@wix/himalaya-cli 0.992.0 → 0.993.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/wix-hosts.d.ts

@@ -0,0 +1,58 @@
+/** Which hosts a WIX-SCOPED dev-server request may be sent to.
+ *
+ *  The dev-server does not merely forward these requests — it ATTACHES CREDENTIALS to them:
+ *  a minted anonymous visitor token, a signed-in member token, the developer's `wixSession2`
+ *  cookie. So the destination is not a detail. A wix-scoped request to any other host is those
+ *  credentials leaving for that host, from a server that binds `0.0.0.0` (it has to, to serve
+ *  simulators and physical devices) with no auth in front of it.
+ *
+ *  The serve plane states the same rule for its own bridge — `core/serve-runtime/src/wix-bridge.ts`
+ *  is "host-locked to www.wixapis.com — absolute URLs are rejected (no open proxy)". The
+ *  dev-server needs the ALLOWLIST form rather than that outright rejection, because absolute
+ *  URLs to other first-party hosts are a real, tested capability here: `users.wix.com` for
+ *  identity, `apps`/`bo`/`manage`/`support`/`www`.wix.com elsewhere in this package, and
+ *  `chat.nownia.com` for the Orion/Genie assistant — `orion-chat`'s `createConversation` sends
+ *  an absolute url there through `wixApi.call`, whose own comment records the contract
+ *  ("forwards this absolute, non-*.wix.com URL untouched"). Rejecting every absolute URL the way
+ *  the serve plane does would break both that and
+ *  "webWixCall preserves absolute Wix URLs for users.wix.com calls".
+ *
+ *  THE LIST IS NOT INVENTED HERE. It mirrors `WixRequestPolicyRules.isFirstPartyWixHost`, which
+ *  both natives already implement identically — `core/runtime/ios/HimalayaCore/Sources/
+ *  HimalayaCore/WixRequestPolicy.swift` and the Kotlin twin under `core/runtime/android`. That is
+ *  the platform's definition of "first party", so the web/dev arm has no business holding a
+ *  narrower one: a host the device may call is a host this bridge may call. `wix-hosts.test.ts`
+ *  pins the two together, so a root added natively cannot silently leave this arm behind — which
+ *  is exactly how `nownia.com` was missed the first time (codebot review on #3120).
+ *
+ *  PARSED, NEVER STRING-MATCHED. `apps/himi-owner-lite/dev/net-mocks.ts` records three spellings
+ *  that defeated an earlier host parse in this repo, and all three are why this reads
+ *  `new URL(...).hostname` instead of testing the raw text:
+ *
+ *    `https://www.wixapis.com@evil.example/x`  userinfo — the host is `evil.example`, and a
+ *                                              `startsWith`/`includes` test says "wixapis".
+ *    `https://www.wix.com\@evil.example/x`     a backslash ENDS THE AUTHORITY for http(s), so
+ *                                              the host really is `www.wix.com` and that is
+ *                                              really where the request goes — a hand-rolled
+ *                                              parser that splits on `/` disagrees.
+ *    `https:///x`                              an empty authority yields no host at all.
+ *
+ *  Judging the PARSED host cannot disagree with the connection that gets made, because `fetch`
+ *  resolves the same string through the same WHATWG parser. A regex over the text can, and that
+ *  divergence is the whole bug class.
+ *
+ *  This is a destination check, NOT an SSRF guard in the `net-guard.ts` sense: it does not
+ *  resolve the name or pin the address, so it does not close DNS rebinding. It does not need to
+ *  — the property wanted here is "these credentials only ever go to Wix", and a name that
+ *  resolves somewhere unexpected is still a name Wix controls. */
+/** Registrable suffixes whose hosts may receive wix-scoped, credential-bearing traffic.
+ *
+ *  Kept in lockstep with the natives' `isFirstPartyWixHost` roots — see the note above. */
+export declare const WIX_HOST_SUFFIXES: readonly ["wix.com", "wixapis.com", "nownia.com"];
+/** The host this url would actually be dialled on, lowercased — or `""` when it has none. */
+export declare function targetHost(raw: string): string;
+/** May a wix-scoped, credential-bearing request go to this url?
+ *
+ *  `https:` only: every legitimate target in this package is https, and a downgrade to `http:`
+ *  would put the very credentials this exists to protect on the wire in clear. */
+export declare function isWixTarget(raw: string): boolean;

package/dist/cli.mjs

@@ -15163,6 +15163,33 @@ var init_derive_transport_capability = __esm({
   }
 });
 
+// ../../core/dev-server/src/wix-hosts.ts
+function targetHost(raw) {
+  try {
+    return new URL(raw).hostname.toLowerCase();
+  } catch {
+    return "";
+  }
+}
+function isWixTarget(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:") return false;
+  const host = url.hostname.toLowerCase();
+  if (!host) return false;
+  return WIX_HOST_SUFFIXES.some((suffix) => host === suffix || host.endsWith(`.${suffix}`));
+}
+var WIX_HOST_SUFFIXES;
+var init_wix_hosts = __esm({
+  "../../core/dev-server/src/wix-hosts.ts"() {
+    WIX_HOST_SUFFIXES = ["wix.com", "wixapis.com", "nownia.com"];
+  }
+});
+
 // ../../core/dev-server/src/wix-member-login.ts
 var wix_member_login_exports = {};
 __export(wix_member_login_exports, {
@@ -15287,6 +15314,9 @@ async function memberDirectRegister(clientId, redirectUri, email, password, firs
 }
 async function webWixCall(method, path, body, token, cookie, forwardedHeaders = {}) {
   const url = /^https?:\/\//i.test(path) ? path : `${API}${path.startsWith("/") ? path : "/" + path}`;
+  if (!isWixTarget(url)) {
+    throw new Error(`refusing to send Wix credentials to a non-Wix host (${targetHost(url) || "no host"})`);
+  }
   const res = await fetch(url, {
     method,
     headers: {
@@ -15302,6 +15332,7 @@ async function webWixCall(method, path, body, token, cookie, forwardedHeaders =
 var API;
 var init_wix_member_login = __esm({
   "../../core/dev-server/src/wix-member-login.ts"() {
+    init_wix_hosts();
     API = "https://www.wixapis.com";
   }
 });
@@ -18867,6 +18898,7 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
+    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -22291,6 +22323,7 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
+    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.992.0",
+  "version": "0.993.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -65,5 +65,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "cbd96ed65b504cab0c2d276b2a961b73f9bf6730d07259f3d334a43e"
+  "falconPackageHash": "65760e4588c44ee36e6538fcc1bf8802e544b4045157544b3f4d0d94"
 }