:1::"] {
+            let ip: IpAddr = s.parse().unwrap();
+            assert!(!is_blocked_ip(ip), "{s} must be allowed");
+        }
+    }
+}

package/crates/tish_runtime/src/http_hyper.rs

@@ -10,7 +10,7 @@
 //!   N OS threads (one per CPU, pinned via core_affinity)
 //!    ├─ single-threaded tokio runtime per thread
 //!    ├─ SO_REUSEPORT-bound TcpListener per thread
-//!    └─ hyper HTTP/1.1 + HTTP/2 server
+//!    └─ hyper HTTP/1.1 server (`http1::Builder`)
 //!          │
 //!          ├─ async per-connection state machine (no OS thread)
 //!          ├─ static-route fast path (lock-free ArcSwap<HashMap> from
@@ -23,13 +23,17 @@
 //!
 //! * Removes tiny_http's thread-per-connection model (the bottleneck on
 //!   every macOS/Linux Tish HTTP server at >50k concurrent connections).
-//! * Gives HTTP/2 + TLS-ready surface for free (hyper handles the state
-//!   machine; we only have to convert our `RequestPrimitive` to/from
-//!   `http::Request` / `http::Response`).
 //! * Shared async context with `reqwest`, `tokio-postgres`, `tokio` in
 //!   general — the tokio runtime is reused for client fetch, db, and
 //!   server accept.
 //!
+//! ## Protocol support
+//!
+//! HTTP/1.1 only today (the accept loop uses `http1::Builder`). The `hyper` dependency enables the
+//! `http2` feature, so upgrading to an `hyper_util::server::conn::auto` builder (h2c prior-knowledge,
+//! and HTTP/2 over TLS once ALPN is wired) is a contained follow-up — tracked separately. Do NOT
+//! advertise HTTP/2 until that lands.
+//!
 //! ## Integration with the Tish VM
 //!
 //! The Tish handler returns a synchronous `Value`. We call it from inside
@@ -182,20 +186,37 @@ where
     }
     drop(tx);
 
-    // VM-thread dispatcher loop: identical to the tiny_http path.
+    // VM-thread dispatcher loop. Mirrors the tiny_http path (#384): `recv_timeout` rather than a
+    // blocking `recv` so a handler's scheduled timers still FIRE when the server is idle, and
+    // `drain_timers()` runs after every handler call AND on each idle tick. Handler calls all run on
+    // this single VM thread, so the timer registry lives here — without the drain a `setTimeout`
+    // scheduled from a hyper handler would never fire and never be freed.
     let mut count = 0usize;
-    while let Ok((req_prim, resp_tx)) = rx.recv() {
-        let req_value = req_prim.into_value_pub();
-        // `handler` is the generic `F: Fn(&[Value]) -> Value` — call it directly. (`.call(..)` here
-        // would bind the *unstable* `Fn::call` trait method, which takes a tuple, not `&[Value]`.)
-        let response_value = handler(&[req_value]);
-        let resp_prim = ResponsePrimitive::from_value_pub(&response_value);
-        let _ = resp_tx.send(resp_prim);
-
-        count += 1;
-        if max_requests.map(|m| count >= m).unwrap_or(false) {
-            stop.store(true, Ordering::Relaxed);
-            break;
+    loop {
+        match rx.recv_timeout(std::time::Duration::from_millis(250)) {
+            Ok((req_prim, resp_tx)) => {
+                let req_value = req_prim.into_value_pub();
+                // `handler` is the generic `F: Fn(&[Value]) -> Value` — call it directly. (`.call(..)`
+                // here would bind the *unstable* `Fn::call` trait method, which takes a tuple, not
+                // `&[Value]`.)
+                let response_value = handler(&[req_value]);
+                crate::timers::drain_timers();
+                let resp_prim = ResponsePrimitive::from_value_pub(&response_value);
+                let _ = resp_tx.send(resp_prim);
+
+                count += 1;
+                if max_requests.map(|m| count >= m).unwrap_or(false) {
+                    stop.store(true, Ordering::Relaxed);
+                    break;
+                }
+            }
+            Err(std_mpsc::RecvTimeoutError::Timeout) => {
+                crate::timers::drain_timers();
+                if stop.load(Ordering::Relaxed) {
+                    break;
+                }
+            }
+            Err(std_mpsc::RecvTimeoutError::Disconnected) => break,
         }
     }
 
@@ -295,7 +316,9 @@ async fn handle_request(
 
     // Slow path: cross the mpsc to the VM thread.
     let (method, url, path, query, headers, body_bytes) = extract_request(req).await;
-    let body = String::from_utf8(body_bytes).unwrap_or_default();
+    // Lossy UTF-8 decode to match the tiny_http path (`http.rs`): a body with invalid UTF-8 becomes
+    // replacement chars, NOT an empty string — `req.body` is a String and both backends must agree.
+    let body = String::from_utf8_lossy(&body_bytes).into_owned();
     let prim = RequestPrimitive::new_pub(method, url, path, query, headers, body);
 
     let (resp_tx, resp_rx) = std_mpsc::sync_channel::<ResponsePrimitive>(1);

package/crates/tish_runtime/src/http_prefork.rs

@@ -57,6 +57,8 @@
 use std::io;
 use std::process::{Child, Command};
 use std::sync::atomic::{AtomicBool, Ordering};
+#[cfg(unix)]
+use std::sync::atomic::{AtomicI32, AtomicUsize};
 use std::sync::Arc;
 
 /// Role of the current process in a prefork group.
@@ -142,28 +144,57 @@ pub fn install_parent_signal_handler(children: Vec<Child>) -> Arc<AtomicBool> {
     stop
 }
 
+/// Managed child PIDs, in a fixed atomic array (not a `Vec`/`OnceLock`): the signal handler may only
+/// do async-signal-safe work, so it reads plain atomics — never a lock or an allocation. Each
+/// `serve()` APPENDS its group here (#384), so a second `serve()` in the same parent no longer orphans
+/// its children on SIGINT/SIGTERM (the previous `OnceLock` silently dropped every group after the
+/// first). Ample for any realistic worker count; extra children beyond the cap simply aren't managed.
+#[cfg(unix)]
+const MAX_MANAGED_PIDS: usize = 4096;
+#[cfg(unix)]
+static CHILD_PIDS: [AtomicI32; MAX_MANAGED_PIDS] =
+    [const { AtomicI32::new(0) }; MAX_MANAGED_PIDS];
+#[cfg(unix)]
+static CHILD_PID_COUNT: AtomicUsize = AtomicUsize::new(0);
+
+/// Append a `serve()` group's child PIDs to the managed set. Stores land before the count is published
+/// (the SeqCst count store is the release), and the signal handler skips non-positive slots — so it
+/// never calls `kill(0, …)` (which would signal the whole process group). Installs are sequential (the
+/// parent's own thread), so no compare-exchange is needed.
+#[cfg(unix)]
+fn register_managed_pids(pids: &[u32]) {
+    let start = CHILD_PID_COUNT.load(Ordering::SeqCst);
+    for (i, pid) in pids.iter().enumerate() {
+        if let Some(slot) = CHILD_PIDS.get(start + i) {
+            slot.store(*pid as i32, Ordering::SeqCst);
+        }
+    }
+    CHILD_PID_COUNT.store((start + pids.len()).min(MAX_MANAGED_PIDS), Ordering::SeqCst);
+}
+
 #[cfg(unix)]
 fn install_shutdown_handler(stop: Arc<AtomicBool>, pids: Vec<u32>) {
-    // Store state in process-global statics so an `extern "C"` fn can reach
-    // them from inside a signal handler. This is the usual pattern for
-    // libc::signal callbacks — setting a flag + waking up listeners is the
-    // only async-signal-safe work we do here.
+    // A single process-global stop flag the handler sets. First `serve()` wins the slot; that is fine
+    // because the handler re-raises the signal with default disposition below, which terminates the
+    // parent regardless of which accept loop is polling — the flag only matters for the non-signal
+    // (max-requests) path, which each loop drives on its own returned `stop` handle.
     use std::sync::OnceLock;
     static STOP_FLAG: OnceLock<Arc<AtomicBool>> = OnceLock::new();
-    static CHILD_PIDS: OnceLock<Vec<u32>> = OnceLock::new();
-
     let _ = STOP_FLAG.set(stop);
-    let _ = CHILD_PIDS.set(pids);
+
+    register_managed_pids(&pids);
 
     extern "C" fn on_signal(sig: libc::c_int) {
         if let Some(flag) = STOP_FLAG.get() {
             flag.store(true, Ordering::Relaxed);
         }
-        if let Some(pids) = CHILD_PIDS.get() {
-            for pid in pids {
+        let count = CHILD_PID_COUNT.load(Ordering::SeqCst).min(MAX_MANAGED_PIDS);
+        for slot in CHILD_PIDS.iter().take(count) {
+            let pid = slot.load(Ordering::SeqCst);
+            if pid > 0 {
                 // codacy-disable-next-line
-        unsafe {
-                    libc::kill(*pid as libc::pid_t, libc::SIGTERM);
+                unsafe {
+                    libc::kill(pid as libc::pid_t, libc::SIGTERM);
                 }
             }
         }
@@ -187,3 +218,33 @@ fn install_shutdown_handler(stop: Arc<AtomicBool>, pids: Vec<u32>) {
 fn install_shutdown_handler(_stop: Arc<AtomicBool>, _pids: Vec<u32>) {
     // TODO: SetConsoleCtrlHandler on Windows.
 }
+
+#[cfg(all(test, unix))]
+mod prefork_pid_tests_384 {
+    use super::*;
+
+    /// Read the managed PID set the way the signal handler does (skipping empty slots).
+    fn managed_snapshot() -> Vec<i32> {
+        let count = CHILD_PID_COUNT.load(Ordering::SeqCst).min(MAX_MANAGED_PIDS);
+        CHILD_PIDS
+            .iter()
+            .take(count)
+            .map(|s| s.load(Ordering::SeqCst))
+            .filter(|&p| p > 0)
+            .collect()
+    }
+
+    #[test]
+    fn repeat_serve_appends_child_pids() {
+        // Reset the process-global set (this is the only test that touches it).
+        CHILD_PID_COUNT.store(0, Ordering::SeqCst);
+        for s in CHILD_PIDS.iter() {
+            s.store(0, Ordering::SeqCst);
+        }
+        // First serve() group, then a SECOND — the old OnceLock silently dropped the second, orphaning
+        // its children on shutdown. Now both groups are managed.
+        register_managed_pids(&[101, 102]);
+        register_managed_pids(&[201, 202, 203]);
+        assert_eq!(managed_snapshot(), vec![101, 102, 201, 202, 203]);
+    }
+}