@wbce-d9/api 12.5.10 → 12.6.0

package/dist/app.js

@@ -109,6 +109,7 @@ export default async function createApp() {
     if (env['HSTS_ENABLED']) {
         app.use(helmet.hsts(getConfigFromEnv('HSTS_', ['HSTS_ENABLED'])));
     }
+    app.use(helmet.crossOriginOpenerPolicy({ policy: env['CROSS_ORIGIN_OPENER_POLICY'] }));
     await emitter.emitInit('app.before', { app });
     await emitter.emitInit('middlewares.before', { app });
     app.use(expressLogger);

package/dist/auth/drivers/saml.js

@@ -116,6 +116,9 @@ export function createSAMLAuthRouter(providerName) {
     }));
     router.post('/acs', express.urlencoded({ extended: false }), asyncHandler(async (req, res, next) => {
         const relayState = req.body?.RelayState;
+        if (isRedirectAllowedOnLogin(relayState, providerName) === false) {
+            throw new InvalidPayloadException(`URL "${relayState}" can't be used to redirect after login`);
+        }
         try {
             const { sp, idp } = getAuthProvider(providerName);
             const { extract } = await sp.parseLoginResponse(idp, 'post', {

package/dist/cli/utils/create-env/env-stub.liquid

@@ -254,6 +254,9 @@ CORS_CREDENTIALS=true
 # Value for the Access-Control-Max-Age header [18000]
 CORS_MAX_AGE=18000
 
+# Value for the Cross-Origin-Opener-Policy header: same-origin, same-origin-allow-popups or unsafe-none ["same-origin"]
+# CROSS_ORIGIN_OPENER_POLICY="same-origin"
+
 ####################################################################################################
 ### Argon2
 

package/dist/env.js

@@ -61,8 +61,10 @@ const allowedEnvironmentVars = [
     'IP_CUSTOM_HEADER',
     'ASSETS_CONTENT_SECURITY_POLICY',
     'IMPORT_IP_DENY_LIST',
+    'IMPORT_FILE_IP_ALLOW_LIST',
     'CONTENT_SECURITY_POLICY_.+',
     'HSTS_.+',
+    'CROSS_ORIGIN_OPENER_POLICY',
     // hashing
     'HASH_.+',
     'X_POWERED_BY_ENABLED',
@@ -283,6 +285,8 @@ const defaults = {
     IP_TRUST_PROXY: true,
     IP_CUSTOM_HEADER: false,
     IMPORT_IP_DENY_LIST: ['0.0.0.0', '169.254.169.254'],
+    IMPORT_FILE_IP_ALLOW_LIST: [],
+    CROSS_ORIGIN_OPENER_POLICY: 'same-origin',
     SERVE_APP: true,
     SERVE_GRAPHQL: true,
     RELATIONAL_BATCH_SIZE: 25000,
@@ -306,6 +310,7 @@ const typeMap = {
     DB_EXCLUDE_TABLES: 'array',
     CACHE_SKIP_ALLOWED: 'boolean',
     IMPORT_IP_DENY_LIST: 'array',
+    IMPORT_FILE_IP_ALLOW_LIST: 'array',
     FILE_METADATA_ALLOW_LIST: 'array',
     SERVE_GRAPHQL: 'boolean',
     GRAPHQL_INTROSPECTION: 'boolean',

package/dist/operations/condition/index.js

@@ -4,7 +4,9 @@ export default defineOperationApi({
     handler: ({ filter }, { data }) => {
         const errors = validatePayload(filter, data, { requireAll: true });
         if (errors.length > 0) {
-            throw errors;
+            // Joi errors hold the validated data ($env, $accountability…) in _original, details[].context and in some
+            // messages: only keep the path and type, both derived from the filter, as webhook flows can return them
+            throw errors.flatMap((error) => error.details.map(({ path, type }) => ({ path, type })));
         }
         else {
             return null;

package/dist/request/index.d.ts

@@ -1,5 +1,27 @@
+/// <reference types="node" resolution-mode="require"/>
 import type { AxiosInstance } from 'axios';
+import { RequestFilteringHttpAgent, RequestFilteringHttpsAgent } from 'request-filtering-agent';
 export declare const _cache: {
     axiosInstance: AxiosInstance | null;
 };
 export declare function getAxios(): Promise<AxiosInstance>;
+/**
+ * Request config for file imports, where the URL is user-provided: only public IP addresses (or those in
+ * IMPORT_FILE_IP_ALLOW_LIST) are allowed, checked on every connection (including redirects).
+ * request-filtering-agent skips its deny list for addresses in its allow list, so IMPORT_IP_DENY_LIST is checked again
+ * on every DNS lookup and redirect to make sure it always takes precedence over IMPORT_FILE_IP_ALLOW_LIST
+ */
+export declare const importRequestConfig: () => {
+    maxRedirects: number;
+    httpAgent: RequestFilteringHttpAgent;
+    httpsAgent: RequestFilteringHttpsAgent;
+    lookup: (hostname: string, options: object) => Promise<[import("dns").LookupAddress[]]>;
+    beforeRedirect: (options: Record<string, any>, responseDetails: {
+        headers: Record<string, string>;
+        statusCode: import("axios").HttpStatusCode;
+    }, requestDetails: {
+        headers: Record<string, string>;
+        url: string;
+        method: string;
+    }) => void;
+};

package/dist/request/index.js

@@ -1,5 +1,10 @@
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+import { RequestFilteringHttpAgent, RequestFilteringHttpsAgent } from 'request-filtering-agent';
+import { getEnv } from '../env.js';
 import { requestInterceptor } from './request-interceptor.js';
 import { responseInterceptor } from './response-interceptor.js';
+import { validateIP } from './validate-ip.js';
 export const _cache = {
     axiosInstance: null,
 };
@@ -12,3 +17,35 @@ export async function getAxios() {
     }
     return _cache.axiosInstance;
 }
+const denyListLookup = async (hostname, options) => {
+    const addresses = await lookup(hostname, { ...options, all: true });
+    for (const { address } of addresses) {
+        validateIP(address, hostname);
+    }
+    return [addresses];
+};
+// IP addresses in the redirect URL are connected to without DNS lookup
+const denyListBeforeRedirect = ({ hostname, href }) => {
+    if (isIP(hostname) !== 0)
+        validateIP(hostname, href);
+};
+/**
+ * Request config for file imports, where the URL is user-provided: only public IP addresses (or those in
+ * IMPORT_FILE_IP_ALLOW_LIST) are allowed, checked on every connection (including redirects).
+ * request-filtering-agent skips its deny list for addresses in its allow list, so IMPORT_IP_DENY_LIST is checked again
+ * on every DNS lookup and redirect to make sure it always takes precedence over IMPORT_FILE_IP_ALLOW_LIST
+ */
+export const importRequestConfig = () => {
+    const env = getEnv();
+    const options = {
+        denyIPAddressList: env['IMPORT_IP_DENY_LIST'],
+        allowIPAddressList: env['IMPORT_FILE_IP_ALLOW_LIST'],
+    };
+    return {
+        maxRedirects: 5,
+        httpAgent: new RequestFilteringHttpAgent(options),
+        httpsAgent: new RequestFilteringHttpsAgent(options),
+        lookup: denyListLookup,
+        beforeRedirect: denyListBeforeRedirect,
+    };
+};

package/dist/request/request-interceptor.js

@@ -21,6 +21,6 @@ export const requestInterceptor = async (config) => {
     else {
         ip = hostname;
     }
-    await validateIP(ip, uri);
+    validateIP(ip, uri);
     return config;
 };

package/dist/request/response-interceptor.js

@@ -1,5 +1,5 @@
 import { validateIP } from './validate-ip.js';
 export const responseInterceptor = async (config) => {
-    await validateIP(config.request.socket.remoteAddress, config.request.url);
+    validateIP(config.request.socket.remoteAddress, config.request.url);
     return config;
 };

package/dist/request/validate-ip.d.ts

@@ -1 +1 @@
-export declare const validateIP: (ip: string, url: string) => Promise<void>;
+export declare const validateIP: (ip: string, url: string) => void;

package/dist/request/validate-ip.js

@@ -1,8 +1,8 @@
-import { BlockList } from 'net';
+import { BlockList, isIP } from 'net';
 import os from 'node:os';
 import { getEnv } from '../env.js';
 import logger from '../logger.js';
-export const validateIP = async (ip, url) => {
+export const validateIP = (ip, url) => {
     const env = getEnv();
     const ipDenyList = env['IMPORT_IP_DENY_LIST'] || [];
     // Create a BlockList for efficient IP range checking
@@ -53,7 +53,7 @@ export const validateIP = async (ip, url) => {
                             logger.warn(`Warning: Invalid prefix length in CIDR "${info.cidr}"`);
                             continue;
                         }
-                        blockList.addSubnet(network, prefixLength);
+                        blockList.addSubnet(network, prefixLength, isIP(network) === 6 ? 'ipv6' : 'ipv4');
                     }
                     catch (error) {
                         // Log but don't fail for invalid local interface CIDR
@@ -64,7 +64,7 @@ export const validateIP = async (ip, url) => {
         }
     }
     // Check if the IP is blocked
-    if (blockList.check(ip)) {
+    if (blockList.check(ip, isIP(ip) === 6 ? 'ipv6' : 'ipv4')) {
         throw new Error(`Requested URL "${url}" resolves to a denied IP address`);
     }
 };

package/dist/services/files.js

@@ -14,7 +14,7 @@ import emitter from '../emitter.js';
 import env from '../env.js';
 import { ForbiddenException, InvalidPayloadException, ServiceUnavailableException } from '../exceptions/index.js';
 import logger from '../logger.js';
-import { getAxios } from '../request/index.js';
+import { getAxios, importRequestConfig } from '../request/index.js';
 import { getStorage } from '../storage/index.js';
 import { parseIptc, parseXmp } from '../utils/parse-image-metadata.js';
 import { ItemsService } from './items.js';
@@ -216,6 +216,7 @@ export class FilesService extends ItemsService {
             const axios = await getAxios();
             fileResponse = await axios.get(encodeURL(importURL), {
                 responseType: 'stream',
+                ...importRequestConfig(),
             });
         }
         catch (err) {

package/dist/utils/is-redirect-allowed-on-login.js

@@ -1,9 +1,13 @@
 import { toArray } from '@wbce-d9/utils';
+import { URL } from 'url';
 import env from '../env.js';
 import isUrlAllowed from './is-url-allowed.js';
-function isUrlValid(string) {
+// Sentinel origin that never resolves (RFC 6761): relative paths keep it,
+// anything pointing elsewhere (`//x`, `/\x`, `https://x`) does not.
+const RELATIVE_BASE = 'https://relative.invalid';
+function isUrlValid(url, base) {
     try {
-        new URL(string);
+        new URL(url, base);
         return true;
     }
     catch (err) {
@@ -18,25 +22,20 @@ export function isRedirectAllowedOnLogin(redirect, provider) {
         return true; // empty redirect
     if (typeof redirect !== 'string')
         return false; // invalid type
-    const publicUrl = env['PUBLIC_URL'];
     if (!isUrlValid(redirect)) {
-        if (!redirect.startsWith('//')) {
-            // should be a relative path like `/admin/test`
-            return true;
-        }
-        // domain without protocol `//example.com/test`
-        return false;
+        // relative path like `/admin/test`, allowed unless it resolves to another origin
+        return isUrlValid(redirect, RELATIVE_BASE) && new URL(redirect, RELATIVE_BASE).origin === RELATIVE_BASE;
     }
-    const { protocol: redirectProtocol, hostname: redirectDomain } = new URL(redirect);
+    const { protocol: redirectProtocol, host: redirectHost } = new URL(redirect);
+    const publicUrl = env['PUBLIC_URL'];
     const envKey = `AUTH_${provider.toUpperCase()}_REDIRECT_ALLOW_LIST`;
     if (envKey in env) {
         if (isUrlAllowed(redirect, [...toArray(env[envKey]), publicUrl]))
             return true;
     }
-    if (!isUrlValid(publicUrl)) {
+    if (!isUrlValid(publicUrl))
         return false;
-    }
     // allow redirects to the defined PUBLIC_URL
-    const { protocol: publicProtocol, hostname: publicDomain } = new URL(publicUrl);
-    return `${redirectProtocol}//${redirectDomain}` === `${publicProtocol}//${publicDomain}`;
+    const { protocol: publicProtocol, host: publicHost } = new URL(publicUrl);
+    return redirectProtocol === publicProtocol && redirectHost === publicHost;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.5.10",
+  "version": "12.6.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -85,6 +85,7 @@
     "openapi3-ts": "3.2.0",
     "ora": "6.3.0",
     "pino": "8.11.0",
+    "request-filtering-agent": "3.2.1",
     "rollup": "3.30.0",
     "uuid": "14.0.0",
     "wellknown": "0.5.0",
@@ -143,20 +144,20 @@
     "tmp-promise": "3.0.3",
     "tsx": "3.12.6",
     "uuid-validate": "0.0.3",
+    "@wbce-d9/app": "11.0.1",
+    "@wbce-d9/exceptions": "10.0.1",
+    "@wbce-d9/extensions-sdk": "10.0.5",
+    "@wbce-d9/specs": "9.26.5",
     "@wbce-d9/constants": "10.0.0",
-    "@wbce-d9/exceptions": "10.0.0",
-    "@wbce-d9/extensions-sdk": "10.0.4",
     "@wbce-d9/schema": "10.0.0",
-    "@wbce-d9/specs": "9.26.5",
+    "@wbce-d9/storage-driver-azure": "10.0.4",
     "@wbce-d9/storage": "10.0.0",
-    "@wbce-d9/storage-driver-azure": "10.0.3",
-    "@wbce-d9/storage-driver-cloudinary": "10.0.4",
-    "@wbce-d9/app": "11.0.0",
-    "@wbce-d9/storage-driver-gcs": "10.0.3",
-    "@wbce-d9/storage-driver-local": "10.0.3",
-    "@wbce-d9/storage-driver-s3": "10.0.3",
+    "@wbce-d9/storage-driver-cloudinary": "10.0.5",
+    "@wbce-d9/storage-driver-gcs": "10.0.4",
+    "@wbce-d9/storage-driver-s3": "10.0.4",
     "@wbce-d9/update-check": "10.0.4",
-    "@wbce-d9/utils": "10.0.3"
+    "@wbce-d9/utils": "10.0.4",
+    "@wbce-d9/storage-driver-local": "10.0.4"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",