@wrongstack/webui 0.7.5 → 0.7.7

package/dist/server/index.js

@@ -366,7 +366,7 @@ async function startWebUI(opts = {}) {
     };
   }
   const wsToken = randomBytes(16).toString("hex");
-  console.log(`[WebUI] WS auth token: ${wsToken}`);
+  console.log(`[WebUI] WS auth token: ${wsToken.slice(0, 4)}\u2026${wsToken.slice(-4)} (masked)`);
   const isLoopback = (hostname) => hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
   const verifyClient = (info) => {
     const origin = info.origin;
@@ -1522,20 +1522,38 @@ async function startWebUI(opts = {}) {
       } else {
         filePath = path.join(DIST_DIR, "index.html");
       }
-      const ext = path.extname(filePath);
+      const resolvedPath = path.resolve(filePath);
+      const resolvedRoot = path.resolve(DIST_DIR);
+      if (!resolvedPath.startsWith(resolvedRoot + path.sep) && resolvedPath !== resolvedRoot) {
+        res.writeHead(403, { "Content-Type": "text/plain" });
+        res.end("Forbidden");
+        return;
+      }
+      const ext = path.extname(resolvedPath);
       const contentType = mimeTypes[ext] ?? "application/octet-stream";
       res.setHeader("Content-Type", contentType);
+      res.setHeader("X-Content-Type-Options", "nosniff");
+      res.setHeader("X-Frame-Options", "DENY");
+      res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
       if (ext === ".html") {
         res.setHeader("Cache-Control", "no-cache");
+        res.setHeader(
+          "Content-Security-Policy",
+          "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self' ws: wss:; img-src 'self' data:; font-src 'self' data:"
+        );
       }
-      const fileContent = await fs2.readFile(filePath);
+      const fileContent = await fs2.readFile(resolvedPath);
       res.writeHead(200);
       res.end(fileContent);
     } catch (err) {
       if (err.code === "ENOENT") {
         try {
           const fileContent = await fs2.readFile(path.join(DIST_DIR, "index.html"));
-          res.writeHead(200, { "Content-Type": "text/html" });
+          res.writeHead(200, {
+            "Content-Type": "text/html",
+            "X-Content-Type-Options": "nosniff",
+            "X-Frame-Options": "DENY"
+          });
           res.end(fileContent);
         } catch {
           res.writeHead(404);