domma-cms 1.8.13 → 1.8.15

package/server/services/mongoQueryGuard.js

@@ -0,0 +1,193 @@
+/**
+ * The one gate between a user-shaped query and MongoDB.
+ *
+ * Site users shape queries in many places - saved views and the view editor,
+ * the `[view]` and `[collection]` shortcodes, collection filters, `/api/v1`
+ * query parameters, API Builder endpoints. Every one of them reaches MongoDB
+ * through one of two translations, and both go through this module:
+ *
+ *   - a structured filter -> `toSafeMongoQuery()` (MongoAdapter.list)
+ *   - a view pipeline     -> `toSafeMongoPipeline()` (views.executeMongoView)
+ *
+ * Refused, at any depth (inside nested objects and arrays, `$lookup`
+ * sub-pipelines, `$expr`, `$group`...):
+ *
+ *   - anything that runs JavaScript inside the database server: `$where`,
+ *     `$function`, `$accumulator`, `$code`, and BSON Code values;
+ *   - anything that writes, or reads outside the site's own collections:
+ *     `$out`, `$merge`, `$unionWith`, `$graphLookup`, the server-state stages
+ *     (`$currentOp`, `$collStats`, ...), and a `$lookup` that is not into one
+ *     of this site's `cms_<slug>` collections (no cross-database form);
+ *   - keys named `__proto__`, `constructor` or `prototype`.
+ *
+ * Plain operators (`$eq`, `$gt`, `$in`, `$regex`, `$expr` with ordinary
+ * expressions, `$group` with `$sum`...) pass untouched.
+ *
+ * @module services/mongoQueryGuard
+ */
+import {toMongoQuery} from './filterEngine.js';
+
+/** Operators that execute code on the database server. */
+export const CODE_OPERATORS = Object.freeze(['$where', '$function', '$accumulator', '$code', '$mapReduce']);
+
+/** Operators that write, or reach data or server state beyond the site's collections. */
+export const REACH_OPERATORS = Object.freeze([
+    '$out', '$merge', '$unionWith', '$graphLookup', '$documents',
+    '$currentOp', '$listSessions', '$listLocalSessions', '$collStats', '$indexStats',
+    '$planCacheStats', '$changeStream', '$listSearchIndexes', '$listSampledQueries', '$querySettings'
+]);
+
+const PROTOTYPE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+const REFUSED = new Set([...CODE_OPERATORS, ...REACH_OPERATORS].map(k => k.toLowerCase()));
+const SITE_SLUG = /^[a-z0-9][a-z0-9_-]*$/;
+const MAX_DEPTH = 64;
+
+export class UnsafeQueryError extends Error {
+    constructor(message) {
+        super(message);
+        this.code = 'EUNSAFE_QUERY';
+        this.statusCode = 400;
+    }
+}
+
+/**
+ * Throw when a query, pipeline or any part of one could run code or reach
+ * outside the site's own collections.
+ *
+ * @param {unknown} value
+ * @param {object} [opts]
+ * @param {Set<string>|string[]} [opts.collections] - the site's collection slugs; when given, a `$lookup` must name one
+ * @param {string} [opts.prefix='cms_'] - the MongoDB name prefix of a site collection
+ * @returns {unknown} the same value, for chaining
+ */
+export function assertSafeMongoQuery(value, opts = {}) {
+    const known = opts.collections ? new Set(opts.collections) : null;
+    const prefix = opts.prefix ?? 'cms_';
+    const seen = new Set();
+
+    const walk = (node, at, depth) => {
+        if (node === null || typeof node !== 'object') {
+            if (typeof node === 'function') throw new UnsafeQueryError(`${at || 'The query'} is a function - not allowed in a query.`);
+            return;
+        }
+        if (depth > MAX_DEPTH) throw new UnsafeQueryError('The query is nested too deeply.');
+        if (seen.has(node)) return;
+        seen.add(node);
+        // A BSON Code value runs as JavaScript wherever the server accepts one.
+        if (String(node._bsontype || '').toLowerCase().startsWith('code')) {
+            throw new UnsafeQueryError(`${at || 'The query'} holds JavaScript code - not allowed in a query.`);
+        }
+        if (Array.isArray(node)) {
+            node.forEach((item, i) => walk(item, `${at}[${i}]`, depth + 1));
+            return;
+        }
+        // Own keys, including a `__proto__` key that JSON.parse makes an own property.
+        for (const key of Reflect.ownKeys(node)) {
+            if (typeof key !== 'string') continue;
+            const here = at ? `${at}.${key}` : key;
+            const lower = key.toLowerCase();
+            // A dotted path ('data.x.__proto__', 'a.$where') is checked a part at a time.
+            for (const part of key.split('.')) {
+                if (PROTOTYPE_KEYS.has(part)) throw new UnsafeQueryError(`"${part}" is not allowed as a name in a query (at ${here}).`);
+                const p = part.toLowerCase();
+                if (REFUSED.has(p)) {
+                    throw new UnsafeQueryError(`${part} is not allowed in a query - it ${CODE_OPERATORS.some(k => k.toLowerCase() === p) ? 'runs code on the database server' : 'reaches beyond this site\'s own collections'} (at ${here}).`);
+                }
+            }
+            const child = node[key];
+            if (lower === '$lookup') checkLookup(child, here, known, prefix);
+            walk(child, here, depth + 1);
+        }
+    };
+
+    walk(value, '', 0);
+    return value;
+}
+
+function checkLookup(config, at, known, prefix) {
+    if (!config || typeof config !== 'object' || Array.isArray(config)) throw new UnsafeQueryError(`$lookup needs an object (at ${at}).`);
+    const from = config.from;
+    if (typeof from !== 'string') {
+        throw new UnsafeQueryError(`$lookup may only join one of this site's collections, named as text - not another database (at ${at}.from).`);
+    }
+    // `cms_<slug>` or the bare `<slug>` (the file evaluator accepts both; the
+    // MongoDB translation prefixes a bare one), never `cms__` meta stores.
+    const slug = from.startsWith(prefix) ? from.slice(prefix.length) : from;
+    if (!SITE_SLUG.test(slug)) {
+        throw new UnsafeQueryError(`$lookup may only join one of this site's collections - "${from}" is not one (at ${at}.from).`);
+    }
+    if (known && !known.has(slug)) {
+        throw new UnsafeQueryError(`$lookup names "${from}", which is not a collection on this site (at ${at}.from).`);
+    }
+}
+
+/**
+ * A structured filter (filterEngine DSL) as a MongoDB query - refused when it
+ * would carry anything `assertSafeMongoQuery` refuses.
+ *
+ * @param {Record<string, unknown>|undefined} filter
+ * @returns {object}
+ */
+export function toSafeMongoQuery(filter) {
+    if (!filter) return {};
+    assertSafeMongoQuery(filter);
+    return assertSafeMongoQuery(toMongoQuery(filter));
+}
+
+/**
+ * Every `$lookup` target named in a (checked) pipeline, at any depth.
+ *
+ * @param {unknown} value
+ * @returns {string[]} the `from` collection names
+ */
+export function lookupTargets(value) {
+    const out = new Set();
+    const walk = (node) => {
+        if (!node || typeof node !== 'object') return;
+        if (Array.isArray(node)) return node.forEach(walk);
+        for (const [k, v] of Object.entries(node)) {
+            if (k === '$lookup' && typeof v?.from === 'string') out.add(v.from);
+            walk(v);
+        }
+    };
+    walk(value);
+    return [...out];
+}
+
+/**
+ * Stage descriptors (`{type, config}`) as a MongoDB aggregation pipeline,
+ * refused when any stage would carry anything `assertSafeMongoQuery` refuses.
+ *
+ * @param {object[]} stages
+ * @param {object} [opts]
+ * @param {Set<string>|string[]} [opts.collections] - the site's collection slugs
+ * @param {(slug: string) => Promise<boolean>} [opts.collectionExists] - asked for each `$lookup` target
+ * @returns {Promise<object[]>}
+ */
+export async function toSafeMongoPipeline(stages, opts = {}) {
+    const pipeline = (Array.isArray(stages) ? stages : []).map(stage => {
+        const type = String(stage?.type || '');
+        if (PROTOTYPE_KEYS.has(type)) throw new UnsafeQueryError(`"${type}" is not a stage.`);
+        return {[type]: stage.config};
+    });
+    assertSafeMongoQuery(pipeline, opts);
+    // A copy, so the saved view is not rewritten: every $lookup names its cms_ collection.
+    const out = structuredClone(pipeline);
+    const prefixLookups = (node) => {
+        if (!node || typeof node !== 'object') return;
+        if (Array.isArray(node)) return node.forEach(prefixLookups);
+        for (const [k, v] of Object.entries(node)) {
+            if (k === '$lookup' && typeof v?.from === 'string' && !v.from.startsWith('cms_')) v.from = `cms_${v.from}`;
+            prefixLookups(v);
+        }
+    };
+    prefixLookups(out);
+    if (opts.collectionExists) {
+        for (const from of lookupTargets(out)) {
+            if (!(await opts.collectionExists(from.slice('cms_'.length)))) {
+                throw new UnsafeQueryError(`$lookup names "${from}", which is not a collection on this site.`);
+            }
+        }
+    }
+    return out;
+}

package/server/services/outbound.js

@@ -0,0 +1,394 @@
+/**
+ * Outbound requests to addresses a site user chose - without becoming a way
+ * into the server's own network (SSRF).
+ *
+ * Every server-side request whose URL a site user can set goes through
+ * `safeFetch()` here: Actions' webhook step, a form's webhook, and any plugin
+ * that fetches a user's URL through core. The WordPress importer's media
+ * downloader (wpImport/fetch.js) uses the same address rules and pinned
+ * connection, with its own host list on top.
+ *
+ *  - http(s) only, no user name or password in the address, ports 80 and 443.
+ *  - The host name is resolved first, and EVERY address it resolves to must be
+ *    public: loopback, private, link-local (cloud metadata lives at
+ *    169.254.169.254), CGNAT, multicast, reserved and documentation ranges are
+ *    refused, IPv4-mapped and NAT64 IPv6 forms included - and so is every
+ *    address of this server's own interfaces, public ones too. The WHATWG URL
+ *    parser has already turned decimal, octal and hex IPv4 spellings
+ *    (http://2130706433/, http://0177.0.0.1/) into dotted form, so they are
+ *    checked as the address they are.
+ *  - The connection goes to the address that was checked (a pinned lookup), so
+ *    a second DNS answer cannot swap in an internal one (DNS rebinding).
+ *  - Redirects are followed at most three times, each one checked as above.
+ *  - A time limit for the whole request and a cap on the answer's size.
+ *
+ * Self-hosted sites that need internal targets (a webhook to n8n on the LAN)
+ * set `outboundAllowPrivate` in config/server.json: `true` lifts the address
+ * and port rules for every request, a list of host names, addresses and CIDR
+ * ranges lifts them for those only. It is IGNORED on a signed-only site
+ * (codePolicy.signedOnly() - every site a Manager hosts), because there the
+ * site's admin is a customer, not the owner of the network.
+ *
+ * @module services/outbound
+ */
+import dns from 'node:dns';
+import http from 'node:http';
+import https from 'node:https';
+import net from 'node:net';
+import os from 'node:os';
+import {getConfig} from '../config.js';
+import {signedOnly} from './codePolicy.js';
+
+export const FETCH_PORTS = Object.freeze([80, 443]);
+
+export const OUTBOUND_LIMITS = Object.freeze({maxBytes: 1024 * 1024, timeoutMs: 15_000, maxRedirects: 3});
+
+export class FetchRefused extends Error {
+    constructor(message) { super(message); this.code = 'EREFUSED_SSRF'; }
+}
+
+/** The port an address would be fetched on. */
+export function portOf(raw) {
+    try { const u = new URL(raw); return u.port ? Number(u.port) : (u.protocol === 'https:' ? 443 : 80); } catch { return 0; }
+}
+
+// ---------------------------------------------------------------------------
+// Addresses
+// ---------------------------------------------------------------------------
+
+const V4_BLOCKED = [
+    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8], ['169.254.0.0', 16], ['172.16.0.0', 12],
+    ['192.0.0.0', 24], ['192.0.2.0', 24], ['192.88.99.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15],
+    ['198.51.100.0', 24], ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4]
+];
+
+function v4ToInt(ip) {
+    const p = String(ip).split('.').map(Number);
+    if (p.length !== 4 || p.some(n => !Number.isInteger(n) || n < 0 || n > 255)) return null;
+    return ((p[0] << 24) >>> 0) + (p[1] << 16) + (p[2] << 8) + p[3];
+}
+
+function v4InRange(n, base, bits) {
+    const mask = bits === 0 ? 0 : (~0 << (32 - bits)) >>> 0;
+    return ((n & mask) >>> 0) === ((v4ToInt(base) & mask) >>> 0);
+}
+
+function v4Blocked(ip) {
+    const n = v4ToInt(ip);
+    if (n === null) return true;
+    return V4_BLOCKED.some(([base, bits]) => v4InRange(n, base, bits));
+}
+
+/** Expand an IPv6 address to 8 groups of numbers (null when it is not one). */
+function v6Groups(ip) {
+    let s = String(ip).toLowerCase().split('%')[0];
+    // A dotted IPv4 tail (::ffff:1.2.3.4).
+    const tail = /(\d+\.\d+\.\d+\.\d+)$/.exec(s);
+    if (tail) {
+        const n = v4ToInt(tail[1]);
+        if (n === null) return null;
+        s = s.slice(0, -tail[1].length) + `${(n >>> 16).toString(16)}:${(n & 0xffff).toString(16)}`;
+    }
+    const halves = s.split('::');
+    if (halves.length > 2) return null;
+    const left = halves[0] ? halves[0].split(':') : [];
+    const right = halves.length === 2 && halves[1] ? halves[1].split(':') : [];
+    const fill = halves.length === 2 ? 8 - left.length - right.length : 0;
+    const groups = [...left, ...Array(Math.max(0, fill)).fill('0'), ...right].map(g => Number.parseInt(g || '0', 16));
+    return groups.length === 8 && groups.every(g => Number.isInteger(g) && g >= 0 && g <= 0xffff) ? groups : null;
+}
+
+/**
+ * Is this address one a server-side fetch must never reach?
+ *
+ * @param {string} ip
+ * @returns {boolean}
+ */
+export function isBlockedAddress(ip) {
+    const kind = net.isIP(String(ip || ''));
+    if (kind === 4) return v4Blocked(ip);
+    if (kind !== 6) return true;
+    const g = v6Groups(ip);
+    if (!g) return true;
+    const embeddedV4 = () => `${g[6] >> 8}.${g[6] & 255}.${g[7] >> 8}.${g[7] & 255}`;
+    if (g.every(x => x === 0)) return true;                                   // ::
+    if (g.slice(0, 7).every(x => x === 0) && g[7] === 1) return true;         // ::1
+    if (g.slice(0, 5).every(x => x === 0) && g[5] === 0xffff) return v4Blocked(embeddedV4()); // ::ffff:a.b.c.d
+    if (g.slice(0, 4).every(x => x === 0) && g[4] === 0xffff && g[5] === 0) return true;      // ::ffff:0:0/96 (SIIT)
+    if (g[0] === 0x64 && g[1] === 0xff9b && g[2] === 1) return true;          // 64:ff9b:1::/48 (local NAT64)
+    if (g[0] === 0x100 && g[1] === 0 && g[2] === 0 && g[3] === 0) return true; // 100::/64 (discard)
+    if (g.slice(0, 6).every(x => x === 0)) return true;                       // ::a.b.c.d (deprecated compat)
+    if (g[0] === 0x64 && g[1] === 0xff9b && g.slice(2, 6).every(x => x === 0)) return v4Blocked(embeddedV4()); // NAT64
+    if ((g[0] & 0xfe00) === 0xfc00) return true;                              // fc00::/7 unique local
+    if ((g[0] & 0xffc0) === 0xfe80) return true;                              // fe80::/10 link-local
+    if ((g[0] & 0xffc0) === 0xfec0) return true;                              // fec0::/10 site-local
+    if ((g[0] & 0xff00) === 0xff00) return true;                              // multicast
+    if (g[0] === 0x2001 && g[1] === 0x0db8) return true;                      // documentation
+    if (g[0] === 0x2002) return v4Blocked(`${g[1] >> 8}.${g[1] & 255}.${g[2] >> 8}.${g[2] & 255}`); // 6to4
+    if (g[0] === 0x2001 && g[1] === 0) return true;                           // Teredo
+    return false;
+}
+
+/** Canonical text for an address, so the two spellings of one IPv6 address compare equal. */
+export function canonAddress(ip) {
+    const s = String(ip || '').toLowerCase().split('%')[0];
+    if (net.isIP(s) !== 6) return s;
+    const g = v6Groups(s);
+    if (g && g.slice(0, 5).every(x => x === 0) && g[5] === 0xffff) return `${g[6] >> 8}.${g[6] & 255}.${g[7] >> 8}.${g[7] & 255}`;
+    return g ? g.map(x => x.toString(16)).join(':') : s;
+}
+
+/**
+ * This machine's own addresses - every interface, public ones included, plus
+ * the unspecified ones. A server must never fetch from itself, whatever its
+ * public address resolves as.
+ */
+export function ownAddresses(interfaces = os.networkInterfaces()) {
+    const out = new Set(['0.0.0.0', canonAddress('::')]);
+    for (const list of Object.values(interfaces || {})) {
+        for (const a of list || []) if (a?.address) out.add(canonAddress(a.address));
+    }
+    return out;
+}
+
+/** Does an address fall inside `a.b.c.d/n`, `v6::/n` or equal a plain address? */
+function addressMatches(ip, entry) {
+    const [base, bitsRaw] = String(entry).split('/');
+    const a = canonAddress(ip);
+    const b = canonAddress(base);
+    if (bitsRaw === undefined) return a === b;
+    const bits = Number(bitsRaw);
+    if (net.isIP(a) === 4 && net.isIP(b) === 4) {
+        return Number.isInteger(bits) && bits >= 0 && bits <= 32 && v4InRange(v4ToInt(a), b, bits);
+    }
+    const ga = v6Groups(a);
+    const gb = v6Groups(b);
+    if (!ga || !gb || !Number.isInteger(bits) || bits < 0 || bits > 128) return false;
+    for (let i = 0, left = bits; left > 0; i++, left -= 16) {
+        const take = Math.min(16, left);
+        const mask = (0xffff << (16 - take)) & 0xffff;
+        if ((ga[i] & mask) !== (gb[i] & mask)) return false;
+    }
+    return true;
+}
+
+/**
+ * Resolve a host and check every address.
+ *
+ * @param {string} hostname
+ * @param {object} [opts]
+ * @param {boolean} [opts.allowPrivate] - skip the address checks entirely
+ * @param {(address: string) => boolean} [opts.allowAddress] - addresses the site allowlisted
+ * @param {Function} [opts.lookup] - dns.promises.lookup, swappable in tests
+ * @param {Set<string>} [opts.own] - this server's addresses
+ * @returns {Promise<{address: string, family: number, allowlisted: boolean}>} the address to connect to
+ */
+export async function resolvePublic(hostname, {allowPrivate = false, allowAddress = null, lookup = dns.promises.lookup, own = ownAddresses()} = {}) {
+    const host = String(hostname || '').replace(/^\[|\]$/g, '');
+    let addrs;
+    if (net.isIP(host)) addrs = [{address: host, family: net.isIP(host)}];
+    else {
+        try { addrs = await lookup(host, {all: true, verbatim: true}); } catch (err) { throw new FetchRefused(`${host} could not be found (${err.code || err.message}).`); }
+    }
+    if (!addrs?.length) throw new FetchRefused(`${host} could not be found.`);
+    const listed = (a) => !!allowAddress && allowAddress(a.address);
+    if (!allowPrivate) {
+        const bad = addrs.find(a => isBlockedAddress(a.address) && !listed(a));
+        if (bad) throw new FetchRefused(`${host} points at a private or reserved address (${bad.address}) - refused.`);
+        const self = addrs.find(a => own.has(canonAddress(a.address)) && !listed(a));
+        if (self) throw new FetchRefused(`${host} points at this server itself (${self.address}) - refused.`);
+    }
+    return {address: addrs[0].address, family: addrs[0].family || net.isIP(addrs[0].address), allowlisted: allowPrivate || addrs.every(listed)};
+}
+
+/** Scheme and credentials (before any DNS). Returns the URL, or throws. */
+export function parseOutboundUrl(raw) {
+    let u;
+    try { u = new URL(String(raw || '').trim()); } catch { throw new FetchRefused('Not a web address.'); }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') throw new FetchRefused(`${u.protocol} addresses are not fetched.`);
+    if (u.username || u.password) throw new FetchRefused('Addresses with a user name or password are not fetched.');
+    return u;
+}
+
+// ---------------------------------------------------------------------------
+// The site's allowlist (config/server.json outboundAllowPrivate)
+// ---------------------------------------------------------------------------
+
+/**
+ * What this site lets outbound requests reach beyond the public internet.
+ *
+ * @param {object} [opts]
+ * @param {object} [opts.server] - server.json (read fresh when omitted)
+ * @param {boolean} [opts.signed] - signed-only (codePolicy.signedOnly() when omitted)
+ * @returns {{all: boolean, hosts: string[], addresses: string[]}}
+ */
+export function outboundPolicy({server, signed} = {}) {
+    const none = {all: false, hosts: [], addresses: []};
+    if (signed ?? signedOnly()) return none;
+    let cfg = server;
+    if (cfg === undefined) { try { cfg = getConfig('server'); } catch { cfg = {}; } }
+    const v = cfg?.outboundAllowPrivate;
+    if (v === true) return {all: true, hosts: [], addresses: []};
+    if (!Array.isArray(v)) return none;
+    const entries = v.filter(x => typeof x === 'string' && x.trim()).map(x => x.trim().toLowerCase().replace(/^\[|\]$/g, ''));
+    return {
+        all: false,
+        addresses: entries.filter(x => net.isIP(x.split('/')[0])),
+        hosts: entries.filter(x => !net.isIP(x.split('/')[0]))
+    };
+}
+
+// ---------------------------------------------------------------------------
+// The request
+// ---------------------------------------------------------------------------
+
+/**
+ * One HTTP request to an address already checked, connecting only to that
+ * address. Never follows a redirect itself.
+ *
+ * @returns {Promise<{status: number, headers: object, buffer: Buffer, truncated: boolean, redirect?: string}>}
+ */
+export function pinnedRequest(u, {address, family, method = 'GET', headers = {}, body, deadline, maxBytes, signal, truncate = false}) {
+    return new Promise((resolve, reject) => {
+        const lib = u.protocol === 'https:' ? https : http;
+        const payload = body === undefined || body === null ? null : (Buffer.isBuffer(body) ? body : Buffer.from(String(body)));
+        if (payload && !Object.keys(headers).some(k => /^content-length$/i.test(k))) headers = {...headers, 'content-length': String(payload.length)};
+        let done = false;
+        const finish = (fn, v) => { if (!done) { done = true; clearTimeout(timer); fn(v); } };
+        const req = lib.request({
+            protocol: u.protocol,
+            hostname: u.hostname.replace(/^\[|\]$/g, ''),
+            servername: net.isIP(u.hostname.replace(/^\[|\]$/g, '')) ? undefined : u.hostname,
+            port: u.port || undefined,
+            path: `${u.pathname}${u.search}`,
+            method,
+            headers,
+            // Connect to the address that was checked - not to a fresh lookup.
+            lookup: (_host, options, cb) => {
+                if (options?.all) cb(null, [{address, family}]);
+                else cb(null, address, family);
+            },
+            agent: false,
+            signal
+        }, (res) => {
+            const status = res.statusCode || 0;
+            if (status >= 300 && status < 400 && res.headers.location) {
+                res.resume();
+                return finish(resolve, {status, headers: res.headers, buffer: Buffer.alloc(0), truncated: false, redirect: String(res.headers.location)});
+            }
+            const declared = Number(res.headers['content-length']);
+            if (!truncate && Number.isFinite(declared) && declared > maxBytes) {
+                res.destroy();
+                return finish(reject, new FetchRefused(`The answer is ${Math.round(declared / 1048576)} MB - over the ${Math.round(maxBytes / 1048576)} MB limit.`));
+            }
+            const chunks = [];
+            let size = 0;
+            res.on('data', (c) => {
+                if (size + c.length > maxBytes) {
+                    res.destroy();
+                    if (truncate) {
+                        chunks.push(c.subarray(0, maxBytes - size));
+                        finish(resolve, {status, headers: res.headers, buffer: Buffer.concat(chunks), truncated: true});
+                    } else {
+                        finish(reject, new FetchRefused(`The answer is over the ${Math.round(maxBytes / 1048576)} MB limit.`));
+                    }
+                    return;
+                }
+                size += c.length;
+                chunks.push(c);
+            });
+            res.on('end', () => finish(resolve, {status, headers: res.headers, buffer: Buffer.concat(chunks), truncated: false}));
+            res.on('error', (err) => finish(reject, err));
+        });
+        const timer = setTimeout(() => { req.destroy(); finish(reject, Object.assign(new Error('The request took too long.'), {code: 'ETIMEDOUT'})); }, Math.max(1, deadline - Date.now()));
+        req.on('error', (err) => finish(reject, err));
+        if (payload) req.write(payload);
+        req.end();
+    });
+}
+
+/**
+ * Check one URL against the rules and the site's allowlist, and resolve it.
+ *
+ * @returns {Promise<{u: URL, address: string, family: number}>}
+ */
+export async function checkOutbound(raw, {policy = outboundPolicy(), lookup, own, allowPrivate = false} = {}) {
+    const u = parseOutboundUrl(raw);
+    const host = u.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    const hostListed = policy.all || allowPrivate || policy.hosts.includes(host);
+    const allowAddress = policy.addresses.length ? (ip) => policy.addresses.some(e => addressMatches(ip, e)) : null;
+    const {address, family, allowlisted} = await resolvePublic(host, {
+        allowPrivate: hostListed, allowAddress, ...(lookup && {lookup}), ...(own && {own})
+    });
+    const port = portOf(u.href);
+    if (!allowlisted && !FETCH_PORTS.includes(port)) throw new FetchRefused(`Port ${port} is not reached - only 80 and 443.`);
+    return {u, address, family};
+}
+
+/**
+ * Make a request to a URL a site user chose.
+ *
+ * @param {string} url
+ * @param {object} [opts]
+ * @param {string} [opts.method='GET']
+ * @param {object} [opts.headers]
+ * @param {string|Buffer} [opts.body]
+ * @param {number} [opts.timeoutMs]
+ * @param {number} [opts.maxBytes] - the answer's size cap
+ * @param {boolean} [opts.truncate] - cut an oversized answer instead of failing
+ * @param {number} [opts.maxRedirects]
+ * @param {AbortSignal} [opts.signal]
+ * @param {object} [opts.policy] - outboundPolicy(), read fresh when omitted
+ * @param {Function} [opts.lookup] - tests
+ * @param {Set<string>} [opts.own] - tests
+ * @returns {Promise<{ok: boolean, status: number, headers: object, buffer: Buffer, text: () => string, json: () => unknown, url: string, truncated: boolean}>}
+ */
+export async function safeFetch(url, opts = {}) {
+    const lim = {...OUTBOUND_LIMITS, ...Object.fromEntries(Object.entries(opts).filter(([, v]) => v !== undefined))};
+    const deadline = Date.now() + lim.timeoutMs;
+    const policy = opts.policy || outboundPolicy();
+    let method = String(opts.method || 'GET').toUpperCase();
+    let body = opts.body;
+    // Headers that steer the connection itself are the request's, not the caller's.
+    const callerHeaders = Object.fromEntries(Object.entries(opts.headers || {})
+        .filter(([k]) => !/^(host|connection|transfer-encoding|content-length|keep-alive|upgrade|te|trailer|proxy-.*)$/i.test(k)));
+    let headers = {'user-agent': 'DommaCMS/1', ...callerHeaders};
+    let current = url;
+    let first = null;
+    for (let hop = 0; hop <= lim.maxRedirects; hop++) {
+        const {u, address, family} = await checkOutbound(current, {policy, lookup: opts.lookup, own: opts.own});
+        if (first === null) first = u;
+        else if (u.origin !== first.origin) {
+            // A redirect to another origin (or from https down to http) takes none of
+            // the caller's headers - an API key meant for the first host stays there.
+            headers = Object.fromEntries(Object.entries(headers).filter(([k]) => /^(user-agent|content-type|accept)$/i.test(k)));
+        }
+        const res = await pinnedRequest(u, {
+            address, family, method, headers, body, deadline,
+            maxBytes: lim.maxBytes, truncate: !!opts.truncate, signal: opts.signal
+        });
+        if (res.redirect) {
+            if (hop === lim.maxRedirects) throw new FetchRefused('Too many redirects.');
+            current = new URL(res.redirect, u).href;
+            // As browsers do: 303, and 301/302 after a POST, continue as a GET without the body.
+            if (res.status === 303 || ((res.status === 301 || res.status === 302) && method === 'POST')) {
+                method = 'GET';
+                body = undefined;
+                headers = Object.fromEntries(Object.entries(headers).filter(([k]) => !/^content-(type|length)$/i.test(k)));
+            }
+            continue;
+        }
+        const buffer = res.buffer;
+        return {
+            ok: res.status >= 200 && res.status < 300,
+            status: res.status,
+            headers: res.headers,
+            buffer,
+            truncated: res.truncated,
+            url: u.href,
+            text: () => buffer.toString('utf8'),
+            json: () => JSON.parse(buffer.toString('utf8'))
+        };
+    }
+    throw new FetchRefused('Too many redirects.');
+}

package/server/services/pluginFiles.js

@@ -13,13 +13,16 @@
  * exception is a SUPER-ADMIN (role level 0), which on the fleet exists only on
  * the manager: the people who publish the paid plugins are the people who need
  * to read and edit them. Customer sites are all level 1, so nothing changes
- * there - see the `allowLicensed` argument, set from the request's user.
+ * there - see the `allowLicensed` argument, set from the request's user. (Hosted
+ * owners are in fact level 0 on their own site: on a signed-only site the route
+ * never allows licensed source - services/codePolicy.js.)
  *
  * Thrown errors carry `statusCode` (400 invalid, 403 licensed, 404 missing,
  * 413 too large) for direct mapping in the route layer.
  */
 import fs from 'fs/promises';
 import path from 'path';
+import {assertMayChangeCode} from './codePolicy.js';
 
 const PLUGINS_DIR = path.resolve('plugins');
 
@@ -200,6 +203,8 @@ export async function readPluginFile(name, relPath, {allowLicensed = false} = {}
  * @returns {Promise<{path: string, restartRequired: boolean}>}
  */
 export async function writePluginFile(name, relPath, content, {allowLicensed = false} = {}) {
+    // A signed-only site runs the Marketplace's code as signed: nothing here may change it.
+    assertMayChangeCode();
     const pluginDir = await resolvePluginDir(name, allowLicensed);
     const abs = await resolveFilePath(pluginDir, relPath);
 
@@ -240,6 +245,8 @@ export async function writePluginFile(name, relPath, content, {allowLicensed = f
  * @returns {Promise<{path: string}>}
  */
 export async function deletePluginFile(name, relPath, {allowLicensed = false} = {}) {
+    // A signed-only site runs the Marketplace's code as signed: nothing here may change it.
+    assertMayChangeCode();
     const pluginDir = await resolvePluginDir(name, allowLicensed);
     const abs = await resolveFilePath(pluginDir, relPath);
     const rel = path.relative(pluginDir, abs).split(path.sep).join('/');