@vantran-se/openchamber-web 1.23.0 → 1.24.3

package/server/lib/guests/extract-zip.js

@@ -0,0 +1,136 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { inflateRawSync } from 'node:zlib';
+
+const LOCAL_FILE = 0x04034b50;
+const CENTRAL_DIR = 0x02014b50;
+const MAX_FILES = 500;
+const MAX_UNCOMPRESSED = 40 * 1024 * 1024;
+const COMPRESSION_STORE = 0;
+const COMPRESSION_DEFLATE = 8;
+
+const readU16 = (buffer, offset) => buffer.readUInt16LE(offset);
+const readU32 = (buffer, offset) => buffer.readUInt32LE(offset);
+
+const isSafeZipName = (name) => {
+  if (!name || name.includes('\0') || name.includes('\\')) {
+    return false;
+  }
+  if (name.startsWith('/') || name.startsWith('./')) {
+    return false;
+  }
+  const segments = name.split('/');
+  return !segments.some((segment) => segment === '..');
+};
+
+/** Extract a zip buffer into dest. Rejects traversal, zip64, encryption, and data descriptors. */
+export const extractZipBuffer = async (buffer, destRoot) => {
+  if (!Buffer.isBuffer(buffer) || buffer.length < 22) {
+    return { ok: false, code: 'extract-failed' };
+  }
+  await fs.mkdir(destRoot, { recursive: true });
+  const destReal = await fs.realpath(destRoot);
+  let offset = 0;
+  let files = 0;
+  let uncompressedTotal = 0;
+
+  while (offset + 4 <= buffer.length) {
+    const signature = readU32(buffer, offset);
+    if (signature === CENTRAL_DIR) {
+      return { ok: true };
+    }
+    if (signature !== LOCAL_FILE) {
+      return { ok: false, code: 'extract-failed' };
+    }
+    if (offset + 30 > buffer.length) {
+      return { ok: false, code: 'extract-failed' };
+    }
+    const flags = readU16(buffer, offset + 6);
+    const method = readU16(buffer, offset + 8);
+    const compressedSize = readU32(buffer, offset + 18);
+    const uncompressedSize = readU32(buffer, offset + 22);
+    const nameLen = readU16(buffer, offset + 26);
+    const extraLen = readU16(buffer, offset + 28);
+    if ((flags & 0x0001) !== 0 || (flags & 0x0008) !== 0) {
+      return { ok: false, code: 'extract-failed' };
+    }
+    if (method !== COMPRESSION_STORE && method !== COMPRESSION_DEFLATE) {
+      return { ok: false, code: 'extract-failed' };
+    }
+    if (compressedSize === 0xffffffff || uncompressedSize === 0xffffffff) {
+      return { ok: false, code: 'extract-failed' };
+    }
+    const nameStart = offset + 30;
+    const nameEnd = nameStart + nameLen;
+    const dataStart = nameEnd + extraLen;
+    const dataEnd = dataStart + compressedSize;
+    if (dataEnd > buffer.length) {
+      return { ok: false, code: 'extract-failed' };
+    }
+    const name = buffer.subarray(nameStart, nameEnd).toString('utf8');
+    offset = dataEnd;
+    if (name.endsWith('/')) {
+      continue;
+    }
+    if (!isSafeZipName(name)) {
+      return { ok: false, code: 'extract-failed' };
+    }
+    files += 1;
+    uncompressedTotal += uncompressedSize;
+    if (files > MAX_FILES || uncompressedTotal > MAX_UNCOMPRESSED) {
+      return { ok: false, code: 'extract-failed' };
+    }
+    let data;
+    try {
+      const payload = buffer.subarray(dataStart, dataEnd);
+      // The declared size is already within the archive budget; capping the
+      // inflate at that size keeps a tiny deflate stream from expanding into
+      // gigabytes before the length check below can reject it.
+      data = method === COMPRESSION_STORE
+        ? payload
+        : inflateRawSync(payload, { maxOutputLength: Math.max(1, uncompressedSize) });
+    } catch {
+      return { ok: false, code: 'extract-failed' };
+    }
+    if (data.length !== uncompressedSize) {
+      return { ok: false, code: 'extract-failed' };
+    }
+    const target = path.resolve(destReal, ...name.split('/'));
+    if (target !== destReal && !target.startsWith(destReal + path.sep)) {
+      return { ok: false, code: 'extract-failed' };
+    }
+    await fs.mkdir(path.dirname(target), { recursive: true });
+    await fs.writeFile(target, data);
+  }
+  return { ok: false, code: 'extract-failed' };
+};
+
+const exists = async (filePath) => {
+  try {
+    await fs.stat(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+/** If the extract has one root folder and package.json is inside it, use that folder. */
+export const unwrapGuestRoot = async (extracted) => {
+  if (await exists(path.join(extracted, 'package.json'))) {
+    return extracted;
+  }
+  const names = await fs.readdir(extracted);
+  if (names.length !== 1) {
+    return extracted;
+  }
+  const inner = path.join(extracted, names[0]);
+  try {
+    const stat = await fs.stat(inner);
+    if (stat.isDirectory() && await exists(path.join(inner, 'package.json'))) {
+      return inner;
+    }
+  } catch {
+    return extracted;
+  }
+  return extracted;
+};

package/server/lib/guests/extract-zip.test.js

@@ -0,0 +1,109 @@
+import { describe, expect, test } from 'bun:test';
+import { crc32 } from 'node:zlib';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { extractZipBuffer, unwrapGuestRoot } from './extract-zip.js';
+
+const u16 = (value) => {
+  const buffer = Buffer.alloc(2);
+  buffer.writeUInt16LE(value);
+  return buffer;
+};
+
+const u32 = (value) => {
+  const buffer = Buffer.alloc(4);
+  buffer.writeUInt32LE(value);
+  return buffer;
+};
+
+/** Store-only zip. Used by install tests too. */
+export const buildStoreZip = (files) => {
+  const locals = [];
+  const centrals = [];
+  let offset = 0;
+  for (const file of files) {
+    const name = Buffer.from(file.name, 'utf8');
+    const data = Buffer.isBuffer(file.data) ? file.data : Buffer.from(file.data);
+    const crc = crc32(data);
+    const local = Buffer.concat([
+      u32(0x04034b50),
+      u16(20),
+      u16(0),
+      u16(0),
+      u16(0),
+      u16(0),
+      u32(crc),
+      u32(data.length),
+      u32(data.length),
+      u16(name.length),
+      u16(0),
+      name,
+      data,
+    ]);
+    locals.push(local);
+    centrals.push(Buffer.concat([
+      u32(0x02014b50),
+      u16(20),
+      u16(20),
+      u16(0),
+      u16(0),
+      u16(0),
+      u16(0),
+      u32(crc),
+      u32(data.length),
+      u32(data.length),
+      u16(name.length),
+      u16(0),
+      u16(0),
+      u16(0),
+      u16(0),
+      u32(0),
+      u32(offset),
+      name,
+    ]));
+    offset += local.length;
+  }
+  const central = Buffer.concat(centrals);
+  const eocd = Buffer.concat([
+    u32(0x06054b50),
+    u16(0),
+    u16(0),
+    u16(files.length),
+    u16(files.length),
+    u32(central.length),
+    u32(offset),
+    u16(0),
+  ]);
+  return Buffer.concat([...locals, central, eocd]);
+};
+
+describe('extractZipBuffer', () => {
+  test('extracts files and rejects traversal', async () => {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-zip-'));
+    const ok = await extractZipBuffer(buildStoreZip([
+      { name: 'package.json', data: '{"ok":true}' },
+      { name: 'panel/index.html', data: '<html></html>' },
+    ]), dir);
+    expect(ok).toEqual({ ok: true });
+    expect(await fs.readFile(path.join(dir, 'package.json'), 'utf8')).toBe('{"ok":true}');
+    expect(await fs.readFile(path.join(dir, 'panel', 'index.html'), 'utf8')).toBe('<html></html>');
+
+    const escapeDir = path.join(dir, 'escape');
+    const escaped = await extractZipBuffer(buildStoreZip([
+      { name: '../secret', data: 'nope' },
+    ]), escapeDir);
+    expect(escaped).toEqual({ ok: false, code: 'extract-failed' });
+
+    await fs.rm(dir, { recursive: true, force: true });
+  });
+
+  test('unwraps a single root folder', async () => {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-zip-'));
+    await fs.mkdir(path.join(dir, 'panel-root', 'panel'), { recursive: true });
+    await fs.writeFile(path.join(dir, 'panel-root', 'package.json'), '{}');
+    expect(await unwrapGuestRoot(dir)).toBe(path.join(dir, 'panel-root'));
+    await fs.rm(dir, { recursive: true, force: true });
+  });
+});

package/server/lib/guests/files.js

@@ -0,0 +1,308 @@
+import defaultFs from 'node:fs/promises';
+import defaultPath from 'node:path';
+
+import { GUEST_FILE_CONTENT_MAX, GUEST_FILE_LIST_MAX, GUEST_FILE_PATH_MAX, guestFileScope } from '@openchamber/sdk';
+
+/**
+ * Guest file access. A relative path lives inside the open project and needs
+ * the `files` grant. `/…` and `~/…` are outside the project, must match one
+ * of the package's `contributes.filesystem` patterns, and need the
+ * `filesystem` grant. Every comparison is made on canonical absolute paths so
+ * a symlink cannot widen either scope.
+ */
+
+const failure = (code, message) => ({ ok: false, code, message });
+
+const isGlobChar = (segment) => segment.includes('*') || segment.includes('?');
+
+const escapeRegExp = (value) => value.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+
+/** Forward-slash form of a path so a glob written with `/` matches on every platform. */
+const toPosix = (value, nodePath) => (nodePath.sep === '/' ? value : value.split(nodePath.sep).join('/'));
+
+export const expandHome = (pattern, homeDir) => {
+  if (pattern === '~') {
+    return homeDir;
+  }
+  if (pattern.startsWith('~/')) {
+    return `${homeDir.replace(/[\\/]+$/, '')}/${pattern.slice(2)}`;
+  }
+  return pattern;
+};
+
+/**
+ * `**` spans any number of segments, `*` and `?` stay inside one segment. A
+ * pattern that ends in `/**` also matches the directory itself, so a guest
+ * may list the root it was granted.
+ */
+export const globToRegExp = (pattern) => {
+  let source = '^';
+  let index = 0;
+  while (index < pattern.length) {
+    const char = pattern[index];
+    if (char === '*' && pattern[index + 1] === '*') {
+      const afterSlash = index === 0 || pattern[index - 1] === '/';
+      const beforeSlash = pattern[index + 2] === '/';
+      const atEnd = index + 2 === pattern.length;
+      if (afterSlash && beforeSlash) {
+        source += '(?:.*/)?';
+        index += 3;
+        continue;
+      }
+      if (afterSlash && atEnd && source.endsWith('/')) {
+        source = `${source.slice(0, -1)}(?:/.*)?`;
+        index += 2;
+        continue;
+      }
+      source += '.*';
+      index += 2;
+      continue;
+    }
+    if (char === '*') {
+      source += '[^/]*';
+      index += 1;
+      continue;
+    }
+    if (char === '?') {
+      source += '[^/]';
+      index += 1;
+      continue;
+    }
+    source += escapeRegExp(char);
+    index += 1;
+  }
+  return new RegExp(`${source}$`);
+};
+
+export const matchesFilesystemPattern = (canonicalPath, patterns, homeDir, nodePath = defaultPath) => {
+  const candidate = toPosix(canonicalPath, nodePath);
+  return patterns.some((pattern) => globToRegExp(expandHome(pattern, homeDir)).test(candidate));
+};
+
+/**
+ * Realpath of the deepest existing ancestor plus the missing tail, so a path
+ * that does not exist yet (a write) still resolves through the symlinks above
+ * it. Permission errors propagate; the caller maps them to `DENIED`.
+ */
+const canonicalize = async (absolute, fsPromises, nodePath) => {
+  let current = absolute;
+  const tail = [];
+  for (;;) {
+    try {
+      const real = await fsPromises.realpath(current);
+      return tail.length > 0 ? nodePath.join(real, ...tail) : real;
+    } catch (error) {
+      if (error?.code !== 'ENOENT' && error?.code !== 'ENOTDIR') {
+        throw error;
+      }
+    }
+    const parent = nodePath.dirname(current);
+    if (parent === current) {
+      return absolute;
+    }
+    tail.unshift(nodePath.basename(current));
+    current = parent;
+  }
+};
+
+/**
+ * The literal prefix of a pattern (segments before the first glob) goes
+ * through the same canonicalization as the candidate, so `/tmp/**` still
+ * matches on a host where `/tmp` is a symlink to `/private/tmp`.
+ */
+const canonicalizePattern = async (pattern, homeDir, fsPromises, nodePath) => {
+  const expanded = expandHome(pattern, homeDir);
+  const segments = expanded.split('/');
+  const firstGlob = segments.findIndex(isGlobChar);
+  const literal = firstGlob === -1 ? segments : segments.slice(0, firstGlob);
+  const rest = firstGlob === -1 ? [] : segments.slice(firstGlob);
+  const literalPath = literal.join('/') || '/';
+  const canonical = toPosix(await canonicalize(nodePath.resolve(literalPath), fsPromises, nodePath), nodePath);
+  return rest.length > 0 ? `${canonical.replace(/\/+$/, '')}/${rest.join('/')}` : canonical;
+};
+
+const isInside = (candidate, root, nodePath) => (
+  candidate === root || candidate.startsWith(root.endsWith(nodePath.sep) ? root : `${root}${nodePath.sep}`)
+);
+
+const hasDotDot = (value) => value.split('/').some((segment) => segment === '..');
+
+export const resolveGuestFilePath = async ({
+  path: rawPath,
+  projectDirectory,
+  patterns,
+  homeDir,
+  fsPromises = defaultFs,
+  nodePath = defaultPath,
+}) => {
+  if (
+    rawPath.length === 0
+    || rawPath.length > GUEST_FILE_PATH_MAX
+    || rawPath.includes('\0')
+    || rawPath.includes('\\')
+    || hasDotDot(rawPath)
+  ) {
+    return failure('BAD_PATH', 'File path is malformed or leaves its scope.');
+  }
+  if (guestFileScope(rawPath) === 'project') {
+    if (!projectDirectory) {
+      return failure('NO_DIRECTORY', 'No project is open.');
+    }
+    let projectReal;
+    try {
+      projectReal = await fsPromises.realpath(projectDirectory);
+    } catch {
+      return failure('NO_DIRECTORY', 'The open project directory is not available.');
+    }
+    const absolute = await canonicalize(nodePath.resolve(projectReal, rawPath), fsPromises, nodePath);
+    if (!isInside(absolute, projectReal, nodePath)) {
+      return failure('BAD_PATH', 'File path leaves the open project.');
+    }
+    return { ok: true, scope: 'project', absolute };
+  }
+  const absolute = await canonicalize(nodePath.resolve(expandHome(rawPath, homeDir)), fsPromises, nodePath);
+  const canonicalPatterns = await Promise.all(
+    (patterns ?? []).map((pattern) => canonicalizePattern(pattern, homeDir, fsPromises, nodePath)),
+  );
+  if (!matchesFilesystemPattern(absolute, canonicalPatterns, homeDir, nodePath)) {
+    return failure('BAD_PATH', 'File path is not covered by a declared filesystem pattern.');
+  }
+  return { ok: true, scope: 'filesystem', absolute };
+};
+
+const entryKind = (dirent) => {
+  if (dirent.isSymbolicLink()) return 'other';
+  if (dirent.isFile()) return 'file';
+  if (dirent.isDirectory()) return 'directory';
+  return 'other';
+};
+
+const readOperation = async (absolute, fsPromises) => {
+  const stat = await fsPromises.stat(absolute);
+  if (stat.isDirectory()) {
+    return failure('BAD_PATH', 'That path is a directory.');
+  }
+  if (stat.size > GUEST_FILE_CONTENT_MAX) {
+    return failure('FILE_TOO_LARGE', `File is over ${GUEST_FILE_CONTENT_MAX} characters.`);
+  }
+  const content = await fsPromises.readFile(absolute, 'utf8');
+  if (content.length > GUEST_FILE_CONTENT_MAX) {
+    return failure('FILE_TOO_LARGE', `File is over ${GUEST_FILE_CONTENT_MAX} characters.`);
+  }
+  return { ok: true, result: { content } };
+};
+
+const writeOperation = async (absolute, content, fsPromises, nodePath) => {
+  if (content === undefined || content === null) {
+    return failure('BAD_PATH', 'Write needs content.');
+  }
+  if (content.length > GUEST_FILE_CONTENT_MAX) {
+    return failure('FILE_TOO_LARGE', `Content is over ${GUEST_FILE_CONTENT_MAX} characters.`);
+  }
+  await fsPromises.mkdir(nodePath.dirname(absolute), { recursive: true });
+  // Temp file plus rename: a concurrent reader never sees a truncated file.
+  const tmp = `${absolute}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  try {
+    await fsPromises.writeFile(tmp, content, 'utf8');
+    await fsPromises.rename(tmp, absolute);
+  } catch (error) {
+    await fsPromises.unlink(tmp).catch(() => {});
+    throw error;
+  }
+  return { ok: true, result: { written: true } };
+};
+
+const listOperation = async (absolute, fsPromises) => {
+  const dirents = await fsPromises.readdir(absolute, { withFileTypes: true });
+  const entries = dirents
+    .map((dirent) => ({ name: dirent.name, kind: entryKind(dirent) }))
+    .sort((left, right) => (left.name < right.name ? -1 : left.name > right.name ? 1 : 0))
+    .slice(0, GUEST_FILE_LIST_MAX);
+  return { ok: true, result: { entries } };
+};
+
+const statOperation = async (absolute, fsPromises) => {
+  let stat;
+  try {
+    stat = await fsPromises.stat(absolute);
+  } catch (error) {
+    if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') {
+      return { ok: true, result: { kind: 'missing', size: 0, mtime: 0 } };
+    }
+    throw error;
+  }
+  const kind = stat.isFile() ? 'file' : stat.isDirectory() ? 'directory' : 'other';
+  return { ok: true, result: { kind, size: stat.size, mtime: Math.floor(stat.mtimeMs) } };
+};
+
+const mapFsError = (error) => {
+  const code = error?.code;
+  if (code === 'ENOENT') {
+    return failure('NOT_FOUND', 'No file at that path.');
+  }
+  if (code === 'EACCES' || code === 'EPERM') {
+    return failure('DENIED', 'The operating system refused access to that path.');
+  }
+  if (code === 'EISDIR' || code === 'ENOTDIR') {
+    return failure('BAD_PATH', 'That path is not the right kind of entry for this operation.');
+  }
+  return null;
+};
+
+/**
+ * One guest file call end to end: scope, grant, then the operation. Returns
+ * `{ ok: true, result }` or `{ ok: false, code, message }`; only unexpected
+ * OS errors throw.
+ */
+export const runGuestFileOperation = async ({
+  op,
+  path: rawPath,
+  content,
+  projectDirectory,
+  patterns,
+  grants,
+  homeDir,
+  fsPromises = defaultFs,
+  nodePath = defaultPath,
+}) => {
+  // Grant first, from the raw path's scope, so an unapproved extension never
+  // touches the disk (not even a realpath probe).
+  const needed = guestFileScope(rawPath) === 'project' ? 'files' : 'filesystem';
+  if (!(grants ?? []).includes(needed)) {
+    return failure(
+      'NOT_GRANTED',
+      needed === 'files'
+        ? 'This extension has not been allowed to read and write project files.'
+        : 'This extension has not been allowed to read and write files outside the project.',
+    );
+  }
+  let resolved;
+  try {
+    resolved = await resolveGuestFilePath({ path: rawPath, projectDirectory, patterns, homeDir, fsPromises, nodePath });
+  } catch (error) {
+    const mapped = mapFsError(error);
+    if (mapped) return mapped;
+    throw error;
+  }
+  if (!resolved.ok) {
+    return resolved;
+  }
+  try {
+    switch (op) {
+      case 'read':
+        return await readOperation(resolved.absolute, fsPromises);
+      case 'write':
+        return await writeOperation(resolved.absolute, content, fsPromises, nodePath);
+      case 'list':
+        return await listOperation(resolved.absolute, fsPromises);
+      case 'stat':
+        return await statOperation(resolved.absolute, fsPromises);
+      default:
+        return failure('BAD_PATH', 'Unknown file operation.');
+    }
+  } catch (error) {
+    const mapped = mapFsError(error);
+    if (mapped) return mapped;
+    throw error;
+  }
+};