@wbce-d9/api 12.5.10 → 12.5.11

package/dist/app.js

@@ -109,6 +109,7 @@ export default async function createApp() {
     if (env['HSTS_ENABLED']) {
         app.use(helmet.hsts(getConfigFromEnv('HSTS_', ['HSTS_ENABLED'])));
     }
+    app.use(helmet.crossOriginOpenerPolicy({ policy: env['CROSS_ORIGIN_OPENER_POLICY'] }));
     await emitter.emitInit('app.before', { app });
     await emitter.emitInit('middlewares.before', { app });
     app.use(expressLogger);

package/dist/cli/utils/create-env/env-stub.liquid

@@ -254,6 +254,9 @@ CORS_CREDENTIALS=true
 # Value for the Access-Control-Max-Age header [18000]
 CORS_MAX_AGE=18000
 
+# Value for the Cross-Origin-Opener-Policy header: same-origin, same-origin-allow-popups or unsafe-none ["same-origin"]
+# CROSS_ORIGIN_OPENER_POLICY="same-origin"
+
 ####################################################################################################
 ### Argon2
 

package/dist/env.js

@@ -63,6 +63,7 @@ const allowedEnvironmentVars = [
     'IMPORT_IP_DENY_LIST',
     'CONTENT_SECURITY_POLICY_.+',
     'HSTS_.+',
+    'CROSS_ORIGIN_OPENER_POLICY',
     // hashing
     'HASH_.+',
     'X_POWERED_BY_ENABLED',
@@ -283,6 +284,7 @@ const defaults = {
     IP_TRUST_PROXY: true,
     IP_CUSTOM_HEADER: false,
     IMPORT_IP_DENY_LIST: ['0.0.0.0', '169.254.169.254'],
+    CROSS_ORIGIN_OPENER_POLICY: 'same-origin',
     SERVE_APP: true,
     SERVE_GRAPHQL: true,
     RELATIONAL_BATCH_SIZE: 25000,

package/dist/operations/condition/index.js

@@ -4,7 +4,9 @@ export default defineOperationApi({
     handler: ({ filter }, { data }) => {
         const errors = validatePayload(filter, data, { requireAll: true });
         if (errors.length > 0) {
-            throw errors;
+            // Joi errors hold the validated data ($env, $accountability…) in _original, details[].context and in some
+            // messages: only keep the path and type, both derived from the filter, as webhook flows can return them
+            throw errors.flatMap((error) => error.details.map(({ path, type }) => ({ path, type })));
         }
         else {
             return null;

package/dist/utils/is-redirect-allowed-on-login.js

@@ -1,9 +1,13 @@
 import { toArray } from '@wbce-d9/utils';
+import { URL } from 'url';
 import env from '../env.js';
 import isUrlAllowed from './is-url-allowed.js';
-function isUrlValid(string) {
+// Sentinel origin that never resolves (RFC 6761): relative paths keep it,
+// anything pointing elsewhere (`//x`, `/\x`, `https://x`) does not.
+const RELATIVE_BASE = 'https://relative.invalid';
+function isUrlValid(url, base) {
     try {
-        new URL(string);
+        new URL(url, base);
         return true;
     }
     catch (err) {
@@ -18,25 +22,20 @@ export function isRedirectAllowedOnLogin(redirect, provider) {
         return true; // empty redirect
     if (typeof redirect !== 'string')
         return false; // invalid type
-    const publicUrl = env['PUBLIC_URL'];
     if (!isUrlValid(redirect)) {
-        if (!redirect.startsWith('//')) {
-            // should be a relative path like `/admin/test`
-            return true;
-        }
-        // domain without protocol `//example.com/test`
-        return false;
+        // relative path like `/admin/test`, allowed unless it resolves to another origin
+        return isUrlValid(redirect, RELATIVE_BASE) && new URL(redirect, RELATIVE_BASE).origin === RELATIVE_BASE;
     }
-    const { protocol: redirectProtocol, hostname: redirectDomain } = new URL(redirect);
+    const { protocol: redirectProtocol, host: redirectHost } = new URL(redirect);
+    const publicUrl = env['PUBLIC_URL'];
     const envKey = `AUTH_${provider.toUpperCase()}_REDIRECT_ALLOW_LIST`;
     if (envKey in env) {
         if (isUrlAllowed(redirect, [...toArray(env[envKey]), publicUrl]))
             return true;
     }
-    if (!isUrlValid(publicUrl)) {
+    if (!isUrlValid(publicUrl))
         return false;
-    }
     // allow redirects to the defined PUBLIC_URL
-    const { protocol: publicProtocol, hostname: publicDomain } = new URL(publicUrl);
-    return `${redirectProtocol}//${redirectDomain}` === `${publicProtocol}//${publicDomain}`;
+    const { protocol: publicProtocol, host: publicHost } = new URL(publicUrl);
+    return redirectProtocol === publicProtocol && redirectHost === publicHost;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.5.10",
+  "version": "12.5.11",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -144,17 +144,17 @@
     "tsx": "3.12.6",
     "uuid-validate": "0.0.3",
     "@wbce-d9/constants": "10.0.0",
+    "@wbce-d9/app": "11.0.0",
     "@wbce-d9/exceptions": "10.0.0",
-    "@wbce-d9/extensions-sdk": "10.0.4",
-    "@wbce-d9/schema": "10.0.0",
     "@wbce-d9/specs": "9.26.5",
+    "@wbce-d9/schema": "10.0.0",
     "@wbce-d9/storage": "10.0.0",
-    "@wbce-d9/storage-driver-azure": "10.0.3",
-    "@wbce-d9/storage-driver-cloudinary": "10.0.4",
-    "@wbce-d9/app": "11.0.0",
     "@wbce-d9/storage-driver-gcs": "10.0.3",
+    "@wbce-d9/storage-driver-cloudinary": "10.0.4",
+    "@wbce-d9/storage-driver-azure": "10.0.3",
     "@wbce-d9/storage-driver-local": "10.0.3",
     "@wbce-d9/storage-driver-s3": "10.0.3",
+    "@wbce-d9/extensions-sdk": "10.0.4",
     "@wbce-d9/update-check": "10.0.4",
     "@wbce-d9/utils": "10.0.3"
   },