@wbce-d9/api 12.5.11 → 12.6.0

package/dist/auth/drivers/saml.js

@@ -116,6 +116,9 @@ export function createSAMLAuthRouter(providerName) {
     }));
     router.post('/acs', express.urlencoded({ extended: false }), asyncHandler(async (req, res, next) => {
         const relayState = req.body?.RelayState;
+        if (isRedirectAllowedOnLogin(relayState, providerName) === false) {
+            throw new InvalidPayloadException(`URL "${relayState}" can't be used to redirect after login`);
+        }
         try {
             const { sp, idp } = getAuthProvider(providerName);
             const { extract } = await sp.parseLoginResponse(idp, 'post', {

package/dist/env.js

@@ -61,6 +61,7 @@ const allowedEnvironmentVars = [
     'IP_CUSTOM_HEADER',
     'ASSETS_CONTENT_SECURITY_POLICY',
     'IMPORT_IP_DENY_LIST',
+    'IMPORT_FILE_IP_ALLOW_LIST',
     'CONTENT_SECURITY_POLICY_.+',
     'HSTS_.+',
     'CROSS_ORIGIN_OPENER_POLICY',
@@ -284,6 +285,7 @@ const defaults = {
     IP_TRUST_PROXY: true,
     IP_CUSTOM_HEADER: false,
     IMPORT_IP_DENY_LIST: ['0.0.0.0', '169.254.169.254'],
+    IMPORT_FILE_IP_ALLOW_LIST: [],
     CROSS_ORIGIN_OPENER_POLICY: 'same-origin',
     SERVE_APP: true,
     SERVE_GRAPHQL: true,
@@ -308,6 +310,7 @@ const typeMap = {
     DB_EXCLUDE_TABLES: 'array',
     CACHE_SKIP_ALLOWED: 'boolean',
     IMPORT_IP_DENY_LIST: 'array',
+    IMPORT_FILE_IP_ALLOW_LIST: 'array',
     FILE_METADATA_ALLOW_LIST: 'array',
     SERVE_GRAPHQL: 'boolean',
     GRAPHQL_INTROSPECTION: 'boolean',

package/dist/request/index.d.ts

@@ -1,5 +1,27 @@
+/// <reference types="node" resolution-mode="require"/>
 import type { AxiosInstance } from 'axios';
+import { RequestFilteringHttpAgent, RequestFilteringHttpsAgent } from 'request-filtering-agent';
 export declare const _cache: {
     axiosInstance: AxiosInstance | null;
 };
 export declare function getAxios(): Promise<AxiosInstance>;
+/**
+ * Request config for file imports, where the URL is user-provided: only public IP addresses (or those in
+ * IMPORT_FILE_IP_ALLOW_LIST) are allowed, checked on every connection (including redirects).
+ * request-filtering-agent skips its deny list for addresses in its allow list, so IMPORT_IP_DENY_LIST is checked again
+ * on every DNS lookup and redirect to make sure it always takes precedence over IMPORT_FILE_IP_ALLOW_LIST
+ */
+export declare const importRequestConfig: () => {
+    maxRedirects: number;
+    httpAgent: RequestFilteringHttpAgent;
+    httpsAgent: RequestFilteringHttpsAgent;
+    lookup: (hostname: string, options: object) => Promise<[import("dns").LookupAddress[]]>;
+    beforeRedirect: (options: Record<string, any>, responseDetails: {
+        headers: Record<string, string>;
+        statusCode: import("axios").HttpStatusCode;
+    }, requestDetails: {
+        headers: Record<string, string>;
+        url: string;
+        method: string;
+    }) => void;
+};

package/dist/request/index.js

@@ -1,5 +1,10 @@
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+import { RequestFilteringHttpAgent, RequestFilteringHttpsAgent } from 'request-filtering-agent';
+import { getEnv } from '../env.js';
 import { requestInterceptor } from './request-interceptor.js';
 import { responseInterceptor } from './response-interceptor.js';
+import { validateIP } from './validate-ip.js';
 export const _cache = {
     axiosInstance: null,
 };
@@ -12,3 +17,35 @@ export async function getAxios() {
     }
     return _cache.axiosInstance;
 }
+const denyListLookup = async (hostname, options) => {
+    const addresses = await lookup(hostname, { ...options, all: true });
+    for (const { address } of addresses) {
+        validateIP(address, hostname);
+    }
+    return [addresses];
+};
+// IP addresses in the redirect URL are connected to without DNS lookup
+const denyListBeforeRedirect = ({ hostname, href }) => {
+    if (isIP(hostname) !== 0)
+        validateIP(hostname, href);
+};
+/**
+ * Request config for file imports, where the URL is user-provided: only public IP addresses (or those in
+ * IMPORT_FILE_IP_ALLOW_LIST) are allowed, checked on every connection (including redirects).
+ * request-filtering-agent skips its deny list for addresses in its allow list, so IMPORT_IP_DENY_LIST is checked again
+ * on every DNS lookup and redirect to make sure it always takes precedence over IMPORT_FILE_IP_ALLOW_LIST
+ */
+export const importRequestConfig = () => {
+    const env = getEnv();
+    const options = {
+        denyIPAddressList: env['IMPORT_IP_DENY_LIST'],
+        allowIPAddressList: env['IMPORT_FILE_IP_ALLOW_LIST'],
+    };
+    return {
+        maxRedirects: 5,
+        httpAgent: new RequestFilteringHttpAgent(options),
+        httpsAgent: new RequestFilteringHttpsAgent(options),
+        lookup: denyListLookup,
+        beforeRedirect: denyListBeforeRedirect,
+    };
+};

package/dist/request/request-interceptor.js

@@ -21,6 +21,6 @@ export const requestInterceptor = async (config) => {
     else {
         ip = hostname;
     }
-    await validateIP(ip, uri);
+    validateIP(ip, uri);
     return config;
 };

package/dist/request/response-interceptor.js

@@ -1,5 +1,5 @@
 import { validateIP } from './validate-ip.js';
 export const responseInterceptor = async (config) => {
-    await validateIP(config.request.socket.remoteAddress, config.request.url);
+    validateIP(config.request.socket.remoteAddress, config.request.url);
     return config;
 };

package/dist/request/validate-ip.d.ts

@@ -1 +1 @@
-export declare const validateIP: (ip: string, url: string) => Promise<void>;
+export declare const validateIP: (ip: string, url: string) => void;

package/dist/request/validate-ip.js

@@ -1,8 +1,8 @@
-import { BlockList } from 'net';
+import { BlockList, isIP } from 'net';
 import os from 'node:os';
 import { getEnv } from '../env.js';
 import logger from '../logger.js';
-export const validateIP = async (ip, url) => {
+export const validateIP = (ip, url) => {
     const env = getEnv();
     const ipDenyList = env['IMPORT_IP_DENY_LIST'] || [];
     // Create a BlockList for efficient IP range checking
@@ -53,7 +53,7 @@ export const validateIP = async (ip, url) => {
                             logger.warn(`Warning: Invalid prefix length in CIDR "${info.cidr}"`);
                             continue;
                         }
-                        blockList.addSubnet(network, prefixLength);
+                        blockList.addSubnet(network, prefixLength, isIP(network) === 6 ? 'ipv6' : 'ipv4');
                     }
                     catch (error) {
                         // Log but don't fail for invalid local interface CIDR
@@ -64,7 +64,7 @@ export const validateIP = async (ip, url) => {
         }
     }
     // Check if the IP is blocked
-    if (blockList.check(ip)) {
+    if (blockList.check(ip, isIP(ip) === 6 ? 'ipv6' : 'ipv4')) {
         throw new Error(`Requested URL "${url}" resolves to a denied IP address`);
     }
 };

package/dist/services/files.js

@@ -14,7 +14,7 @@ import emitter from '../emitter.js';
 import env from '../env.js';
 import { ForbiddenException, InvalidPayloadException, ServiceUnavailableException } from '../exceptions/index.js';
 import logger from '../logger.js';
-import { getAxios } from '../request/index.js';
+import { getAxios, importRequestConfig } from '../request/index.js';
 import { getStorage } from '../storage/index.js';
 import { parseIptc, parseXmp } from '../utils/parse-image-metadata.js';
 import { ItemsService } from './items.js';
@@ -216,6 +216,7 @@ export class FilesService extends ItemsService {
             const axios = await getAxios();
             fileResponse = await axios.get(encodeURL(importURL), {
                 responseType: 'stream',
+                ...importRequestConfig(),
             });
         }
         catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.5.11",
+  "version": "12.6.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -85,6 +85,7 @@
     "openapi3-ts": "3.2.0",
     "ora": "6.3.0",
     "pino": "8.11.0",
+    "request-filtering-agent": "3.2.1",
     "rollup": "3.30.0",
     "uuid": "14.0.0",
     "wellknown": "0.5.0",
@@ -143,20 +144,20 @@
     "tmp-promise": "3.0.3",
     "tsx": "3.12.6",
     "uuid-validate": "0.0.3",
-    "@wbce-d9/constants": "10.0.0",
-    "@wbce-d9/app": "11.0.0",
-    "@wbce-d9/exceptions": "10.0.0",
+    "@wbce-d9/app": "11.0.1",
+    "@wbce-d9/exceptions": "10.0.1",
+    "@wbce-d9/extensions-sdk": "10.0.5",
     "@wbce-d9/specs": "9.26.5",
+    "@wbce-d9/constants": "10.0.0",
     "@wbce-d9/schema": "10.0.0",
+    "@wbce-d9/storage-driver-azure": "10.0.4",
     "@wbce-d9/storage": "10.0.0",
-    "@wbce-d9/storage-driver-gcs": "10.0.3",
-    "@wbce-d9/storage-driver-cloudinary": "10.0.4",
-    "@wbce-d9/storage-driver-azure": "10.0.3",
-    "@wbce-d9/storage-driver-local": "10.0.3",
-    "@wbce-d9/storage-driver-s3": "10.0.3",
-    "@wbce-d9/extensions-sdk": "10.0.4",
+    "@wbce-d9/storage-driver-cloudinary": "10.0.5",
+    "@wbce-d9/storage-driver-gcs": "10.0.4",
+    "@wbce-d9/storage-driver-s3": "10.0.4",
     "@wbce-d9/update-check": "10.0.4",
-    "@wbce-d9/utils": "10.0.3"
+    "@wbce-d9/utils": "10.0.4",
+    "@wbce-d9/storage-driver-local": "10.0.4"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",