domma-cms 1.6.60 → 1.7.0

package/docs/pentest-report-2026-04-03.md

@@ -0,0 +1,181 @@
+# Penetration Test Report - Domma CMS
+
+**Date:** 2026-04-03  
+**Scope:** domma-cms (localhost:4096) and domma-cms-manager (localhost:8192)  
+**Tester:** Claude Code (authorised, internal pen test)  
+**Method:** Black-box HTTP + grey-box (source review where required)
+
+---
+
+## Executive Summary
+
+The application has a solid authentication and authorisation foundation. All unauthenticated access to protected
+resources was correctly blocked. Path traversal is detected and rejected server-side. However, four actionable findings
+were identified that should be addressed before the application is exposed to the public internet.
+
+---
+
+## Findings
+
+### FIND-01 - Stored XSS in Page Title (Reflected in Public `<title>` tag)
+
+**Severity:** High  
+**Affects:** Both 4096 and 8192 (shared codebase)
+
+**Endpoint:** `POST /api/pages`  
+**Method:** POST (authenticated)  
+**Payload:**
+
+```json
+{
+  "urlPath": "xss-pentest2",
+  "frontmatter": { "title": "<script>alert(1)</script>", "status": "published" },
+  "body": "<img src=x onerror=alert(2)>"
+}
+```
+
+**Response (API):** 201 - title stored verbatim: `"title":"<script>alert(1)</script>"`  
+**Response (public render):** 200 - raw script tag appears in `<title>` element of SSR HTML:
+
+```html
+<title><script>alert(1)</script> | My Nice Little Super Blog!</title>
+```
+
+**Impact:** Any admin/editor who creates a page with a script tag in the title causes that script to execute in the
+browser of any visitor to that page. The body `onerror` payload is also stored unescaped in the API response, though the
+SSR renderer may escape it in the body context (only the `<title>` injection was confirmed to execute).
+
+**Recommendation:**
+
+- HTML-encode page titles before inserting into the `<title>` tag in `server/templates/page.html` and
+  `server/services/renderer.js`. Use `title.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;')`.
+- Sanitise all frontmatter string fields on write in `server/services/content.js` before persisting.
+- Consider a Content Security Policy (`Content-Security-Policy: default-src 'self'`) header on all public responses.
+
+---
+
+### FIND-02 - No Rate Limiting on Login Endpoint
+
+**Severity:** High  
+**Affects:** Both 4096 and 8192
+
+**Endpoint:** `POST /api/auth/login`  
+**Method:** POST  
+**Payload:** `{"email":"admin@dwit.uk","password":"wrongpassword"}` × 20 rapid requests  
+**Response:** 20 × 401 - no 429, no delay, no lockout observed.
+
+**Impact:** The login endpoint accepts unlimited password attempts. A targeted brute-force or credential-stuffing attack
+against known email addresses (which are enumerable if an attacker has admin access, or guessable) faces no automated
+defence.
+
+**Recommendation:**
+
+- Add `@fastify/rate-limit` to the Fastify instance, scoped to `POST /api/auth/login` (e.g. max 10 attempts per IP per
+  15 minutes).
+- Optionally implement account lockout after N consecutive failures per email, with unlock by admin or timed expiry.
+- Log and alert on repeated login failures.
+
+---
+
+### FIND-03 - Content-Type Spoofing on Media Upload (HTML stored as JPEG)
+
+**Severity:** Medium  
+**Affects:** Both 4096 and 8192
+
+**Endpoint:** `POST /api/media`  
+**Method:** POST (authenticated)  
+**Payload:** Multipart upload - filename `evil.jpg`, `Content-Type: image/jpeg`, body is
+`<html><body><script>alert('xss')</script></body></html>`  
+**Response:** 201 `{"name":"evil.jpg","url":"/media/evil.jpg"}`  
+**Follow-up:** `GET /media/evil.jpg` → 200, `Content-Type: image/jpeg`, body is the raw HTML.
+
+**Impact:** The server trusts the client-supplied `Content-Type` and file extension without inspecting the actual file
+content (magic bytes / file signature). An authenticated user can store an HTML file disguised as an image. When another
+user or browser fetches `/media/evil.jpg`, modern browsers will sniff the content and may render it as HTML (especially
+if `X-Content-Type-Options: nosniff` is absent), enabling stored XSS via the media path.
+
+**Note:** `.html` files with `Content-Type: text/html` are correctly blocked (400). Only the extension/MIME-spoof path
+is vulnerable.
+
+**Recommendation:**
+
+- Inspect file magic bytes on upload (e.g. using the `file-type` npm package) and reject files whose content does not
+  match their declared type.
+- Add the `X-Content-Type-Options: nosniff` response header to all static media responses - this is the primary
+  mitigation and is a single-line Fastify config change.
+- Enforce an allowlist of magic-byte signatures for accepted image types.
+
+---
+
+### FIND-04 - Internal Path Disclosed in 500 Error (Long Filename)
+
+**Severity:** Low  
+**Affects:** Both 4096 and 8192
+
+**Endpoint:** `POST /api/media`  
+**Method:** POST (authenticated)  
+**Payload:** Multipart upload with filename of 500 `A` characters + `.jpg`  
+**Response:** 500
+
+```json
+{"error":"ENAMETOOLONG: name too long, open 'content/media/AAAA...'"}
+```
+
+**Impact:** The raw Node.js filesystem error is passed directly to the client, disclosing the relative server-side
+storage path (`content/media/`). This aids an attacker in understanding the directory structure if combined with other
+vulnerabilities.
+
+**Recommendation:**
+
+- Validate filename length before attempting filesystem operations (e.g. reject filenames over 200 characters).
+- Catch filesystem errors in the media upload handler and return a generic `{"error":"Upload failed"}` without including
+  the raw error message.
+
+---
+
+## Findings Requiring No Action (Passed)
+
+| Test                                                                                   | Result                                                                          |
+|----------------------------------------------------------------------------------------|---------------------------------------------------------------------------------|
+| Unauthenticated access to `/api/users`, `/api/pages`, `/api/collections`, `/api/media` | Correctly blocked - 401                                                         |
+| `POST /api/auth/setup` after setup complete                                            | Correctly blocked - 403                                                         |
+| Expired JWT                                                                            | Correctly rejected - 401                                                        |
+| JWT with `alg:none`                                                                    | Correctly rejected - 401                                                        |
+| Refresh token used as access token                                                     | Correctly rejected - 401 (`Invalid token type`)                                 |
+| Path traversal in page GET/POST (`..%2F..%2Fconfig`, `../../../etc/passwd`)            | Detected and rejected - 500 `Invalid path: outside content directory`           |
+| SQL injection in login fields                                                          | No effect - 401                                                                 |
+| Very long strings in login                                                             | No effect - 401                                                                 |
+| NoSQL injection in collection query (`?filter[$where]=1==1`)                           | No effect - empty result set returned                                           |
+| Prototype pollution in POST body (`__proto__`)                                         | Rejected - 400 invalid JSON                                                     |
+| Subscriber role blocked from admin endpoints                                           | Correctly blocked - 403                                                         |
+| Password hashes exposed in `/api/users` list                                           | Not present (good)                                                              |
+| `GET /.env`                                                                            | 404 (not statically served)                                                     |
+| `GET /config/server.json`                                                              | 404 (not statically served)                                                     |
+| `GET /admin/../../../package.json`                                                     | 403 Forbidden                                                                   |
+| CORS - arbitrary origin reflected                                                      | Not reflected (no `Access-Control-Allow-Origin` header set for unknown origins) |
+| TRACE method                                                                           | 404 (method not registered, not echoed)                                         |
+| `.html` file upload                                                                    | Correctly blocked - 400                                                         |
+| SSTI (`{{7*7}}`, `${7*7}`) in content                                                  | Not evaluated - stored/rendered as literal text                                 |
+
+---
+
+## Prioritised Summary Table
+
+| # | ID      | Severity   | Category        | Finding                                                         | Effort to Fix |
+|---|---------|------------|-----------------|-----------------------------------------------------------------|---------------|
+| 1 | FIND-01 | **High**   | XSS             | Script tag in page title rendered unescaped in public `<title>` | Low           |
+| 2 | FIND-02 | **High**   | Auth            | No rate limiting on login endpoint - brute-force possible       | Low           |
+| 3 | FIND-03 | **Medium** | Upload          | HTML file uploaded as JPEG, served from media path              | Low-Medium    |
+| 4 | FIND-04 | **Low**    | Info Disclosure | Internal filesystem path leaked in 500 error on long filename   | Low           |
+
+---
+
+## Notes
+
+- **JWT secret in `.env`:** The JWT secret is stored in `.env` which is not statically served (correctly). Ensure `.env`
+  is in `.gitignore` and never committed.
+- **`type: 'access'` check in JWT:** The middleware correctly rejects tokens that lack `type: 'access'`, which prevents
+  refresh tokens being used as access tokens. This is good practice.
+- **8192 (domma-cms-manager):** Spot-checked and behaves identically to 4096 on auth, CORS, and rate limiting - all
+  findings above apply equally to both instances.
+- **Test artefacts:** All pages, media, and collections created during testing have been deleted.

package/docs/plans/2026-02-28-admin-topbar-login-forms.md

@@ -0,0 +1,349 @@
+# Admin Topbar & Login Form Refactor - Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
+
+**Goal:** Replace the hacky Domma navbar with a proper custom `<header>` topbar showing brand icon + user info on the left and Settings/Sign out on the right; also rewrite both login and setup forms to use Domma's `F.render()` blueprint-driven API.
+
+**Architecture:** The admin panel already has a sidebar for navigation, so the topbar is pure chrome - brand identity + session info. We replace `Domma.elements.navbar()` with a hand-crafted `<header id="admin-topbar">` rendered via admin.css flexbox. The login/setup forms are replaced with `F.render()` calls using blueprints; the onboarding wizard panels (site identity, theme picker) stay as custom HTML since they are not standard forms.
+
+**Tech Stack:** Domma `F.render()`, `I.scan()`, `E.toast()`, admin.css custom styles, ESM view modules.
+
+---
+
+### Task 1: Update `admin/index.html` - replace nav with header
+
+**Files:**
+- Modify: `admin/index.html`
+
+The current `<nav id="admin-navbar">` uses `Domma.elements.navbar()` and gets a chip appended after auth. Replace it with a structured `<header>` that has two permanent sub-regions JS will populate.
+
+**Step 1: Replace the nav element**
+
+Change:
+```html
+<!-- Top Navbar -->
+<nav id="admin-navbar"></nav>
+```
+
+To:
+```html
+<!-- Top Bar -->
+<header id="admin-topbar">
+    <div class="topbar-brand">
+        <span data-icon="layout"></span>
+        <span class="topbar-brand-text">Domma CMS</span>
+    </div>
+    <div class="topbar-user" id="topbar-user">
+        <!-- Populated after auth: name + role badge -->
+    </div>
+    <div class="topbar-actions" id="topbar-actions">
+        <!-- Populated after auth: Settings link + Sign out -->
+    </div>
+</header>
+```
+
+**Step 2: Verify**
+
+Open `admin/index.html` and confirm the `<nav>` is gone and the `<header>` has the three child divs with correct IDs.
+
+---
+
+### Task 2: Update `admin/js/app.js` - remove navbar init, rewrite user injection
+
+**Files:**
+- Modify: `admin/js/app.js`
+
+**Step 1: Remove the Domma navbar call**
+
+Delete the entire `Domma.elements.navbar(...)` block (lines ~16-22 currently). It is no longer needed.
+
+**Step 2: Rewrite `injectUserMenu()`**
+
+Replace the current `injectUserMenu()` function with one that targets the new `#topbar-user` and `#topbar-actions` divs properly, and is fully idempotent:
+
+```javascript
+function injectUserMenu() {
+    const user = getUser();
+    if (!user) return;
+    if ($('#topbar-user-name').length) return; // already injected
+
+    const roleLabelMap = {
+        admin: 'Admin', manager: 'Manager', editor: 'Editor', subscriber: 'Subscriber'
+    };
+    const roleLabel = roleLabelMap[user.role] || user.role;
+
+    $('#topbar-user').html(`
+        <span id="topbar-user-name" class="topbar-user-name">${escapeHtml(user.name)}</span>
+        <span class="topbar-role-badge topbar-role-badge--${user.role}">${roleLabel}</span>
+    `);
+
+    $('#topbar-actions').html(`
+        <a href="#/settings" class="topbar-action-link">
+            <span data-icon="settings"></span>
+            <span>Settings</span>
+        </a>
+        <button id="topbar-logout-btn" class="btn btn-sm btn-ghost topbar-signout">
+            <span data-icon="log-out"></span>
+            <span>Sign out</span>
+        </button>
+    `);
+
+    $('#topbar-logout-btn').on('click', () => logout());
+    Domma.icons.scan('#admin-topbar');
+}
+```
+
+**Step 3: Update the login page `onEnter` hide/show references**
+
+Currently: `$('#admin-navbar').hide()` / `$('#admin-navbar').show()`
+Change both to: `$('#admin-topbar').hide()` / `$('#admin-topbar').show()`
+
+**Step 4: Verify**
+
+Check `app.js` has no remaining references to `admin-navbar` or `Domma.elements.navbar`.
+
+---
+
+### Task 3: Add topbar CSS to `admin/css/admin.css`
+
+**Files:**
+- Modify: `admin/css/admin.css`
+
+Add the following styles before the `/* Login / setup page */` section. The topbar must be exactly 60px tall - the sidebar already uses `top: '60px'` as its offset.
+
+```css
+/* ── Admin Top Bar ──────────────────────────────── */
+#admin-topbar {
+    height: 60px;
+    display: flex;
+    align-items: center;
+    gap: 1rem;
+    padding: 0 1.25rem;
+    background: var(--navbar-bg, rgba(0,0,0,.3));
+    border-bottom: 1px solid var(--border-color, rgba(255,255,255,.08));
+    position: sticky;
+    top: 0;
+    z-index: 200;
+    flex-shrink: 0;
+}
+
+.topbar-brand {
+    display: flex;
+    align-items: center;
+    gap: .5rem;
+    font-weight: 700;
+    font-size: .95rem;
+    text-decoration: none;
+    color: inherit;
+    flex-shrink: 0;
+    margin-right: .5rem;
+}
+
+.topbar-brand span[data-icon],
+.topbar-brand svg {
+    color: var(--primary, #5b8cff);
+    width: 22px;
+    height: 22px;
+}
+
+.topbar-brand-text {
+    opacity: .85;
+}
+
+/* User info - sits immediately after brand */
+.topbar-user {
+    display: flex;
+    align-items: center;
+    gap: .6rem;
+    flex: 1;  /* pushes actions to RHS */
+}
+
+.topbar-user-name {
+    font-size: .875rem;
+    font-weight: 500;
+}
+
+.topbar-role-badge {
+    font-size: .7rem;
+    font-weight: 600;
+    letter-spacing: .04em;
+    text-transform: uppercase;
+    padding: .15rem .45rem;
+    border-radius: 4px;
+    background: var(--primary-alpha, rgba(91,140,255,.15));
+    color: var(--primary, #5b8cff);
+}
+
+/* Role-specific badge colours */
+.topbar-role-badge--admin      { background: rgba(91,140,255,.15); color: #5b8cff; }
+.topbar-role-badge--manager    { background: rgba(52,211,153,.15);  color: #34d399; }
+.topbar-role-badge--editor     { background: rgba(251,191,36,.15);  color: #fbbf24; }
+.topbar-role-badge--subscriber { background: rgba(148,163,184,.15); color: #94a3b8; }
+
+/* Actions - RHS */
+.topbar-actions {
+    display: flex;
+    align-items: center;
+    gap: .5rem;
+    flex-shrink: 0;
+}
+
+.topbar-action-link {
+    display: flex;
+    align-items: center;
+    gap: .35rem;
+    font-size: .875rem;
+    color: var(--text-muted, #888);
+    text-decoration: none;
+    padding: .4rem .65rem;
+    border-radius: 6px;
+    transition: color .15s, background .15s;
+}
+
+.topbar-action-link:hover {
+    color: var(--text, #eee);
+    background: rgba(255,255,255,.06);
+}
+
+.topbar-action-link svg,
+.topbar-action-link span[data-icon] {
+    width: 16px;
+    height: 16px;
+}
+
+.topbar-signout {
+    display: flex;
+    align-items: center;
+    gap: .35rem;
+    font-size: .875rem;
+}
+
+.topbar-signout svg,
+.topbar-signout span[data-icon] {
+    width: 16px;
+    height: 16px;
+}
+```
+
+**Step 5: Verify**
+
+No visual verification needed at this step - just check CSS was added without breaking existing selectors.
+
+---
+
+### Task 4: Rewrite login/setup forms to use `F.render()`
+
+**Files:**
+- Modify: `admin/js/templates/login.html`
+- Modify: `admin/js/views/login.js`
+
+#### 4a - Simplify `login.html`
+
+Replace the manual form inputs in `#setup-panel` and `#login-panel` with bare containers. The onboarding panels (site identity, theme picker, done) are **not** touched - they are wizard UI, not forms.
+
+`#setup-panel` becomes:
+```html
+<div id="setup-panel" style="display:none">
+    <h2 class="login-heading">Welcome - create your admin account</h2>
+    <p class="text-muted mb-4">First-time setup. Create your administrator account to get started.</p>
+    <div id="setup-form-container"></div>
+</div>
+```
+
+`#login-panel` becomes:
+```html
+<div id="login-panel" style="display:none">
+    <h2 class="login-heading">Sign in</h2>
+    <div id="login-form-container"></div>
+</div>
+```
+
+#### 4b - Rewrite `login.js` - define blueprints and use `F.render()`
+
+Define both blueprints at the module level (above the view export):
+
+```javascript
+const setupBlueprint = {
+    name:     { type: 'string',   required: true, minLength: 1, label: 'Full name',
+                formConfig: { placeholder: 'Your name', autocomplete: 'name' } },
+    email:    { type: 'email',    required: true,               label: 'Email address',
+                formConfig: { placeholder: 'admin@example.com', autocomplete: 'email' } },
+    password: { type: 'password', required: true, minLength: 8, label: 'Password (min. 8 characters)',
+                formConfig: { placeholder: '••••••••', autocomplete: 'new-password' } }
+};
+
+const loginBlueprint = {
+    email:    { type: 'email',    required: true, label: 'Email address',
+                formConfig: { placeholder: 'you@example.com', autocomplete: 'email' } },
+    password: { type: 'password', required: true, label: 'Password',
+                formConfig: { placeholder: '••••••••', autocomplete: 'current-password' } }
+};
+```
+
+Replace `bindSetup()` with an `F.render()` call:
+
+```javascript
+function bindSetup($container) {
+    F.render('#setup-form-container', setupBlueprint, {}, {
+        layout: 'stacked',
+        submitText: 'Create admin account',
+        onSubmit: async (data) => {
+            try {
+                const result = await api.auth.setup(data);
+                setAuthData(result);
+                showStep($container, 'onboarding-site');
+                bindOnboardingSite($container);
+            } catch (err) {
+                E.toast(err.message || 'Setup failed. Please try again.', { type: 'danger' });
+            }
+            return false; // prevent default form reset
+        }
+    });
+}
+```
+
+Replace `bindLogin()` with an `F.render()` call:
+
+```javascript
+function bindLogin($container) {
+    F.render('#login-form-container', loginBlueprint, {}, {
+        layout: 'stacked',
+        submitText: 'Sign in',
+        onSubmit: async (data) => {
+            try {
+                const result = await api.auth.login(data);
+                setAuthData(result);
+                R.navigate('/');
+            } catch (err) {
+                E.toast(err.message || 'Invalid credentials. Please try again.', { type: 'danger' });
+            }
+            return false;
+        }
+    });
+}
+```
+
+Remove the now-unused `showError()` helper and all manual `$container.find('#...-error')` / `val()` / `prop('disabled')` code - `F.render()` handles validation display and button state internally.
+
+---
+
+### Task 5: Check the `log-out` icon exists in Domma
+
+**Files:** Read-only check.
+
+The topbar actions use `data-icon="log-out"`. Domma's icon set (200+ icons) includes `log-out` in the Security category. If running and icon doesn't render, fall back to `data-icon="x-circle"` or `data-icon="power"`.
+
+No code change needed unless icon is missing - verify visually after boot.
+
+---
+
+### Verification Checklist
+
+1. Start server: `npm start`
+2. Visit `http://localhost:4096/admin/`
+3. Redirects to `#/login` - login panel shows (F.render form, no raw inputs)
+4. Log in - topbar appears: `[layout icon] [Domma CMS] [name] [admin badge] ──── [⚙ Settings] [↩ Sign out]`
+5. Role badge colour matches role (admin = blue)
+6. Settings link navigates to `#/settings`
+7. Sign out clears tokens and returns to `#/login`
+8. On first run (no users): setup form via F.render → onboarding wizard → dashboard with topbar