@wbce-d9/api 12.5.9 → 12.5.11

package/dist/app.js

@@ -109,6 +109,7 @@ export default async function createApp() {
     if (env['HSTS_ENABLED']) {
         app.use(helmet.hsts(getConfigFromEnv('HSTS_', ['HSTS_ENABLED'])));
     }
+    app.use(helmet.crossOriginOpenerPolicy({ policy: env['CROSS_ORIGIN_OPENER_POLICY'] }));
     await emitter.emitInit('app.before', { app });
     await emitter.emitInit('middlewares.before', { app });
     app.use(expressLogger);

package/dist/auth/drivers/openid.js

@@ -17,6 +17,23 @@ import { getIPFromReq } from '../../utils/get-ip-from-req.js';
 import { Url } from '../../utils/url.js';
 import { isRedirectAllowedOnLogin } from '../../utils/is-redirect-allowed-on-login.js';
 import { BaseOAuthDriver } from './baseoauth.js';
+// Authorization-request parameters the caller must never control
+const RESERVED_AUTH_PARAMS = new Set([
+    'prompt',
+    'redirect',
+    'scope',
+    'access_type',
+    'code_challenge',
+    'code_challenge_method',
+    'state',
+    'nonce',
+    'redirect_uri',
+    'client_id',
+    'response_type',
+    'response_mode',
+    'request',
+    'request_uri',
+]);
 export class OpenIDAuthDriver extends BaseOAuthDriver {
     client;
     redirectUrl;
@@ -75,6 +92,7 @@ export class OpenIDAuthDriver extends BaseOAuthDriver {
             const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);
             const paramsConfig = typeof this.config['params'] === 'object' ? this.config['params'] : {};
             const params = {
+                ...additionalParams,
                 scope: this.config['scope'] ?? 'openid profile email',
                 access_type: 'offline',
                 ...paramsConfig,
@@ -84,7 +102,6 @@ export class OpenIDAuthDriver extends BaseOAuthDriver {
                 state: codeChallenge,
                 nonce: codeChallenge,
                 redirect_uri: this.redirectUrl,
-                ...additionalParams,
             };
             if (prompt) {
                 params.prompt = 'consent';
@@ -155,7 +172,7 @@ export function createOpenIDAuthRouter(providerName) {
             issuer: 'directus',
         });
         const additionalParams = Object.fromEntries(Object.entries(req.query)
-            .filter(([k, v]) => k !== 'prompt' && k !== 'redirect' && typeof v === 'string')
+            .filter(([k, v]) => RESERVED_AUTH_PARAMS.has(k) === false && typeof v === 'string')
             .map(([k, v]) => [k, v]));
         const authUrl = await provider.generateAuthUrl(codeVerifier, prompt, additionalParams);
         const urlParams = new URL(authUrl);

package/dist/auth/drivers/openid.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli/utils/create-env/env-stub.liquid

@@ -254,6 +254,9 @@ CORS_CREDENTIALS=true
 # Value for the Access-Control-Max-Age header [18000]
 CORS_MAX_AGE=18000
 
+# Value for the Cross-Origin-Opener-Policy header: same-origin, same-origin-allow-popups or unsafe-none ["same-origin"]
+# CROSS_ORIGIN_OPENER_POLICY="same-origin"
+
 ####################################################################################################
 ### Argon2
 

package/dist/env.js

@@ -63,6 +63,7 @@ const allowedEnvironmentVars = [
     'IMPORT_IP_DENY_LIST',
     'CONTENT_SECURITY_POLICY_.+',
     'HSTS_.+',
+    'CROSS_ORIGIN_OPENER_POLICY',
     // hashing
     'HASH_.+',
     'X_POWERED_BY_ENABLED',
@@ -283,6 +284,7 @@ const defaults = {
     IP_TRUST_PROXY: true,
     IP_CUSTOM_HEADER: false,
     IMPORT_IP_DENY_LIST: ['0.0.0.0', '169.254.169.254'],
+    CROSS_ORIGIN_OPENER_POLICY: 'same-origin',
     SERVE_APP: true,
     SERVE_GRAPHQL: true,
     RELATIONAL_BATCH_SIZE: 25000,

package/dist/operations/condition/index.js

@@ -4,7 +4,9 @@ export default defineOperationApi({
     handler: ({ filter }, { data }) => {
         const errors = validatePayload(filter, data, { requireAll: true });
         if (errors.length > 0) {
-            throw errors;
+            // Joi errors hold the validated data ($env, $accountability…) in _original, details[].context and in some
+            // messages: only keep the path and type, both derived from the filter, as webhook flows can return them
+            throw errors.flatMap((error) => error.details.map(({ path, type }) => ({ path, type })));
         }
         else {
             return null;

package/dist/utils/is-redirect-allowed-on-login.js

@@ -1,9 +1,13 @@
 import { toArray } from '@wbce-d9/utils';
+import { URL } from 'url';
 import env from '../env.js';
 import isUrlAllowed from './is-url-allowed.js';
-function isUrlValid(string) {
+// Sentinel origin that never resolves (RFC 6761): relative paths keep it,
+// anything pointing elsewhere (`//x`, `/\x`, `https://x`) does not.
+const RELATIVE_BASE = 'https://relative.invalid';
+function isUrlValid(url, base) {
     try {
-        new URL(string);
+        new URL(url, base);
         return true;
     }
     catch (err) {
@@ -18,25 +22,20 @@ export function isRedirectAllowedOnLogin(redirect, provider) {
         return true; // empty redirect
     if (typeof redirect !== 'string')
         return false; // invalid type
-    const publicUrl = env['PUBLIC_URL'];
     if (!isUrlValid(redirect)) {
-        if (!redirect.startsWith('//')) {
-            // should be a relative path like `/admin/test`
-            return true;
-        }
-        // domain without protocol `//example.com/test`
-        return false;
+        // relative path like `/admin/test`, allowed unless it resolves to another origin
+        return isUrlValid(redirect, RELATIVE_BASE) && new URL(redirect, RELATIVE_BASE).origin === RELATIVE_BASE;
     }
-    const { protocol: redirectProtocol, hostname: redirectDomain } = new URL(redirect);
+    const { protocol: redirectProtocol, host: redirectHost } = new URL(redirect);
+    const publicUrl = env['PUBLIC_URL'];
     const envKey = `AUTH_${provider.toUpperCase()}_REDIRECT_ALLOW_LIST`;
     if (envKey in env) {
         if (isUrlAllowed(redirect, [...toArray(env[envKey]), publicUrl]))
             return true;
     }
-    if (!isUrlValid(publicUrl)) {
+    if (!isUrlValid(publicUrl))
         return false;
-    }
     // allow redirects to the defined PUBLIC_URL
-    const { protocol: publicProtocol, hostname: publicDomain } = new URL(publicUrl);
-    return `${redirectProtocol}//${redirectDomain}` === `${publicProtocol}//${publicDomain}`;
+    const { protocol: publicProtocol, host: publicHost } = new URL(publicUrl);
+    return redirectProtocol === publicProtocol && redirectHost === publicHost;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.5.9",
+  "version": "12.5.11",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -143,20 +143,20 @@
     "tmp-promise": "3.0.3",
     "tsx": "3.12.6",
     "uuid-validate": "0.0.3",
+    "@wbce-d9/constants": "10.0.0",
     "@wbce-d9/app": "11.0.0",
     "@wbce-d9/exceptions": "10.0.0",
     "@wbce-d9/specs": "9.26.5",
     "@wbce-d9/schema": "10.0.0",
-    "@wbce-d9/extensions-sdk": "10.0.4",
     "@wbce-d9/storage": "10.0.0",
-    "@wbce-d9/constants": "10.0.0",
-    "@wbce-d9/storage-driver-s3": "10.0.3",
-    "@wbce-d9/storage-driver-azure": "10.0.3",
-    "@wbce-d9/update-check": "10.0.4",
-    "@wbce-d9/utils": "10.0.3",
     "@wbce-d9/storage-driver-gcs": "10.0.3",
     "@wbce-d9/storage-driver-cloudinary": "10.0.4",
-    "@wbce-d9/storage-driver-local": "10.0.3"
+    "@wbce-d9/storage-driver-azure": "10.0.3",
+    "@wbce-d9/storage-driver-local": "10.0.3",
+    "@wbce-d9/storage-driver-s3": "10.0.3",
+    "@wbce-d9/extensions-sdk": "10.0.4",
+    "@wbce-d9/update-check": "10.0.4",
+    "@wbce-d9/utils": "10.0.3"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",