domma-cms 1.8.13 → 1.8.15

package/server/services/pluginInstaller.js

@@ -16,9 +16,9 @@ import {readFileSync} from 'fs';
 import path from 'path';
 import zlib from 'zlib';
 import {fileURLToPath} from 'url';
-import {getConfig} from '../config.js';
 import {discoverPlugins, pluginRoleHooks, unregisterAllRolesForPlugin, validatePluginDir} from './plugins.js';
 import {allowInGitignore, manifestContentPaths, pluginContentRules} from './siteGitignore.js';
+import {signedOnly, signedOnlyError} from './codePolicy.js';
 
 // ---------------------------------------------------------------------------
 // Paths
@@ -74,18 +74,14 @@ MCowBQYDK2VwAyEAqAlx1lfHeCaNiwJmoXZMDY56yafU2GlpNG3VInw9Q14=
  * Does this site refuse anything the marketplace has not signed?
  *
  * Default false, because a CMS whose own scaffolder produces unsigned plugins
- * cannot refuse unsigned plugins without refusing its user's own work. A fleet
- * site should set it true: everything it receives arrives by push-copy, and
- * nothing legitimate is ever uploaded there.
+ * cannot refuse unsigned plugins without refusing its user's own work. A hosted
+ * site has it on (services/codePolicy.js - the one place that decides, and the
+ * other doors it closes).
  *
  * @returns {boolean}
  */
 function requireSignedPlugins() {
-    try {
-        return getConfig('server')?.requireSignedPlugins === true;
-    } catch {
-        return false;
-    }
+    return signedOnly();
 }
 
 /**
@@ -348,12 +344,12 @@ export async function installPlugin(slug, { tarball, signature, publicKeyId, all
     // Step 1 - Verify signature, or establish that there is deliberately none.
     const unsigned = !signature;
     if (unsigned) {
+        // Signed-only first: asking the admin to confirm something the site will
+        // refuse anyway would be a question with no right answer.
+        if (requireSignedPlugins()) throw signedOnlyError();
         if (!allowUnsigned) {
             throw new Error('This plugin is unsigned. Installing it runs its code on this server, so it has to be confirmed.');
         }
-        if (requireSignedPlugins()) {
-            throw new Error('This site accepts signed plugins only (server.json: requireSignedPlugins).');
-        }
     }
 
     const pubKeyPem = unsigned ? null : trustedKey(publicKeyId, 'bundle');
@@ -396,7 +392,14 @@ export async function installPlugin(slug, { tarball, signature, publicKeyId, all
         throw err;
     }
 
-    // Step 4 - Validate manifest
+    // Step 4 - Validate manifest. discoverPlugins() names a plugin after its
+    // folder, so it cannot tell a bundle installed under someone else's slug -
+    // the manifest inside must name this slug itself (as an upgrade checks).
+    const own = await validatePluginDir(destDir, slug);
+    if (!own.ok) {
+        await fs.rm(destDir, { recursive: true, force: true });
+        throw new Error(`Plugin manifest validation failed after extraction: ${slug} (${own.reason})`);
+    }
     const manifests = await discoverPlugins();
     const manifest = manifests.find(m => m.name === slug);
     if (!manifest) {

package/server/services/pluginScaffold.js

@@ -12,6 +12,7 @@
 import fs from 'fs/promises';
 import path from 'path';
 import {allowInGitignore, sitePluginRules} from './siteGitignore.js';
+import {assertMayChangeCode} from './codePolicy.js';
 
 const PLUGINS_DIR = path.resolve('plugins');
 const TEMPLATE_DIR = path.join(PLUGINS_DIR, '_template');
@@ -71,6 +72,8 @@ export function validateScaffoldInput(input = {}) {
  * @returns {Promise<{name: string, files: string[]}>} Created plugin name and relative file list
  */
 export async function scaffoldPlugin(input) {
+    // A new plugin is new server code: a signed-only site makes none (services/codePolicy.js).
+    assertMayChangeCode();
     const { slug, displayName, description, author, icon } = validateScaffoldInput(input);
 
     try {

package/server/services/safePath.js

@@ -0,0 +1,35 @@
+/**
+ * One name, one file, inside one folder.
+ *
+ * Fastify DECODES route params, so `/api/forms/..%2F..%2Fconfig%2Fserver`
+ * arrives as the slug `../../config/server`. A store that builds its file as
+ * `path.join(DIR, `${slug}.json`)` then reads and writes `config/server.json` -
+ * which is how a site admin could rewrite the host's own settings (switching
+ * `requireSignedPlugins` off, unlocking a Tool) through an ordinary form save.
+ * Routes check slugs in most places; this is the check at the file, so a route
+ * that forgets is still safe.
+ *
+ * @module services/safePath
+ */
+import path from 'path';
+
+/**
+ * The file `<dir>/<name><ext>`, refusing any name that is not one plain path
+ * segment (a separator, `.`/`..`, a NUL, empty, or not a string).
+ *
+ * @param {string} dir
+ * @param {string} name
+ * @param {string} [ext]  e.g. '.json'; '' for a folder
+ * @returns {string}
+ * @throws {Error} statusCode 404 - to a caller, a name like that names nothing
+ */
+export function fileIn(dir, name, ext = '') {
+    const root = path.resolve(dir);
+    const ok = typeof name === 'string' && name !== '' && name !== '.' && name !== '..'
+        && !/[\\/\0]/.test(name);
+    const file = ok ? path.join(root, `${name}${ext}`) : null;
+    if (!file || path.dirname(file) !== root) {
+        throw Object.assign(new Error(`Not found: ${String(name).slice(0, 80)}`), {statusCode: 404, code: 'ENOENT'});
+    }
+    return file;
+}

package/server/services/staffAccess.js

@@ -24,7 +24,8 @@
  *
  * Anyone who can read the site's JWT_SECRET (shell access, or code running in
  * the site's process - which includes a level-0 user installing an unsigned
- * plugin, unless server.json `requireSignedPlugins` is on) can mint either;
+ * plugin or editing one, unless the site is signed-only - services/codePolicy.js,
+ * which hosted sites are) can mint either;
  * that is true of every session. The session is the site's full top role for
  * an hour (the Manager can already act as it), with no `sid` to revoke it.
  *

package/server/services/versions.js

@@ -37,7 +37,7 @@ const PAGES_DIR = path.join(config.content.contentDir, 'pages');
 function versionsDirForPath(urlPath) {
     const normalised = urlPath === '/' || !urlPath ? '_index' : urlPath.replace(/^\//, '').replace(/\/$/, '');
     const resolved = path.resolve(path.join(VERSIONS_DIR, normalised));
-    if (!resolved.startsWith(path.resolve(VERSIONS_DIR))) {
+    if (resolved !== path.resolve(VERSIONS_DIR) && !resolved.startsWith(path.resolve(VERSIONS_DIR) + path.sep)) {
         throw new Error('Invalid path: outside versions directory');
     }
     return resolved;

package/server/services/views.js

@@ -24,6 +24,11 @@
  *
  * Forbidden stage types:
  *   $out, $merge, $function, $accumulator, $graphLookup
+ *
+ * Stage CONFIGS are checked too, at any depth (mongoQueryGuard.js): no
+ * `$where`/`$function`/`$accumulator` hidden in a `$match`, `$group` or
+ * `$lookup` sub-pipeline, and a `$lookup` only into this site's `cms_<slug>`
+ * collections. Checked on save and again before MongoDB runs the pipeline.
  */
 import fs from 'fs/promises';
 import path from 'path';
@@ -34,6 +39,8 @@ import {checkVisibility} from '../middleware/auth.js';
 import {getEffectiveLevel} from './userRoles.js';
 import {executePipeline} from './viewPipeline.js';
 import * as cache from './cache/index.js';
+import {fileIn} from './safePath.js';
+import {assertSafeMongoQuery, toSafeMongoPipeline} from './mongoQueryGuard.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT      = path.resolve(__dirname, '..', '..');
@@ -87,6 +94,7 @@ function validateStages(stages) {
         if (!ALLOWED_STAGES.has(stage.type)) {
             throw new Error(`Stage type "${stage.type}" is not in the allowed list`);
         }
+        assertSafeMongoQuery({[stage.type]: stage.config});
     }
 }
 
@@ -122,7 +130,7 @@ export async function ensureViewsDir() {
  * @throws {Error} If the view file does not exist or cannot be parsed.
  */
 export async function readView(slug) {
-    const file = path.join(VIEWS_DIR, `${slug}.json`);
+    const file = fileIn(VIEWS_DIR, slug, '.json');
     return JSON.parse(await fs.readFile(file, 'utf8'));
 }
 
@@ -135,7 +143,7 @@ export async function readView(slug) {
  */
 export async function writeView(slug, view) {
     await ensureViewsDir();
-    const file = path.join(VIEWS_DIR, `${slug}.json`);
+    const file = fileIn(VIEWS_DIR, slug, '.json');
     await fs.writeFile(file, JSON.stringify(view, null, 4) + '\n', 'utf8');
     await cache.invalidateTags([`view:${slug}`]);
 }
@@ -368,7 +376,7 @@ export async function deleteView(slug) {
         throw new Error(`View "${slug}" not found`);
     }
     try {
-        await fs.unlink(path.join(VIEWS_DIR, `${slug}.json`));
+        await fs.unlink(fileIn(VIEWS_DIR, slug, '.json'));
     } catch {
         throw new Error(`View "${slug}" not found`);
     }
@@ -388,7 +396,12 @@ async function executeMongoView(view, { page, limit, user }) {
     const db = getDb(view.connection || 'default');
 
     const sourceCollection = `${COLLECTION_PREFIX}${view.pipeline.source}`;
-    const pipeline = buildPipelineStages(view.pipeline?.stages || []);
+    // The one translation of a view for MongoDB: refuses code-running
+    // operators at any depth and a $lookup outside this site's collections.
+    const {getCollection} = await import('./collections.js');
+    const pipeline = await toSafeMongoPipeline(view.pipeline?.stages || [], {
+        collectionExists: async (slug) => !!(await getCollection(slug).catch(() => null))
+    });
 
     // Prepend row-level $match if configured
     const rowLevel = view.access?.rowLevel;

package/server/services/wpImport/fetch.js

@@ -21,25 +21,15 @@
  *
  * @module services/wpImport/fetch
  */
-import dns from 'node:dns';
-import http from 'node:http';
-import https from 'node:https';
-import net from 'node:net';
-import os from 'node:os';
+import {FETCH_PORTS, FetchRefused, isBlockedAddress, ownAddresses, pinnedRequest, portOf, resolvePublic} from '../outbound.js';
 
-export const FETCH_PORTS = Object.freeze([80, 443]);
-
-/** The port an address would be fetched on. */
-export function portOf(raw) {
-    try { const u = new URL(raw); return u.port ? Number(u.port) : (u.protocol === 'https:' ? 443 : 80); } catch { return 0; }
-}
+// The address rules and the pinned connection are shared with every other
+// outbound request (services/outbound.js); this module adds the WordPress
+// site's own host list, the 50 MB cap and "only a 200 is a file".
+export {FETCH_PORTS, FetchRefused, isBlockedAddress, ownAddresses, portOf, resolvePublic};
 
 export const FETCH_LIMITS = Object.freeze({maxBytes: 50 * 1024 * 1024, timeoutMs: 60_000, maxRedirects: 3});
 
-export class FetchRefused extends Error {
-    constructor(message) { super(message); this.code = 'EREFUSED_SSRF'; }
-}
-
 /**
  * The test-only switch: private addresses are allowed only outside
  * production AND with WP_IMPORT_ALLOW_PRIVATE_HOSTS=1 set.
@@ -48,121 +38,6 @@ export function testHostsAllowed(env = process.env) {
     return env.NODE_ENV !== 'production' && env.WP_IMPORT_ALLOW_PRIVATE_HOSTS === '1';
 }
 
-const V4_BLOCKED = [
-    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8], ['169.254.0.0', 16], ['172.16.0.0', 12],
-    ['192.0.0.0', 24], ['192.0.2.0', 24], ['192.88.99.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15],
-    ['198.51.100.0', 24], ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4]
-];
-
-function v4ToInt(ip) {
-    const p = ip.split('.').map(Number);
-    if (p.length !== 4 || p.some(n => !Number.isInteger(n) || n < 0 || n > 255)) return null;
-    return ((p[0] << 24) >>> 0) + (p[1] << 16) + (p[2] << 8) + p[3];
-}
-
-function v4Blocked(ip) {
-    const n = v4ToInt(ip);
-    if (n === null) return true;
-    return V4_BLOCKED.some(([base, bits]) => {
-        const mask = bits === 0 ? 0 : (~0 << (32 - bits)) >>> 0;
-        return ((n & mask) >>> 0) === ((v4ToInt(base) & mask) >>> 0);
-    });
-}
-
-/** Expand an IPv6 address to 8 groups of numbers (null when it is not one). */
-function v6Groups(ip) {
-    let s = ip.toLowerCase().split('%')[0];
-    // A dotted IPv4 tail (::ffff:1.2.3.4).
-    const tail = /(\d+\.\d+\.\d+\.\d+)$/.exec(s);
-    if (tail) {
-        const n = v4ToInt(tail[1]);
-        if (n === null) return null;
-        s = s.slice(0, -tail[1].length) + `${(n >>> 16).toString(16)}:${(n & 0xffff).toString(16)}`;
-    }
-    const halves = s.split('::');
-    if (halves.length > 2) return null;
-    const left = halves[0] ? halves[0].split(':') : [];
-    const right = halves.length === 2 && halves[1] ? halves[1].split(':') : [];
-    const fill = halves.length === 2 ? 8 - left.length - right.length : 0;
-    const groups = [...left, ...Array(Math.max(0, fill)).fill('0'), ...right].map(g => Number.parseInt(g || '0', 16));
-    return groups.length === 8 && groups.every(g => Number.isInteger(g) && g >= 0 && g <= 0xffff) ? groups : null;
-}
-
-/**
- * Is this address one a server-side fetch must never reach?
- *
- * @param {string} ip
- * @returns {boolean}
- */
-export function isBlockedAddress(ip) {
-    const kind = net.isIP(String(ip || ''));
-    if (kind === 4) return v4Blocked(ip);
-    if (kind !== 6) return true;
-    const g = v6Groups(ip);
-    if (!g) return true;
-    const embeddedV4 = () => `${g[6] >> 8}.${g[6] & 255}.${g[7] >> 8}.${g[7] & 255}`;
-    if (g.every(x => x === 0)) return true;                                   // ::
-    if (g.slice(0, 7).every(x => x === 0) && g[7] === 1) return true;         // ::1
-    if (g.slice(0, 5).every(x => x === 0) && g[5] === 0xffff) return v4Blocked(embeddedV4()); // ::ffff:a.b.c.d
-    if (g.slice(0, 4).every(x => x === 0) && g[4] === 0xffff && g[5] === 0) return true;      // ::ffff:0:0/96 (SIIT)
-    if (g[0] === 0x64 && g[1] === 0xff9b && g[2] === 1) return true;          // 64:ff9b:1::/48 (local NAT64)
-    if (g[0] === 0x100 && g[1] === 0 && g[2] === 0 && g[3] === 0) return true; // 100::/64 (discard)
-    if (g.slice(0, 6).every(x => x === 0)) return true;                       // ::a.b.c.d (deprecated compat)
-    if (g[0] === 0x64 && g[1] === 0xff9b && g.slice(2, 6).every(x => x === 0)) return v4Blocked(embeddedV4()); // NAT64
-    if ((g[0] & 0xfe00) === 0xfc00) return true;                              // fc00::/7 unique local
-    if ((g[0] & 0xffc0) === 0xfe80) return true;                              // fe80::/10 link-local
-    if ((g[0] & 0xffc0) === 0xfec0) return true;                              // fec0::/10 site-local
-    if ((g[0] & 0xff00) === 0xff00) return true;                              // multicast
-    if (g[0] === 0x2001 && g[1] === 0x0db8) return true;                      // documentation
-    if (g[0] === 0x2002) return v4Blocked(`${g[1] >> 8}.${g[1] & 255}.${g[2] >> 8}.${g[2] & 255}`); // 6to4
-    if (g[0] === 0x2001 && g[1] === 0) return true;                           // Teredo
-    return false;
-}
-
-/** Canonical text for an address, so the two spellings of one IPv6 address compare equal. */
-function canon(ip) {
-    const s = String(ip || '').toLowerCase().split('%')[0];
-    if (net.isIP(s) !== 6) return s;
-    const g = v6Groups(s);
-    if (g && g.slice(0, 5).every(x => x === 0) && g[5] === 0xffff) return `${g[6] >> 8}.${g[6] & 255}.${g[7] >> 8}.${g[7] & 255}`;
-    return g ? g.map(x => x.toString(16)).join(':') : s;
-}
-
-/**
- * This machine's own addresses - every interface, public ones included, plus
- * the unspecified ones. A server must never fetch from itself, whatever its
- * public address resolves as.
- */
-export function ownAddresses(interfaces = os.networkInterfaces()) {
-    const out = new Set(['0.0.0.0', canon('::')]);
-    for (const list of Object.values(interfaces || {})) {
-        for (const a of list || []) if (a?.address) out.add(canon(a.address));
-    }
-    return out;
-}
-
-/**
- * Resolve a host and check every address.
- *
- * @returns {Promise<{address: string, family: number}>} the address to connect to
- */
-export async function resolvePublic(hostname, {allowPrivate = false, lookup = dns.promises.lookup, own = ownAddresses()} = {}) {
-    const host = String(hostname || '').replace(/^\[|\]$/g, '');
-    let addrs;
-    if (net.isIP(host)) addrs = [{address: host, family: net.isIP(host)}];
-    else {
-        try { addrs = await lookup(host, {all: true, verbatim: true}); } catch (err) { throw new FetchRefused(`${host} could not be found (${err.code || err.message}).`); }
-    }
-    if (!addrs?.length) throw new FetchRefused(`${host} could not be found.`);
-    if (!allowPrivate) {
-        const bad = addrs.find(a => isBlockedAddress(a.address));
-        if (bad) throw new FetchRefused(`${host} points at a private or reserved address (${bad.address}) - refused.`);
-        const self = addrs.find(a => own.has(canon(a.address)));
-        if (self) throw new FetchRefused(`${host} points at this server itself (${self.address}) - refused.`);
-    }
-    return addrs[0];
-}
-
 /** May this URL be fetched at all (before any DNS)? Returns the URL, or throws. */
 export function checkUrl(raw, {hosts = [], allowPrivate = false} = {}) {
     let u;
@@ -209,56 +84,12 @@ export async function fetchMedia(url, opts = {}) {
     throw new FetchRefused('Too many redirects.');
 }
 
-function request(u, {address, family, deadline, maxBytes, signal}) {
-    return new Promise((resolve, reject) => {
-        const lib = u.protocol === 'https:' ? https : http;
-        let done = false;
-        const finish = (fn, v) => { if (!done) { done = true; clearTimeout(timer); fn(v); } };
-        const req = lib.request({
-            protocol: u.protocol,
-            hostname: u.hostname,
-            port: u.port || undefined,
-            path: `${u.pathname}${u.search}`,
-            method: 'GET',
-            headers: {'user-agent': 'DommaCMS-WordPress-Import/1', accept: '*/*'},
-            // Connect to the address that was checked - not to a fresh lookup.
-            lookup: (_host, options, cb) => {
-                if (options?.all) cb(null, [{address, family}]);
-                else cb(null, address, family);
-            },
-            agent: false,
-            signal
-        }, (res) => {
-            const status = res.statusCode || 0;
-            if (status >= 300 && status < 400 && res.headers.location) {
-                res.resume();
-                return finish(resolve, {redirect: String(res.headers.location)});
-            }
-            if (status !== 200) {
-                res.resume();
-                return finish(reject, Object.assign(new Error(`The old site answered ${status}.`), {code: 'EHTTP', status}));
-            }
-            const declared = Number(res.headers['content-length']);
-            if (Number.isFinite(declared) && declared > maxBytes) {
-                res.destroy();
-                return finish(reject, new FetchRefused(`The file is ${Math.round(declared / 1048576)} MB - over the ${Math.round(maxBytes / 1048576)} MB limit.`));
-            }
-            const chunks = [];
-            let size = 0;
-            res.on('data', (c) => {
-                size += c.length;
-                if (size > maxBytes) {
-                    res.destroy();
-                    finish(reject, new FetchRefused(`The file is over the ${Math.round(maxBytes / 1048576)} MB limit.`));
-                    return;
-                }
-                chunks.push(c);
-            });
-            res.on('end', () => finish(resolve, {buffer: Buffer.concat(chunks), contentType: String(res.headers['content-type'] || '')}));
-            res.on('error', (err) => finish(reject, err));
-        });
-        const timer = setTimeout(() => { req.destroy(); finish(reject, Object.assign(new Error('The download took too long.'), {code: 'ETIMEDOUT'})); }, Math.max(1, deadline - Date.now()));
-        req.on('error', (err) => finish(reject, err));
-        req.end();
+async function request(u, {address, family, deadline, maxBytes, signal}) {
+    const res = await pinnedRequest(u, {
+        address, family, deadline, maxBytes, signal,
+        headers: {'user-agent': 'DommaCMS-WordPress-Import/1', accept: '*/*'}
     });
+    if (res.redirect) return {redirect: res.redirect};
+    if (res.status !== 200) throw Object.assign(new Error(`The old site answered ${res.status}.`), {code: 'EHTTP', status: res.status});
+    return {buffer: res.buffer, contentType: String(res.headers['content-type'] || '')};
 }