dsh-notify-me 1.14.0 → 1.14.1

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 All notable changes to **dsh-notify-me** are documented here.
 
+## [1.14.1] — 2026-10-23
+
+### 修复
+
+- **抬窗路由的 CSRF 闸门换成本地性校验**：1.14.0 把 `x-dsh-notify-me-focus: focus` 头当成防线，理由写的是「跨源页面带这个头要先过预检」。这条对 DNS rebinding 不成立——rebinding 出来的页面和目标地址同源，能带任意自定义头、不会触发预检。现在改成三层：对端地址必须 loopback；`Host` 必须是 loopback 名（`127.0.0.1` / `localhost` / `[::1]`，可带端口）；带了 `Origin` 就必须与 `Host` 同源。任一条不满足回 `403`，`reason` 写 `bad-remote` / `bad-host` / `cross-origin`。依据是 [@xinming-chenniang 在 #10446 的复测](https://github.com/deepseek-ai/deepseek-harness/discussions/10446#discussioncomment-19145735)。
+- **`Host` 这一层是真正的分界**：壳转发 `dsh-app://app` 时会把 `host` 一起删掉，由 fetch 按 loopback URL 重填，所以桌面页面永远带 loopback 的 `Host`；rebinding 的页面 Host 仍是攻击者域名。自定义头保留，但只当「这是页面发的」标记，不再承担安全职责。
+- **`OPTIONS` 一律 `405` 且从不回 CORS 头**：预检不会被应答，跨源页面拿不到放行。
+
+### 测试
+
+- cordis 冒烟的路由段补五组断言：外边 `Host` → `403 bad-host`；非 loopback 对端 → `403 bad-remote`；跨源 `Origin` → `403 cross-origin`；同源 `Origin` 通过闸门后走到 `501`；换端口的 `Origin` 也算跨源；预检 `OPTIONS` → `405`。假请求补齐 `socket.remoteAddress` 与默认 `Host`。
+- 另用真 socket 复现过 1.14.0 的行为：`POST` 带 `Host: evil.example` + 跨源 `Origin` 仍返回 `200 focused:true`（打进 OS 激活路径），硬化后同样请求回 `403 bad-host`。`npm test` 全绿。
+
+### 文档
+
+- 中英 README 与 `docs/listing.md` 的安全段改口径：不再说「自定义头挡跨源」，改成本地性三层闸门与各自的 `reason`。
+
 ## [1.14.0] — 2026-10-23
 
 ### 新增

package/README.en.md

@@ -299,7 +299,9 @@ The raise order is adaptive and comes from the five-method table measured in [di
 
 Measured with `powershell.exe` 5.1 in one round: window in front ×3, minimized with Notepad in front ×3, visible but covered ×3 — all `FOCUSED=1` with the foreground comparison matching and every `IsIconic` flipped back to `false`; Notepad maximized, minimized plus maximized, and `-ProcessId 0` auto-detection all succeeded too. Script-internal time peaked at 434 ms, process wall time at 782 ms, well inside the 8 s cap; `pwsh` 7.6 behaved identically, only slower by ~100 ms compiling the `Add-Type` helpers (the script avoids PowerShell 7 syntax on purpose). A pid that does not exist and a pid with no visible window both settle on `FOCUSED=0` and `exit 0`.
 
-The route is a single exact path and says no by default: non-POST answers `405`, a non-Desktop host (Web, macOS / Linux, plain Node) `501`, a missing `x-dsh-notify-me-focus: focus` header `403`. A cross-origin page would have to pass a preflight to send that header and the route allows no CORS at all, so other sites in the browser cannot drive it. A `GET` returns `{ok, route, enabled, desktop, platform}` so you can check the route from a browser after installing. Calls within 400 ms coalesce into one, and a script that has not answered after 8 s is killed and counted as a failure.
+The route is a single exact path and says no by default: anything other than `GET` / `HEAD` / `POST` answers `405` (including a preflight `OPTIONS`, and the route never returns a CORS header), a non-Desktop host (Web, macOS / Linux, plain Node) `501`, and a missing `x-dsh-notify-me-focus: focus` header `403`.
+
+That header is a "this came from the page" marker, not the defence: a DNS-rebinding page is same-origin with the address it resolved, so it can send any custom header and no preflight fires. The gate is three checks — the peer address must be loopback; `Host` must be a loopback name (`127.0.0.1` / `localhost` / `[::1]`, port optional), because the shell deletes `host` when forwarding and the fetch refills it from the loopback URL while a rebound page keeps its own name; and an `Origin`, when present, must agree with that `Host`. A failure answers `403` with `reason` set to `bad-remote`, `bad-host` or `cross-origin`. A `GET` returns `{ok, route, enabled, desktop, platform}` so you can check the route from a browser after installing. Calls within 400 ms coalesce into one, and a script that has not answered after 8 s is killed and counted as a failure.
 
 A few cases still will not raise, and they answer `202` with the conversation switch intact: a target window owned by a higher integrity level (elevated / UAC), a window on another virtual desktop, or a foreground that keeps getting stolen. A tray-hidden window (`SW_HIDE` rather than minimized) is filtered out as well; DSH does not do that today.
 

package/README.md

@@ -294,7 +294,9 @@ DSH Desktop 是一层 Electron 壳，页面跑在 `dsh-app://app` 下：DOM 的
 
 实测（`powershell.exe` 5.1，同一轮跑完）：窗口在前台 ×3、最小化 + 记事本在前台 ×3、可见但被盖住 ×3，全部 `FOCUSED=1` 且前台窗口比对一致，最小化那几个的 `IsIconic` 都从 `true` 变回 `false`；记事本最大化完全遮挡、最小化 + 完全遮挡、`-ProcessId 0` 自动探测同样成功。脚本内部耗时最坏 434 ms，进程启动到退出最坏 782 ms，都在 8 秒上限内；`pwsh` 7.6 对照一轮行为一致，只是 `Add-Type` 编译慢约 100 ms（脚本刻意不用 7 的语法）。不存在的 pid、存在但没有可见窗口的 pid 都稳定 `FOCUSED=0` 并 `exit 0`。
 
-安全上只开一条 exact 路由：非 POST 回 `405`，非桌面宿主（Web 版、macOS / Linux、纯 Node）回 `501`，缺了 `x-dsh-notify-me-focus: focus` 头回 `403`——跨源页面要带这个头得先过 preflight，而路由不放行任何 CORS 头，所以浏览器里别的站点调不动它。`GET` 只回 `{ok, route, enabled, desktop, platform}`，装完可以先用浏览器打开确认路由在不在。400 毫秒内的重复调用合并成一次，脚本超过 8 秒没回话就 kill 掉按失败处理。
+安全上只开一条 exact 路由。词表之外的请求一律拒：非 GET / HEAD / POST 回 `405`（包括预检的 `OPTIONS`，且从不回任何 CORS 头），非桌面宿主（Web 版、macOS / Linux、纯 Node）回 `501`，缺 `x-dsh-notify-me-focus: focus` 头回 `403`。
+
+那个头只是「这是页面发来的」标记，不是防线——DNS rebinding 的恶意页对目标地址而言是同源的，能带任意自定义头、也不触发预检。真正的闸门是三层：对端地址必须是 loopback；`Host` 必须是 loopback 名（`127.0.0.1` / `localhost` / `[::1]`，可带端口），因为壳转发时 `host` 已被删掉、由 fetch 按 loopback URL 重填，而 rebinding 的页面 Host 仍是攻击者域名；带了 `Origin` 就必须和 `Host` 同源。任一条不符回 `403`，`reason` 分别是 `bad-remote` / `bad-host` / `cross-origin`。`GET` 只回 `{ok, route, enabled, desktop, platform}`，装完可以先用浏览器打开确认路由在不在。400 毫秒内的重复调用合并成一次，脚本超过 8 秒没回话就 kill 掉按失败处理。
 
 抬不起来的场合还剩几种，都会如实回 `202`、对话照常切：目标窗口属于更高完整性级别（提权 / UAC）、窗口在另一个虚拟桌面、前台被别的进程反复抢回去。托盘隐藏（`SW_HIDE` 而非最小化）的窗口也选不到，DSH 当前不会这样。
 

package/lib/client.js

@@ -2230,7 +2230,7 @@
       });
     } catch (e) {}
     // keep in sync with package.json "version" on every release
-    api.version = "1.14.0";
+    api.version = "1.14.1";
     api.setConfig = function (patch) { return setConfigLocal(patch); };
     api.resetConfig = function () {
       try {

package/lib/index.js

@@ -24,9 +24,10 @@ import { fileURLToPath } from "node:url";
 export const FOCUS_ROUTE = "/__dsh-notify-me/focus-window";
 
 /**
- * Request header proving the caller is page code. A cross-origin page cannot
- * send a custom header without a CORS preflight, which this route never
- * answers, so the header doubles as the CSRF gate.
+ * Request header proving the caller is page code, sent by the notification
+ * click. It is an intent marker, not the security boundary: a DNS-rebinding
+ * page is same-origin with the address it resolved, so it can send any custom
+ * header without a CORS preflight. The gate is {@link gateRequest}.
  */
 const RAISE_HEADER = "x-dsh-notify-me-focus";
 
@@ -214,6 +215,76 @@ function raiseWindow() {
   return pendingRaise;
 }
 
+/**
+ * Strip the IPv6 brackets a `Host` header may carry.
+ * @param hostname - bare hostname.
+ * @returns the comparable form.
+ */
+function bareHostname(hostname) {
+  return hostname.toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
+}
+
+/**
+ * @param hostname - bare hostname (brackets tolerated).
+ * @returns whether it names the loopback interface.
+ */
+function isLoopbackHostname(hostname) {
+  const text = bareHostname(hostname);
+  if (text === "localhost" || text === "::1") return true;
+  return /^127(?:\.\d{1,3}){3}$/.test(text);
+}
+
+/**
+ * @param value - raw `Host` header (`127.0.0.1:3080`, `[::1]:3080`, `localhost`).
+ * @returns `{ hostname, port }`, or `null` when it is not a host at all.
+ */
+function splitHost(value) {
+  if (typeof value !== "string") return null;
+  const text = value.trim();
+  const bracketed = text.match(/^\[([^\]]+)\](?::(\d{1,5}))?$/);
+  if (bracketed !== null) return { hostname: bracketed[1], port: bracketed[2] ?? "" };
+  const plain = text.match(/^([A-Za-z0-9._-]+)(?::(\d{1,5}))?$/);
+  if (plain === null) return null;
+  return { hostname: plain[1], port: plain[2] ?? "" };
+}
+
+/**
+ * Refuse a request that did not come from this machine's own page.
+ *
+ * The shell already rejects a foreign `Origin` before forwarding, but the route
+ * also answers plain HTTP on the host port, and a DNS-rebinding page reaches
+ * that port while looking same-origin to the browser — it can send any header,
+ * including {@link RAISE_HEADER}, and no preflight fires. What it cannot forge
+ * is the connection's source address (loopback: it is on this machine, so no)
+ * or the `Host` header: the shell deletes the original and the fetch re-fills
+ * it from the loopback URL, while a rebound page keeps its own name.
+ *
+ * So the gate is: loopback peer, loopback `Host`, and an `Origin` that agrees
+ * with that `Host` when one is present.
+ * @param req - the incoming request.
+ * @returns a short refusal reason, or `null` when the request may proceed.
+ */
+function gateRequest(req) {
+  const remote = req.socket?.remoteAddress ?? "";
+  if (!isLoopbackHostname(String(remote).replace(/^::ffff:/i, ""))) return "bad-remote";
+  const host = splitHost(req.headers.host);
+  if (host === null || !isLoopbackHostname(host.hostname)) return "bad-host";
+  const origin = req.headers.origin;
+  if (typeof origin !== "string" || origin.length === 0) return null;
+  if (origin === "dsh-app://app") return null; // the desktop page, if not stripped
+  let parsed;
+  try {
+    parsed = new URL(origin);
+  } catch {
+    return "cross-origin";
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return "cross-origin";
+  const defaultPort = parsed.protocol === "https:" ? "443" : "80";
+  if (bareHostname(parsed.hostname) !== bareHostname(host.hostname)) return "cross-origin";
+  if ((parsed.port || defaultPort) !== (host.port || defaultPort)) return "cross-origin";
+  return null;
+}
+
 /**
  * Write a JSON response. Route handlers own the whole response lifecycle.
  * @param res - the server response.
@@ -238,6 +309,15 @@ function respond(res, status, body) {
 function createHandler() {
   return function handleFocus(req, res) {
     const method = req.method ?? "GET";
+    if (method !== "GET" && method !== "HEAD" && method !== "POST") {
+      respond(res, 405, { ok: false, reason: "method-not-allowed" });
+      return;
+    }
+    const refusal = gateRequest(req);
+    if (refusal !== null) {
+      respond(res, 403, { ok: false, reason: refusal });
+      return;
+    }
     if (method === "GET" || method === "HEAD") {
       respond(res, 200, {
         ok: true,
@@ -248,10 +328,6 @@ function createHandler() {
       });
       return;
     }
-    if (method !== "POST") {
-      respond(res, 405, { ok: false, reason: "method-not-allowed" });
-      return;
-    }
     if (!focusAvailable()) {
       respond(res, 501, { ok: false, reason: "unsupported-host", platform: process.platform });
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-notify-me",
-  "version": "1.14.0",
+  "version": "1.14.1",
   "description": "离开 DSH 页面也能收到提醒：需要你操作 / 后台回复完成时发系统通知、标题标记与提示音，支持审批快捷裁决与外部推送，Web 版与桌面版均可用。",
   "license": "MIT",
   "type": "module",