domma-cms 1.8.14 → 1.8.16

package/server/services/mailHost.js

@@ -0,0 +1,100 @@
+/**
+ * Where this server may open a mail connection (SMTP or IMAP) to a host a site
+ * user typed - and the address it then connects to.
+ *
+ * A mail host is a TCP target the admin chooses, and a failed connection says
+ * what is listening there, so an unchecked host is a scanner of the server's
+ * own network. The address rules are services/outbound.js's (`resolvePublic`,
+ * `isBlockedAddress`): every address the name resolves to must be public,
+ * IPv4-mapped / NAT64 / decimal and octal spellings included. This module adds
+ * what is particular to mail:
+ *
+ *  - Signed-only sites (codePolicy.signedOnly() - every site a Manager hosts)
+ *    may name `localhost`, `127.0.0.1` or `::1` (hosted sites send through the
+ *    box's own port 25) or a public mail server, on the mail ports only
+ *    (SMTP 25/465/587/2525, IMAP 143/993). Nothing the site's admin sets lifts
+ *    that - not `outboundAllowPrivate`, not a mail plugin's
+ *    `allowPrivateMailHosts`, not the site's own SMTP host.
+ *  - This server's own PUBLIC address is not refused here (outbound.js refuses
+ *    it for web requests): a hosted mailbox at mail.<domain> on the same box is
+ *    normal, and on a signed-only site the port list keeps it to mail.
+ *  - The connection goes to the address that was checked (`address`), with the
+ *    name kept for TLS (`servername`), so a second DNS answer cannot swap in an
+ *    internal one (DNS rebinding).
+ *
+ * Self-hosted sites keep their freedom: core's site SMTP is not checked at all
+ * there (an internal relay is normal), and the mail plugins' own rules apply
+ * (plugins/_lib/mail/hostGuard.js).
+ *
+ * @module services/mailHost
+ */
+import dns from 'node:dns';
+import net from 'node:net';
+import {FetchRefused, resolvePublic} from './outbound.js';
+import {signedOnly} from './codePolicy.js';
+
+export const SMTP_PORTS = Object.freeze([25, 465, 587, 2525]);
+export const IMAP_PORTS = Object.freeze([143, 993]);
+
+/** The loopback names a signed-only site may use, and the address each one is. */
+const LOOPBACK = Object.freeze({localhost: '127.0.0.1', '127.0.0.1': '127.0.0.1', '::1': '::1'});
+
+export const REFUSED_PRIVATE = 'That mail server is on a private network, so this site will not connect to it. '
+    + 'Use the mail server\'s public name.';
+
+export class MailHostRefused extends Error {
+    constructor(message) { super(message); this.code = 'EMAILHOST_REFUSED'; this.mailHostRefused = true; }
+}
+
+/**
+ * Normalise a typed host for comparison: case, spaces, trailing dot, IPv6 brackets.
+ *
+ * @param {string} host
+ * @returns {string}
+ */
+export function normaliseMailHost(host) {
+    return String(host ?? '').trim().toLowerCase().replace(/\.$/, '').replace(/^\[(.*)\]$/, '$1');
+}
+
+/**
+ * Check a mail host and port, and say which address to connect to.
+ *
+ * @param {string} host
+ * @param {number} port
+ * @param {object} [opts]
+ * @param {'smtp'|'imap'} [opts.kind='smtp']
+ * @param {boolean} [opts.signed] - codePolicy.signedOnly() when omitted
+ * @param {boolean} [opts.checkAddresses] - refuse private addresses (default: on when signed)
+ * @param {boolean} [opts.anyPort] - skip the port rule (a save route that has no port to hand; the connection checks it)
+ * @param {Function} [opts.lookup] - dns.promises.lookup, swappable in tests
+ * @returns {Promise<{address: string, family: number, servername: string|undefined}>}
+ * @throws {MailHostRefused} the host or port is not allowed
+ * @throws {Error} code ENOTFOUND - the name did not resolve (never connect by name instead)
+ */
+export async function resolveMailHost(host, port, {kind = 'smtp', signed, checkAddresses, anyPort = false, lookup = dns.promises.lookup} = {}) {
+    const isSigned = signed ?? signedOnly();
+    const check = checkAddresses ?? isSigned;
+    const name = normaliseMailHost(host);
+    if (!name) throw new MailHostRefused('A mail server is required.');
+    if (isSigned && !anyPort) {
+        const ports = kind === 'imap' ? IMAP_PORTS : SMTP_PORTS;
+        const n = Number(port);
+        if (!ports.includes(n)) throw new MailHostRefused(`Port ${Number.isFinite(n) ? n : port} is not used for mail here - use ${ports.join(', ')}.`);
+    }
+    const servername = net.isIP(name) ? undefined : name;
+    if (isSigned && Object.hasOwn(LOOPBACK, name)) {
+        const address = LOOPBACK[name];
+        return {address, family: net.isIP(address), servername};
+    }
+    try {
+        // own: an empty set - see the module note on this server's public address.
+        const r = await resolvePublic(name, {allowPrivate: !check, lookup, own: new Set()});
+        return {address: r.address, family: r.family, servername};
+    } catch (err) {
+        if (!(err instanceof FetchRefused)) throw err;
+        if (/could not be found/.test(err.message)) {
+            throw Object.assign(new Error(`getaddrinfo ENOTFOUND ${name}`), {code: 'ENOTFOUND'});
+        }
+        throw new MailHostRefused(REFUSED_PRIVATE);
+    }
+}

package/server/services/mongoQueryGuard.js

@@ -0,0 +1,193 @@
+/**
+ * The one gate between a user-shaped query and MongoDB.
+ *
+ * Site users shape queries in many places - saved views and the view editor,
+ * the `[view]` and `[collection]` shortcodes, collection filters, `/api/v1`
+ * query parameters, API Builder endpoints. Every one of them reaches MongoDB
+ * through one of two translations, and both go through this module:
+ *
+ *   - a structured filter -> `toSafeMongoQuery()` (MongoAdapter.list)
+ *   - a view pipeline     -> `toSafeMongoPipeline()` (views.executeMongoView)
+ *
+ * Refused, at any depth (inside nested objects and arrays, `$lookup`
+ * sub-pipelines, `$expr`, `$group`...):
+ *
+ *   - anything that runs JavaScript inside the database server: `$where`,
+ *     `$function`, `$accumulator`, `$code`, and BSON Code values;
+ *   - anything that writes, or reads outside the site's own collections:
+ *     `$out`, `$merge`, `$unionWith`, `$graphLookup`, the server-state stages
+ *     (`$currentOp`, `$collStats`, ...), and a `$lookup` that is not into one
+ *     of this site's `cms_<slug>` collections (no cross-database form);
+ *   - keys named `__proto__`, `constructor` or `prototype`.
+ *
+ * Plain operators (`$eq`, `$gt`, `$in`, `$regex`, `$expr` with ordinary
+ * expressions, `$group` with `$sum`...) pass untouched.
+ *
+ * @module services/mongoQueryGuard
+ */
+import {toMongoQuery} from './filterEngine.js';
+
+/** Operators that execute code on the database server. */
+export const CODE_OPERATORS = Object.freeze(['$where', '$function', '$accumulator', '$code', '$mapReduce']);
+
+/** Operators that write, or reach data or server state beyond the site's collections. */
+export const REACH_OPERATORS = Object.freeze([
+    '$out', '$merge', '$unionWith', '$graphLookup', '$documents',
+    '$currentOp', '$listSessions', '$listLocalSessions', '$collStats', '$indexStats',
+    '$planCacheStats', '$changeStream', '$listSearchIndexes', '$listSampledQueries', '$querySettings'
+]);
+
+const PROTOTYPE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+const REFUSED = new Set([...CODE_OPERATORS, ...REACH_OPERATORS].map(k => k.toLowerCase()));
+const SITE_SLUG = /^[a-z0-9][a-z0-9_-]*$/;
+const MAX_DEPTH = 64;
+
+export class UnsafeQueryError extends Error {
+    constructor(message) {
+        super(message);
+        this.code = 'EUNSAFE_QUERY';
+        this.statusCode = 400;
+    }
+}
+
+/**
+ * Throw when a query, pipeline or any part of one could run code or reach
+ * outside the site's own collections.
+ *
+ * @param {unknown} value
+ * @param {object} [opts]
+ * @param {Set<string>|string[]} [opts.collections] - the site's collection slugs; when given, a `$lookup` must name one
+ * @param {string} [opts.prefix='cms_'] - the MongoDB name prefix of a site collection
+ * @returns {unknown} the same value, for chaining
+ */
+export function assertSafeMongoQuery(value, opts = {}) {
+    const known = opts.collections ? new Set(opts.collections) : null;
+    const prefix = opts.prefix ?? 'cms_';
+    const seen = new Set();
+
+    const walk = (node, at, depth) => {
+        if (node === null || typeof node !== 'object') {
+            if (typeof node === 'function') throw new UnsafeQueryError(`${at || 'The query'} is a function - not allowed in a query.`);
+            return;
+        }
+        if (depth > MAX_DEPTH) throw new UnsafeQueryError('The query is nested too deeply.');
+        if (seen.has(node)) return;
+        seen.add(node);
+        // A BSON Code value runs as JavaScript wherever the server accepts one.
+        if (String(node._bsontype || '').toLowerCase().startsWith('code')) {
+            throw new UnsafeQueryError(`${at || 'The query'} holds JavaScript code - not allowed in a query.`);
+        }
+        if (Array.isArray(node)) {
+            node.forEach((item, i) => walk(item, `${at}[${i}]`, depth + 1));
+            return;
+        }
+        // Own keys, including a `__proto__` key that JSON.parse makes an own property.
+        for (const key of Reflect.ownKeys(node)) {
+            if (typeof key !== 'string') continue;
+            const here = at ? `${at}.${key}` : key;
+            const lower = key.toLowerCase();
+            // A dotted path ('data.x.__proto__', 'a.$where') is checked a part at a time.
+            for (const part of key.split('.')) {
+                if (PROTOTYPE_KEYS.has(part)) throw new UnsafeQueryError(`"${part}" is not allowed as a name in a query (at ${here}).`);
+                const p = part.toLowerCase();
+                if (REFUSED.has(p)) {
+                    throw new UnsafeQueryError(`${part} is not allowed in a query - it ${CODE_OPERATORS.some(k => k.toLowerCase() === p) ? 'runs code on the database server' : 'reaches beyond this site\'s own collections'} (at ${here}).`);
+                }
+            }
+            const child = node[key];
+            if (lower === '$lookup') checkLookup(child, here, known, prefix);
+            walk(child, here, depth + 1);
+        }
+    };
+
+    walk(value, '', 0);
+    return value;
+}
+
+function checkLookup(config, at, known, prefix) {
+    if (!config || typeof config !== 'object' || Array.isArray(config)) throw new UnsafeQueryError(`$lookup needs an object (at ${at}).`);
+    const from = config.from;
+    if (typeof from !== 'string') {
+        throw new UnsafeQueryError(`$lookup may only join one of this site's collections, named as text - not another database (at ${at}.from).`);
+    }
+    // `cms_<slug>` or the bare `<slug>` (the file evaluator accepts both; the
+    // MongoDB translation prefixes a bare one), never `cms__` meta stores.
+    const slug = from.startsWith(prefix) ? from.slice(prefix.length) : from;
+    if (!SITE_SLUG.test(slug)) {
+        throw new UnsafeQueryError(`$lookup may only join one of this site's collections - "${from}" is not one (at ${at}.from).`);
+    }
+    if (known && !known.has(slug)) {
+        throw new UnsafeQueryError(`$lookup names "${from}", which is not a collection on this site (at ${at}.from).`);
+    }
+}
+
+/**
+ * A structured filter (filterEngine DSL) as a MongoDB query - refused when it
+ * would carry anything `assertSafeMongoQuery` refuses.
+ *
+ * @param {Record<string, unknown>|undefined} filter
+ * @returns {object}
+ */
+export function toSafeMongoQuery(filter) {
+    if (!filter) return {};
+    assertSafeMongoQuery(filter);
+    return assertSafeMongoQuery(toMongoQuery(filter));
+}
+
+/**
+ * Every `$lookup` target named in a (checked) pipeline, at any depth.
+ *
+ * @param {unknown} value
+ * @returns {string[]} the `from` collection names
+ */
+export function lookupTargets(value) {
+    const out = new Set();
+    const walk = (node) => {
+        if (!node || typeof node !== 'object') return;
+        if (Array.isArray(node)) return node.forEach(walk);
+        for (const [k, v] of Object.entries(node)) {
+            if (k === '$lookup' && typeof v?.from === 'string') out.add(v.from);
+            walk(v);
+        }
+    };
+    walk(value);
+    return [...out];
+}
+
+/**
+ * Stage descriptors (`{type, config}`) as a MongoDB aggregation pipeline,
+ * refused when any stage would carry anything `assertSafeMongoQuery` refuses.
+ *
+ * @param {object[]} stages
+ * @param {object} [opts]
+ * @param {Set<string>|string[]} [opts.collections] - the site's collection slugs
+ * @param {(slug: string) => Promise<boolean>} [opts.collectionExists] - asked for each `$lookup` target
+ * @returns {Promise<object[]>}
+ */
+export async function toSafeMongoPipeline(stages, opts = {}) {
+    const pipeline = (Array.isArray(stages) ? stages : []).map(stage => {
+        const type = String(stage?.type || '');
+        if (PROTOTYPE_KEYS.has(type)) throw new UnsafeQueryError(`"${type}" is not a stage.`);
+        return {[type]: stage.config};
+    });
+    assertSafeMongoQuery(pipeline, opts);
+    // A copy, so the saved view is not rewritten: every $lookup names its cms_ collection.
+    const out = structuredClone(pipeline);
+    const prefixLookups = (node) => {
+        if (!node || typeof node !== 'object') return;
+        if (Array.isArray(node)) return node.forEach(prefixLookups);
+        for (const [k, v] of Object.entries(node)) {
+            if (k === '$lookup' && typeof v?.from === 'string' && !v.from.startsWith('cms_')) v.from = `cms_${v.from}`;
+            prefixLookups(v);
+        }
+    };
+    prefixLookups(out);
+    if (opts.collectionExists) {
+        for (const from of lookupTargets(out)) {
+            if (!(await opts.collectionExists(from.slice('cms_'.length)))) {
+                throw new UnsafeQueryError(`$lookup names "${from}", which is not a collection on this site.`);
+            }
+        }
+    }
+    return out;
+}

package/server/services/notification-sources.js

@@ -317,7 +317,8 @@ export async function registerCoreSources() {
 export function emailFailed(message) {
     return notify({source: 'core:email', severity: 'warning', dedupeKey: `email-failed:${day()}`, link: '#/settings',
         title: 'An email could not be sent',
-        body: `The mail server refused or could not be reached: ${String(message || '').slice(0, 300)}\n\nPassword resets and form emails may not be arriving. Check Settings > Email.`});
+        // `message` is email.js's plain text, never the mail server's own words (those are in the server log).
+        body: `${String(message || 'The mail server refused the message or could not be reached.').slice(0, 300)}\n\nPassword resets and form emails may not be arriving. Check Settings > Email; the server log has the mail server's reply.`});
 }
 
 /** email.js: no SMTP host, so mail goes to a test inbox. */