@tschk/moonshine-deploy-node 0.3.2 → 0.3.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tschk/moonshine-deploy-node",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "license": "ISC",
   "type": "module",
   "main": "./src/index.ts",
@@ -15,11 +15,11 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@tschk/moonshine-adapter-conformance": "^0.3.2",
-    "@tschk/moonshine-compiler": "^0.3.2",
-    "@tschk/moonshine-framework": "^0.3.2",
-    "@tschk/moonshine-react": "^0.3.2",
-    "@tschk/moonshine-server": "^0.3.2"
+    "@tschk/moonshine-adapter-conformance": "^0.3.4",
+    "@tschk/moonshine-compiler": "^0.3.4",
+    "@tschk/moonshine-framework": "^0.3.4",
+    "@tschk/moonshine-react": "^0.3.4",
+    "@tschk/moonshine-server": "^0.3.4"
   },
   "devDependencies": {
     "@types/bun": "1.3.14",

package/src/index.ts

@@ -11,7 +11,7 @@ import {
   type DeploymentAdapter,
   type MoonshineManifest,
 } from "@tschk/moonshine-framework";
-import { resolveStaticPath } from "@tschk/moonshine-server";
+import { isContained, resolveStaticPath } from "@tschk/moonshine-server";
 import {
   type Harness,
   type HarnessFactory,
@@ -71,12 +71,18 @@ async function tryServeNodeStatic(
     return null;
   }
   if (!stats.isFile()) return null;
+  try {
+    if (!isContained(staticDir, filePath)) return null;
+  } catch {
+    return null;
+  }
   const type = MIME[extOf(filePath)] ?? "application/octet-stream";
   const stream = createReadStream(filePath);
   return new Response(Readable.toWeb(stream) as unknown as ReadableStream, {
     headers: {
       "content-type": type,
       "content-length": String(stats.size),
+      "x-content-type-options": "nosniff",
     },
   });
 }
@@ -104,6 +110,18 @@ async function sendNodeResponse(
   stream.pipe(res);
 }
 
+const HOST_PATTERN = /^(?:[a-zA-Z0-9._-]+|\[[0-9a-fA-F:.]+\])(?::\d{1,5})?$/;
+
+/**
+ * Node hands the Host header through unvalidated, so a client-supplied value
+ * can smuggle userinfo, a path, or a query into the base URL and change the
+ * origin every downstream URL comparison is made against.
+ */
+function safeHost(host: string | undefined): string {
+  if (!host) return "localhost";
+  return HOST_PATTERN.test(host) ? host : "localhost";
+}
+
 export type NodeHandlerOptions = {
   fetch: (request: Request) => Promise<Response>;
   staticDir?: string;
@@ -115,7 +133,7 @@ export function createNodeHandler(
   return async (req, res) => {
     const method = req.method ?? "GET";
     const reqUrl = req.url ?? "/";
-    const host = req.headers.host ?? "localhost";
+    const host = safeHost(req.headers.host);
     const requestUrl = new URL(reqUrl, `http://${host}`);
     const pathname = requestUrl.pathname;