domma-cms 1.8.15 → 1.8.17

package/plugins/_lib/mail/hostGuard.js

@@ -11,14 +11,22 @@
  * the admin chose) or `allowPrivateMailHosts` is set for a site whose mail
  * server really is on its LAN.
  *
- * The pure half is `isPrivateAddress` / `isLocalName` in unsubscribe.js; this
- * module adds the lookup, which the tests inject.
+ * The address rules are core's (services/outbound.js `isBlockedAddress`, and
+ * services/mailHost.js on a signed-only site, where nothing above lifts them);
+ * `isLocalName` is unsubscribe.js's. Checking a name and then connecting by
+ * name lets a second DNS answer point the connection inward, so the
+ * connections themselves (imapPool.js, send.js) go through `pinMailHost()`:
+ * checked again, and connected to the address that was checked.
  *
  * @module _lib/mail/hostGuard
  */
 import dns from 'node:dns/promises';
 import net from 'node:net';
-import {isLocalName, isPrivateAddress} from './unsubscribe.js';
+import {getConfig} from '../../../server/config.js';
+import {isBlockedAddress} from '../../../server/services/outbound.js';
+import {MailHostRefused, normaliseMailHost, resolveMailHost} from '../../../server/services/mailHost.js';
+import {signedOnly} from '../../../server/services/codePolicy.js';
+import {isLocalName} from './unsubscribe.js';
 
 const REFUSED = 'That server is on this machine\'s own network, so the site will not connect to it. '
     + 'Use the mail server\'s public name, or ask the site administrator to allow private mail hosts.';
@@ -30,33 +38,58 @@ const REFUSED = 'That server is on this machine\'s own network, so the site will
  * @returns {string}
  */
 export function normaliseHost(host) {
-    return String(host ?? '').trim().toLowerCase().replace(/\.$/, '').replace(/^\[(.*)\]$/, '$1');
+    return normaliseMailHost(host);
+}
+
+/** Does `allowPrivate` / `ownSmtpHost` let this (self-hosted) site reach the name anywhere? */
+function exempt(name, {allowPrivate, ownSmtpHost}) {
+    return allowPrivate === true || (!!ownSmtpHost && normaliseHost(ownSmtpHost) === name);
 }
 
 /**
- * Check one host.
+ * Check one host (the save and "test these details" routes).
+ *
+ * On a signed-only (hosted) site the rules are core's services/mailHost.js and
+ * nothing the site's admin sets lifts them: loopback names or public servers,
+ * on the mail ports when `port` is given. `allowPrivate` and `ownSmtpHost`
+ * count on self-hosted sites only.
+ *
+ * Passing is not the end of it: every connection checks again and connects to
+ * the address it checked (`pinMailHost`), so a name that resolves differently
+ * later (DNS rebinding) is caught there.
  *
  * @param   {string} host
  * @param   {object} [options]
  * @param   {boolean} [options.allowPrivate]  - the site's `allowPrivateMailHosts` setting
  * @param   {string}  [options.ownSmtpHost]   - the site's configured outgoing server; always allowed
- * @param   {(host: string) => Promise<{address: string}[]>} [options.lookup] - DNS, injectable
+ * @param   {number}  [options.port]          - checked against the mail ports on a signed-only site
+ * @param   {'smtp'|'imap'} [options.kind]    - which mail ports
+ * @param   {boolean} [options.signed]        - codePolicy.signedOnly() when omitted
+ * @param   {Function} [options.lookup] - DNS, injectable
  * @returns {Promise<{ok: true} | {ok: false, error: string}>}
  */
-export async function checkMailHost(host, {allowPrivate = false, ownSmtpHost = '', lookup} = {}) {
+export async function checkMailHost(host, {allowPrivate = false, ownSmtpHost = '', lookup, port, kind = 'imap', signed} = {}) {
     const name = normaliseHost(host);
     if (!name) return {ok: false, error: 'A server is required.'};
-    if (allowPrivate) return {ok: true};
-    if (ownSmtpHost && normaliseHost(ownSmtpHost) === name) return {ok: true};
+    if (signed ?? signedOnly()) {
+        try {
+            await resolveMailHost(name, port, {kind, signed: true, anyPort: port === undefined, ...(lookup && {lookup})});
+            return {ok: true};
+        } catch (err) {
+            if (err.mailHostRefused) return {ok: false, error: err.message};
+            return {ok: true}; // unresolvable: the connection attempt says so
+        }
+    }
+    if (exempt(name, {allowPrivate, ownSmtpHost})) return {ok: true};
 
     if (net.isIP(name)) {
-        return isPrivateAddress(name) ? {ok: false, error: REFUSED} : {ok: true};
+        return isBlockedAddress(name) ? {ok: false, error: REFUSED} : {ok: true};
     }
     if (isLocalName(name)) return {ok: false, error: REFUSED};
 
     let answers;
     try {
-        answers = await (lookup ?? ((h) => dns.lookup(h, {all: true})))(name);
+        answers = await (lookup ?? ((h) => dns.lookup(h, {all: true, verbatim: true})))(name, {all: true, verbatim: true});
     } catch {
         // Unresolvable: let the connection attempt say so in its own words.
         // The check is about where a name points, not whether it exists.
@@ -65,10 +98,61 @@ export async function checkMailHost(host, {allowPrivate = false, ownSmtpHost = '
     // Every answer must be public: a name with one private A record among
     // public ones is exactly the rebinding trick the check exists for.
     const addresses = (answers ?? []).map(a => (typeof a === 'string' ? a : a?.address)).filter(Boolean);
-    if (addresses.some(isPrivateAddress)) return {ok: false, error: REFUSED};
+    if (addresses.some(isBlockedAddress)) return {ok: false, error: REFUSED};
     return {ok: true};
 }
 
+/**
+ * Is `allowPrivateMailHosts` on for a mail plugin on this site? Read from
+ * config/plugins.json for the connections made without a plugin's config in
+ * hand (email-pro's SMTP test). Never consulted on a signed-only site.
+ *
+ * @returns {boolean}
+ */
+export function pluginsAllowPrivate() {
+    try {
+        const plugins = getConfig('plugins') || {};
+        return ['mail-reader', 'email-pro'].some(n => plugins[n]?.settings?.allowPrivateMailHosts === true);
+    } catch {
+        return false;
+    }
+}
+
+/**
+ * Check a host at the moment of connecting, and say which address to connect
+ * to - the address that was checked, so a second DNS answer cannot swap an
+ * internal one in (DNS rebinding). The name is returned as `servername` for
+ * TLS (SNI and the certificate check).
+ *
+ * @param   {string} host
+ * @param   {number} port
+ * @param   {object} [options]
+ * @param   {'smtp'|'imap'} [options.kind='imap']
+ * @param   {boolean} [options.allowPrivate] - pluginsAllowPrivate() when omitted
+ * @param   {string}  [options.ownSmtpHost]  - siteSmtpHost(getConfig) when omitted
+ * @param   {boolean} [options.signed]
+ * @param   {Function} [options.lookup]
+ * @returns {Promise<{address: string, family: number, servername: string|undefined}>}
+ * @throws  {Error} MailHostRefused (`mailHostRefused`), or code ENOTFOUND
+ */
+export async function pinMailHost(host, port, {kind = 'imap', allowPrivate, ownSmtpHost, signed, lookup} = {}) {
+    const name = normaliseHost(host);
+    const isSigned = signed ?? signedOnly();
+    const opts = {kind, signed: isSigned, ...(lookup && {lookup})};
+    if (isSigned) return resolveMailHost(name, port, opts);
+    const free = exempt(name, {
+        allowPrivate: allowPrivate ?? pluginsAllowPrivate(),
+        ownSmtpHost: ownSmtpHost ?? siteSmtpHost(getConfig)
+    });
+    if (!free && !net.isIP(name) && isLocalName(name)) throw new MailHostRefused(REFUSED);
+    try {
+        return await resolveMailHost(name, port, {...opts, checkAddresses: !free});
+    } catch (err) {
+        if (err.mailHostRefused) throw new MailHostRefused(REFUSED);
+        throw err;
+    }
+}
+
 /**
  * The site's own outgoing server, from config/site.json `smtp.host` (what
  * core `createTransport` sends with), read through a getter so a test can

package/plugins/_lib/mail/imapPool.js

@@ -27,6 +27,7 @@
  * @module mail-reader/services/imapPool
  */
 import {ImapFlow} from 'imapflow';
+import {pinMailHost} from './hostGuard.js';
 
 /**
  * Identify a connection's target. A change to any of these means the cached
@@ -98,8 +99,16 @@ export function createPool(config) {
             auth = {user: auth.user, accessToken: r.accessToken};
         }
 
+        // Checked here, at every connect, and connected to the checked address
+        // (the name kept for TLS) - see hostGuard.js pinMailHost.
+        const pinned = await pinMailHost(connection.host, connection.port, {kind: 'imap', allowPrivate: config.allowPrivateMailHosts === true});
+
         const attempt = async (withAuth) => {
-            const client = new ImapFlow(clientOptions({...connection, auth: withAuth}));
+            const client = new ImapFlow({
+                ...clientOptions({...connection, auth: withAuth}),
+                host: pinned.address,
+                ...(pinned.servername && {servername: pinned.servername})
+            });
             prepare(client);
             try {
                 await client.connect();
@@ -300,7 +309,10 @@ export function createPool(config) {
     // Never hold the process open on account of an idle mail connection.
     reaper.unref?.();
 
-    return {withClient, withMailbox, test, release, releaseUser, closeAll, connectClient, get size() {
+    return {withClient, withMailbox, test, release, releaseUser, closeAll, connectClient,
+        // What send.js passes to hostGuard.js pinMailHost for this plugin's outgoing servers.
+        mailHostOptions: {allowPrivate: config.allowPrivateMailHosts === true},
+        get size() {
         return pool.size;
     }};
 }
@@ -321,7 +333,7 @@ export function createPool(config) {
  */
 export function describeError(err, connection = {}) {
     if (!err) return 'Unknown error.';
-    if (err.needsReconnect) return err.message;
+    if (err.needsReconnect || err.mailHostRefused) return err.message;
     // A signed-in (OAuth2) mailbox has no password to blame.
     if ((err.authenticationFailed || err.code === 'EAUTH' || err.code === 'EOAUTH2') && (connection.auth?.accessToken !== undefined || connection.auth?.type === 'OAuth2')) {
         return 'The mail server refused the sign-in. If it keeps happening, Reconnect the mailbox.';
@@ -366,6 +378,16 @@ export function describeError(err, connection = {}) {
         case 'ECONNRESET':
             return 'The mail server did not respond in time.';
         default:
-            return err.message || 'The mail server connection failed.';
+            // Words that are ours, or a mail server's answer to a command after
+            // it greeted and (for IMAP) signed us in - those say nothing about
+            // what else listens on a host and port.
+            if (err.name === 'MailKeyError' || err.responseStatus === 'NO' || err.responseStatus === 'BAD'
+                || err.code === 'EENVELOPE' || err.code === 'EMESSAGE') {
+                return err.message || 'The mail server connection failed.';
+            }
+            // Anything else stays out of the browser: a greeting, a banner or a
+            // socket error is exactly what a port scan reads. The log has it.
+            console.warn(`[mail] connection to ${connection.host || 'the mail server'}:${connection.port || '?'} failed${err.code ? ` (${err.code})` : ''}: ${err.message || err}`);
+            return 'The mail server connection failed. Check the server settings.';
     }
 }

package/plugins/_lib/mail/poller.js

@@ -13,6 +13,7 @@
  * @module _lib/mail/poller
  */
 import {selectDuePolls} from './pollSchedule.js';
+import {describeError} from './imapPool.js';
 
 /** How often the ticker looks for work. Finer than any poll interval. */
 const TICK_MS = 30_000;
@@ -49,7 +50,7 @@ export function createPoller({listAccounts, syncAccount, defaultMinutes, logger,
         } catch (err) {
             const failures = (entry.failures ?? 0) + 1;
             state.set(account.id, {
-                lastAttemptAt: Date.now(), failures, running: false, lastError: err.message
+                lastAttemptAt: Date.now(), failures, running: false, lastError: describeError(err)
             });
             // Warn, not error: a mail server being unreachable is an ordinary
             // condition, and the backoff already handles it.

package/plugins/_lib/mail/readRoutes.js

@@ -240,7 +240,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
     }
 
     /** Where this server may be asked to connect - see hostGuard.js. */
-    const guardHost = (host) => checkMailHost(host, {allowPrivate: config.allowPrivateMailHosts === true, ownSmtpHost: siteSmtpHost(getConfig)});
+    const guardHost = (host, port) => checkMailHost(host, {allowPrivate: config.allowPrivateMailHosts === true, ownSmtpHost: siteSmtpHost(getConfig), port, kind: 'imap'});
     // Each test is a connection attempt whose answer says what is listening: a few a minute per address is plenty.
     const testLimit = {config: {rateLimit: {max: 10, timeWindow: '1 minute'}}};
 
@@ -258,7 +258,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
 
         const result = accounts.validate(request.body ?? {}, null);
         if (!result.ok) return reply.code(400).send({error: result.error});
-        const where = await guardHost(result.value.host);
+        const where = await guardHost(result.value.host, result.value.port);
         if (!where.ok) return reply.code(400).send({error: where.error});
 
         const saved = await accounts.saveAccount(uid, null, result.value);
@@ -277,7 +277,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
         const result = accounts.validate(request.body ?? {}, existing);
         if (!result.ok) return reply.code(400).send({error: result.error});
         // A signed-in mailbox's servers are the provider's and cannot be edited here.
-        const where = result.value.oauth ? {ok: true} : await guardHost(result.value.host);
+        const where = result.value.oauth ? {ok: true} : await guardHost(result.value.host, result.value.port);
         if (!where.ok) return reply.code(400).send({error: where.error});
 
         const saved = await accounts.saveAccount(uid, request.params.id, result.value);
@@ -343,7 +343,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
                 throw err;
             }
         }
-        const where = await guardHost(result.value.host);
+        const where = await guardHost(result.value.host, result.value.port);
         if (!where.ok) return reply.code(400).send({error: where.error});
 
         let pass = result.value.password;

package/plugins/_lib/mail/scheduler.js

@@ -24,6 +24,7 @@
  */
 import * as accounts from './accounts.js';
 import {sendMessage} from './send.js';
+import {describeError} from './imapPool.js';
 
 /** How often the ticker looks for work. */
 const TICK_MS = 5_000;
@@ -118,11 +119,13 @@ export function createScheduler({store, pool, config, logger, tickMs = TICK_MS})
             // the sender is told (the send-failed notice) instead of waiting.
             const giveUp = err?.needsReconnect || (item.attempts ?? 1) >= MAX_ATTEMPTS;
             await store.finishSend(item._id, giveUp
-                ? {status: 'failed', error: err?.needsReconnect ? reconnectReason(err) : err.message}
+                // describeError: a queue item is read in the browser, and the mail
+                // server's own words are for the log (they say what listens on a port).
+                ? {status: 'failed', error: err?.needsReconnect ? reconnectReason(err) : describeError(err)}
                 // Back to pending, a little later. `finishedAt` is set either
                 // way, which is harmless on a retry and is what tells a
                 // screen when the last attempt was.
-                : {status: 'pending', at: new Date(Date.now() + RETRY_MS), error: err.message});
+                : {status: 'pending', at: new Date(Date.now() + RETRY_MS), error: describeError(err)});
 
             logger.warn(
                 `[mail] queued send ${item._id} failed (attempt ${item.attempts}): ${err.message}`
@@ -186,8 +189,8 @@ export function createScheduler({store, pool, config, logger, tickMs = TICK_MS})
             const attempts = (item.attempts ?? 0) + 1;
             const giveUp = err?.needsReconnect || attempts >= MAX_ATTEMPTS;
             await store.finishSnooze(item._id, giveUp
-                ? {status: 'failed', error: err?.needsReconnect ? `${reconnectReason(err)} The message is still in ${item.folder}.` : err.message, attempts}
-                : {status: 'pending', at: new Date(Date.now() + RETRY_MS), error: err.message, attempts});
+                ? {status: 'failed', error: err?.needsReconnect ? `${reconnectReason(err)} The message is still in ${item.folder}.` : describeError(err), attempts}
+                : {status: 'pending', at: new Date(Date.now() + RETRY_MS), error: describeError(err), attempts});
             logger.warn(
                 `[mail] could not wake snoozed message ${item._id} (attempt ${attempts}): ${err.message}`
             );

package/plugins/_lib/mail/send.js

@@ -14,6 +14,7 @@ import nodemailer from 'nodemailer';
 
 import {bareAddress, formatFrom} from '../admin/mail/identity.js';
 import {describeError} from './imapPool.js';
+import {pinMailHost} from './hostGuard.js';
 import {normalisePriority, priorityHeaders} from './priority.js';
 import {normaliseMessageSource, recordMessageAction, SOURCE_HEADER} from './message-action.js';
 
@@ -213,22 +214,31 @@ export async function sendMessage({
     // running its own mail server with a self-signed certificate has the same
     // problem in both directions, and two switches for one decision is how
     // one of them ends up wrong.
-    const transport = nodemailer.createTransport({
-        ...smtp.transport,
-        tls: {rejectUnauthorized: !allowInsecureTLS}
-    });
-    const info = await transport.sendMail({
-        envelope: {
-            // Bare, always. A display name here is not decoration the server
-            // ignores - it is a MAIL FROM the server rejects, and `smtp.from`
-            // is a free-text field somebody may well have typed a name into.
-            from: bareAddress(smtp.from),
-            to: [...addresses(draft.to), ...addresses(draft.cc), ...addresses(draft.bcc)]
-                .map(a => a.address)
-        },
-        raw
-    });
-    transport.close();
+    // The mail server's own words never leave as the error (they say what
+    // listens on a port): describeError's plain text, the detail in the log.
+    let transport;
+    let info;
+    try {
+        transport = nodemailer.createTransport({
+            ...await pinnedTransport(smtp.transport, pool?.mailHostOptions),
+            tls: {rejectUnauthorized: !allowInsecureTLS}
+        });
+        info = await transport.sendMail({
+            envelope: {
+                // Bare, always. A display name here is not decoration the server
+                // ignores - it is a MAIL FROM the server rejects, and `smtp.from`
+                // is a free-text field somebody may well have typed a name into.
+                from: bareAddress(smtp.from),
+                to: [...addresses(draft.to), ...addresses(draft.cc), ...addresses(draft.bcc)]
+                    .map(a => a.address)
+            },
+            raw
+        });
+    } catch (err) {
+        throw plainSendError(err, smtp.transport);
+    } finally {
+        transport?.close();
+    }
 
     const messageAction = await recordMessageAction({
         source: draft.sourceMessage, account, pool, poolKey, connection, store
@@ -383,15 +393,54 @@ async function findSentFolder(pool, poolKey, connection) {
     return findSpecialFolder(pool, poolKey, connection, '\\Sent');
 }
 
+/**
+ * A send failure as plain words. Our own errors (a refused host, a mailbox that
+ * needs signing in again) pass as they are; anything from the server or the
+ * library becomes describeError()'s text, keeping `code` so a caller can still
+ * tell an authentication failure from the rest.
+ *
+ * @param   {Error} err
+ * @param   {object} transportConfig
+ * @returns {Error}
+ */
+export function plainSendError(err, transportConfig = {}) {
+    if (!err || err.needsReconnect || err.mailHostRefused || err.name === 'MailKeyError') return err;
+    const plain = new Error(describeError(err, transportConfig));
+    if (err.code) plain.code = err.code;
+    if (err.responseCode) plain.responseCode = err.responseCode;
+    return plain;
+}
+
+/**
+ * A mailbox's transport settings with the host checked and pinned: connect to
+ * the address hostGuard.js checked, keep the name for TLS. Throws when the
+ * host or port is refused, or the name does not resolve.
+ *
+ * @param   {object} transportConfig - {host, port, ...}
+ * @param   {{allowPrivate?: boolean}} [guard] - the plugin's allowPrivateMailHosts, when the caller has it
+ * @returns {Promise<object>}
+ */
+export async function pinnedTransport(transportConfig, guard = {}) {
+    const port = Number(transportConfig.port) || (transportConfig.secure ? 465 : 587);
+    const {address, servername} = await pinMailHost(transportConfig.host, port, {kind: 'smtp', ...(guard || {})});
+    return {...transportConfig, port, host: address, ...(servername && {servername})};
+}
+
 /**
  * Try the outgoing server without sending anything.
  *
  * @param   {object} transportConfig
  * @returns {Promise<{ok: boolean, error?: string}>}
  */
-export async function verifySmtp(transportConfig, allowInsecureTLS = false) {
+export async function verifySmtp(transportConfig, allowInsecureTLS = false, guard = undefined) {
+    let pinned;
+    try {
+        pinned = await pinnedTransport(transportConfig, guard);
+    } catch (err) {
+        return {ok: false, error: describeError(err, transportConfig)};
+    }
     const transport = nodemailer.createTransport({
-        ...transportConfig,
+        ...pinned,
         connectionTimeout: 10_000,
         tls: {rejectUnauthorized: !allowInsecureTLS}
     });

package/plugins/free-tier.lock.json

@@ -1,6 +1,6 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@ddb1e0c",
+  "source": "dcms-marketplace@af8baa8",
   "plugins": {
     "blog": {
       "version": "1.10.1",
@@ -165,9 +165,9 @@
       }
     },
     "security": {
-      "version": "1.2.0",
+      "version": "1.2.1",
       "files": {
-        "CLAUDE.md": "c4a8cedeff2af492871d2b9af446c6b73792881f4e428e189516105508bc07e5",
+        "CLAUDE.md": "1aabef04e77d9bd10ead195851a75c358b5c6657a57ad217495cf7b5b0d63538",
         "admin/lib/blocks.js": "5ef346b7de751518f8beb9212e3b89b270ae236560ae3d8a1f40d129c50918ff",
         "admin/lib/health.js": "3b233a3d29b2d69c333321602c13233b8221cfe1114aa03903739d9ae8ad65d5",
         "admin/lib/ip.js": "cf33be4fa2e2cad37bafd12ebec17f293891a88de402caad1bf9c9a57ce87680",
@@ -183,11 +183,12 @@
         "config.js": "e6a00f7816637687d6a68ebbac65a71489246a926c28523c2a78d859e75b7ae0",
         "docs/guide.md": "a27d5303f9146057fd79c2093d7476ada1a5ee4fd14d34df7f94ad8555d88ca0",
         "plugin.js": "9d3a2e8b56dd637407c8abd93252dda9f67042231bc79d35771f766a62022c14",
-        "plugin.json": "5cf525d76b1f043a475268f8d37622bdb53120e0c34a1068930d7fcff88ea686",
+        "plugin.json": "c7ebf55a71048e914ca8e6d2f042fb099123367e1e6fd694cfbf9eb2e4146852",
         "server/common-passwords.NOTICE": "3b148a49a569bfa24feaa7879db602da8f0607fa61ab6c52b7a62391fc7c009a",
         "server/common-passwords.txt": "68782d6a4a19a4768d5f15dd66bd534e7a33055cc755411e33f16d18c50fdcce",
-        "server/facts.js": "25538a8d1cfe012688fceb8ec0d0dd7b43ac9e168430723d6fb731183701fb46",
+        "server/facts.js": "8dbf6802acd9103fe4ca8d5e7d2dfc97c169df6d47bea72b33411cd22fee597b",
         "server/state.js": "1319b322e94a4aec176948990b2d674b28dfece761eef4d5685df474037bfc4a",
+        "tests/facts.test.js": "dc59d307033c7a9887b4d522bccd9e9d4986b6ed5cb4ffe1287282a93f54cb11",
         "tests/screen-state.test.js": "5349273cf7cfe526a05f929115a6e4e66287e6fb05b252ea859e182e88e3925e",
         "tests/security.test.js": "f0cb70dcb28bc8b3de8d3b39064616296382c5b0f97bfd615ee8e24fe3b031bc"
       }

package/plugins/security/CLAUDE.md

@@ -24,7 +24,10 @@ Ships with the engine (free tier, `make sync-free-tier`); switched ON when it fi
   `kind: 'reset'` lines - their `ok` is not a sign-in. Older engines never emit the event: nothing changes there.
 - **Health check**: `server/facts.js` gathers (users, engine vs npm latest, certificate via tls, security headers of the
   public home page, private paths fetched LOCALLY, TRUST_PROXY, bind, SMTP, licences); `admin/lib/health.js` judges.
-  Unknown = 'info', never a pass. Cached 10 min; the sidebar badge (`/count`) = checks needing attention, red only
+  Unknown = 'info', never a pass. The public checks (headers, HTTPS, certificate) connect ONLY to `publicTarget()`:
+  site.json `baseUrl`/`url` when it is a public name (every DNS answer public), else the admin's own Host but only
+  when it resolves to one of this server's public interface addresses - never a host a visitor names (1.2.1). The
+  connection is pinned to the checked address (no second DNS lookup). Cached 10 min; the sidebar badge (`/count`) = checks needing attention, red only
   when a failing check is critical.
 - Engines before 0.83 have no sign-in checks: the plugin logs it, the screen says so, lockout/rules are off.
 - plugin.json `minCmsVersion: "0.83.0"` (1.1.1) states that floor; core enforces it at install/update from the release after 0.92.1,
@@ -63,3 +66,8 @@ what strangers typed). Public data (emails, addresses, user-agents) only through
   `security.rule-draft.<user>`. Pure parts in `admin/lib/screen-state.js` (Pro's copy adds Audit and 2FA).
 - Every list: click/Enter/Shift+F10/right-click/⋮ open the row menu (a check row opens its details on click). Filter
   counts follow the search; skeletons; help popovers started after mount. Keep this screen alike with Security Pro's.
+
+## 1.2.1 (2026-10-16)
+
+- Health check: the headers/certificate fetch no longer goes to whatever Host / X-Forwarded-Host a request carried
+  (a forged one made the server connect anywhere). `publicTarget()` in server/facts.js; `tests/facts.test.js`.

package/plugins/security/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "security",
   "displayName": "Security",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "tier": "free",
   "description": "Keeps a Domma CMS site safe: a health check of what is weak and how to fix it, sign-in lockout after repeated wrong passwords, password rules, a log of every sign-in, and blocking of the scanners that probe every site for WordPress, .env files and the like.",
   "author": "Domma CMS",
-  "date": "2026-10-15",
+  "date": "2026-10-16",
   "minCmsVersion": "0.83.0",
   "icon": "shield",
   "permissions": [