@tishlang/tish 2.12.0 → 2.16.13

package/crates/tish_runtime/src/http_fetch.rs

@@ -201,7 +201,7 @@ impl HttpBody {
         };
         Box::pin(async move {
             match resp {
-                Ok(r) => r.text().await.map_err(|e| e.to_string()),
+                Ok(r) => read_text_capped(r, fetch_max_body()).await,
                 Err(e) => Err(e),
             }
         })
@@ -373,12 +373,116 @@ fn fetch_client() -> &'static reqwest::Client {
     })
 }
 
+/// Maximum outbound-`fetch` response body we will buffer, in bytes. `reqwest::Response::text()`
+/// reads the whole body with no bound, so a compromised or hostile upstream (or a
+/// compression-amplified response) could OOM the worker (#383). Override with `TISH_FETCH_MAX_BODY`;
+/// default 100 MiB — generous enough for normal API responses and moderate downloads, low enough to
+/// stop a pathological body. Set it higher for legitimately large downloads.
+fn fetch_max_body() -> usize {
+    use std::sync::OnceLock;
+    static MAX: OnceLock<usize> = OnceLock::new();
+    *MAX.get_or_init(|| parse_max_body(std::env::var("TISH_FETCH_MAX_BODY").ok()))
+}
+
+/// Pure `TISH_FETCH_MAX_BODY` parse: a valid byte count, else the 100 MiB default. Split out so it is
+/// testable without touching process-global env / the `OnceLock` cache.
+fn parse_max_body(env: Option<String>) -> usize {
+    env.and_then(|v| v.parse().ok()).unwrap_or(100 * 1024 * 1024)
+}
+
+/// Read a response body to a `String`, streaming with a byte budget so it can never buffer more than
+/// `max` bytes (#383). Rejects early on a `Content-Length` that already exceeds the cap, and again mid
+/// stream for chunked/lying responses. Decodes UTF-8 lossily (matching `reqwest::text()` for the
+/// UTF-8 responses that dominate `fetch`).
+async fn read_text_capped(mut resp: reqwest::Response, max: usize) -> Result<String, String> {
+    if let Some(len) = resp.content_length() {
+        if len as usize > max {
+            return Err(format!(
+                "fetch: response body ({len} bytes, Content-Length) exceeds the {max}-byte cap (set TISH_FETCH_MAX_BODY to raise it)"
+            ));
+        }
+    }
+    let mut buf: Vec<u8> = Vec::new();
+    while let Some(chunk) = resp.chunk().await.map_err(|e| e.to_string())? {
+        if buf.len() + chunk.len() > max {
+            return Err(format!(
+                "fetch: response body exceeds the {max}-byte cap (set TISH_FETCH_MAX_BODY to raise it)"
+            ));
+        }
+        buf.extend_from_slice(&chunk);
+    }
+    Ok(String::from_utf8_lossy(&buf).into_owned())
+}
+
+/// Opt-in SSRF guard (#383): when `TISH_FETCH_BLOCK_PRIVATE_IPS=1`, `fetch()` refuses to connect to a
+/// loopback / private / link-local / unique-local address. Off by default so localhost development is
+/// unaffected; enable it when the request URL can derive from untrusted input (metadata-endpoint /
+/// internal-service pivots). NOTE: this is a pre-flight resolution check, so a DNS-rebinding attacker
+/// could in principle change the record between this check and reqwest's own resolution — a follow-up
+/// could move the filter into a custom `reqwest` resolver to close that window.
+fn fetch_block_private() -> bool {
+    use std::sync::OnceLock;
+    static ON: OnceLock<bool> = OnceLock::new();
+    *ON.get_or_init(|| std::env::var("TISH_FETCH_BLOCK_PRIVATE_IPS").as_deref() == Ok("1"))
+}
+
+/// True for addresses a hardened `fetch()` must not reach: loopback, RFC1918 private, link-local
+/// (incl. the `169.254.169.254` cloud-metadata endpoint), unspecified/broadcast, `0.0.0.0/8`, IPv6
+/// unique-local (`fc00::/7`) and link-local (`fe80::/10`), and IPv4-mapped forms of all the above.
+fn is_blocked_ip(ip: std::net::IpAddr) -> bool {
+    use std::net::IpAddr;
+    match ip {
+        IpAddr::V4(v4) => {
+            v4.is_loopback()
+                || v4.is_private()
+                || v4.is_link_local()
+                || v4.is_broadcast()
+                || v4.is_unspecified()
+                || v4.octets()[0] == 0 // 0.0.0.0/8 "this network"
+        }
+        IpAddr::V6(v6) => {
+            v6.is_loopback()
+                || v6.is_unspecified()
+                || (v6.segments()[0] & 0xfe00) == 0xfc00 // unique-local fc00::/7
+                || (v6.segments()[0] & 0xffc0) == 0xfe80 // link-local fe80::/10
+                || v6
+                    .to_ipv4_mapped()
+                    .is_some_and(|m| is_blocked_ip(IpAddr::V4(m)))
+        }
+    }
+}
+
+/// Reject the request if the URL's host resolves to a blocked address (only when the opt-in policy is
+/// enabled). `tokio::net::lookup_host` handles both literal IPs and hostnames.
+async fn ssrf_preflight(url: &str) -> Result<(), String> {
+    let parsed = reqwest::Url::parse(url).map_err(|e| format!("fetch: invalid URL: {e}"))?;
+    let host = parsed
+        .host_str()
+        .ok_or_else(|| "fetch: URL has no host".to_string())?;
+    let port = parsed.port_or_known_default().unwrap_or(80);
+    let addrs = tokio::net::lookup_host((host, port))
+        .await
+        .map_err(|e| format!("fetch: cannot resolve {host}: {e}"))?;
+    for addr in addrs {
+        if is_blocked_ip(addr.ip()) {
+            return Err(format!(
+                "fetch: blocked by SSRF policy — host {host} resolves to internal address {}",
+                addr.ip()
+            ));
+        }
+    }
+    Ok(())
+}
+
 async fn send_request_parts(
     url: String,
     method: String,
     headers: Vec<(String, String)>,
     body: Option<String>,
 ) -> Result<reqwest::Response, String> {
+    if fetch_block_private() {
+        ssrf_preflight(&url).await?;
+    }
     let client = fetch_client();
     let mut req = match method.as_str() {
         "GET" => client.get(&url),
@@ -490,3 +594,48 @@ pub fn fetch_all_promise_from_args(args: Vec<Value>) -> Value {
         rx: Mutex::new(Some(rx)),
     }))
 }
+
+#[cfg(test)]
+mod fetch_cap_tests_383 {
+    use super::{is_blocked_ip, parse_max_body};
+    use std::net::IpAddr;
+
+    #[test]
+    fn default_cap_is_100_mib() {
+        assert_eq!(parse_max_body(None), 100 * 1024 * 1024);
+        assert_eq!(parse_max_body(Some("not-a-number".into())), 100 * 1024 * 1024);
+    }
+
+    #[test]
+    fn env_override_parses() {
+        assert_eq!(parse_max_body(Some("1048576".into())), 1024 * 1024);
+        assert_eq!(parse_max_body(Some("0".into())), 0);
+    }
+
+    #[test]
+    fn ssrf_blocks_internal_addresses() {
+        for s in [
+            "127.0.0.1",         // loopback
+            "10.0.0.5",          // RFC1918
+            "172.16.9.9",        // RFC1918
+            "192.168.1.1",       // RFC1918
+            "169.254.169.254",   // link-local / cloud metadata
+            "0.0.0.0",           // unspecified
+            "::1",               // IPv6 loopback
+            "fc00::1",           // IPv6 unique-local
+            "fe80::1",           // IPv6 link-local
+            "::ffff:127.0.0.1",  // IPv4-mapped loopback
+        ] {
+            let ip: IpAddr = s.parse().unwrap();
+            assert!(is_blocked_ip(ip), "{s} must be blocked");
+        }
+    }
+
+    #[test]
+    fn ssrf_allows_public_addresses() {
+        for s in ["8.8.8.8", "1.1.1.1", "93.184.216.34", "2606:2800:220:1::"] {
+            let ip: IpAddr = s.parse().unwrap();
+            assert!(!is_blocked_ip(ip), "{s} must be allowed");
+        }
+    }
+}

package/crates/tish_runtime/src/http_prefork.rs

@@ -57,6 +57,8 @@
 use std::io;
 use std::process::{Child, Command};
 use std::sync::atomic::{AtomicBool, Ordering};
+#[cfg(unix)]
+use std::sync::atomic::{AtomicI32, AtomicUsize};
 use std::sync::Arc;
 
 /// Role of the current process in a prefork group.
@@ -142,28 +144,57 @@ pub fn install_parent_signal_handler(children: Vec<Child>) -> Arc<AtomicBool> {
     stop
 }
 
+/// Managed child PIDs, in a fixed atomic array (not a `Vec`/`OnceLock`): the signal handler may only
+/// do async-signal-safe work, so it reads plain atomics — never a lock or an allocation. Each
+/// `serve()` APPENDS its group here (#384), so a second `serve()` in the same parent no longer orphans
+/// its children on SIGINT/SIGTERM (the previous `OnceLock` silently dropped every group after the
+/// first). Ample for any realistic worker count; extra children beyond the cap simply aren't managed.
+#[cfg(unix)]
+const MAX_MANAGED_PIDS: usize = 4096;
+#[cfg(unix)]
+static CHILD_PIDS: [AtomicI32; MAX_MANAGED_PIDS] =
+    [const { AtomicI32::new(0) }; MAX_MANAGED_PIDS];
+#[cfg(unix)]
+static CHILD_PID_COUNT: AtomicUsize = AtomicUsize::new(0);
+
+/// Append a `serve()` group's child PIDs to the managed set. Stores land before the count is published
+/// (the SeqCst count store is the release), and the signal handler skips non-positive slots — so it
+/// never calls `kill(0, …)` (which would signal the whole process group). Installs are sequential (the
+/// parent's own thread), so no compare-exchange is needed.
+#[cfg(unix)]
+fn register_managed_pids(pids: &[u32]) {
+    let start = CHILD_PID_COUNT.load(Ordering::SeqCst);
+    for (i, pid) in pids.iter().enumerate() {
+        if let Some(slot) = CHILD_PIDS.get(start + i) {
+            slot.store(*pid as i32, Ordering::SeqCst);
+        }
+    }
+    CHILD_PID_COUNT.store((start + pids.len()).min(MAX_MANAGED_PIDS), Ordering::SeqCst);
+}
+
 #[cfg(unix)]
 fn install_shutdown_handler(stop: Arc<AtomicBool>, pids: Vec<u32>) {
-    // Store state in process-global statics so an `extern "C"` fn can reach
-    // them from inside a signal handler. This is the usual pattern for
-    // libc::signal callbacks — setting a flag + waking up listeners is the
-    // only async-signal-safe work we do here.
+    // A single process-global stop flag the handler sets. First `serve()` wins the slot; that is fine
+    // because the handler re-raises the signal with default disposition below, which terminates the
+    // parent regardless of which accept loop is polling — the flag only matters for the non-signal
+    // (max-requests) path, which each loop drives on its own returned `stop` handle.
     use std::sync::OnceLock;
     static STOP_FLAG: OnceLock<Arc<AtomicBool>> = OnceLock::new();
-    static CHILD_PIDS: OnceLock<Vec<u32>> = OnceLock::new();
-
     let _ = STOP_FLAG.set(stop);
-    let _ = CHILD_PIDS.set(pids);
+
+    register_managed_pids(&pids);
 
     extern "C" fn on_signal(sig: libc::c_int) {
         if let Some(flag) = STOP_FLAG.get() {
             flag.store(true, Ordering::Relaxed);
         }
-        if let Some(pids) = CHILD_PIDS.get() {
-            for pid in pids {
+        let count = CHILD_PID_COUNT.load(Ordering::SeqCst).min(MAX_MANAGED_PIDS);
+        for slot in CHILD_PIDS.iter().take(count) {
+            let pid = slot.load(Ordering::SeqCst);
+            if pid > 0 {
                 // codacy-disable-next-line
-        unsafe {
-                    libc::kill(*pid as libc::pid_t, libc::SIGTERM);
+                unsafe {
+                    libc::kill(pid as libc::pid_t, libc::SIGTERM);
                 }
             }
         }
@@ -187,3 +218,33 @@ fn install_shutdown_handler(stop: Arc<AtomicBool>, pids: Vec<u32>) {
 fn install_shutdown_handler(_stop: Arc<AtomicBool>, _pids: Vec<u32>) {
     // TODO: SetConsoleCtrlHandler on Windows.
 }
+
+#[cfg(all(test, unix))]
+mod prefork_pid_tests_384 {
+    use super::*;
+
+    /// Read the managed PID set the way the signal handler does (skipping empty slots).
+    fn managed_snapshot() -> Vec<i32> {
+        let count = CHILD_PID_COUNT.load(Ordering::SeqCst).min(MAX_MANAGED_PIDS);
+        CHILD_PIDS
+            .iter()
+            .take(count)
+            .map(|s| s.load(Ordering::SeqCst))
+            .filter(|&p| p > 0)
+            .collect()
+    }
+
+    #[test]
+    fn repeat_serve_appends_child_pids() {
+        // Reset the process-global set (this is the only test that touches it).
+        CHILD_PID_COUNT.store(0, Ordering::SeqCst);
+        for s in CHILD_PIDS.iter() {
+            s.store(0, Ordering::SeqCst);
+        }
+        // First serve() group, then a SECOND — the old OnceLock silently dropped the second, orphaning
+        // its children on shutdown. Now both groups are managed.
+        register_managed_pids(&[101, 102]);
+        register_managed_pids(&[201, 202, 203]);
+        assert_eq!(managed_snapshot(), vec![101, 102, 201, 202, 203]);
+    }
+}