home-hosted 0.7.6 → 0.7.8

package/dist/cli.js

@@ -2437,6 +2437,11 @@ function createAuthRoute(deps) {
 			statusCode: 400,
 			code: "EXPOSED_WITHOUT_PASSWORD"
 		});
+		const proxyExposure = checkProxyExposure(deps.proxy.config, false, false, false);
+		if (proxyExposure !== null) throw new DetailedError(proxyExposure, {
+			statusCode: 400,
+			code: "PROXY_EXPOSURE_BLOCKED"
+		});
 		deps.auth.clearPassword();
 		deps.panel.settings.updateControl({ auth: { enabled: false } });
 		return c.json({ ok: true });
@@ -6028,9 +6033,20 @@ var init_logs = __esmMin((() => {
 }));
 //#endregion
 //#region src/api/metrics.ts
+/**
+* Escapes a value for the quoted form of a Prometheus label, per the exposition
+* format: only `\\`, `"` and a newline are special, and each needs a backslash.
+*
+* A raw Windows path is the reachable case — `diskPaths` is user config and
+* `C:\Users\me` emits `\U`, which is not a valid escape, so the scraper rejects the
+* whole sample. The ids are charset-constrained by their schemas, but the paths are not.
+*/
+function labelValue(value) {
+	return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n");
+}
 /** A server id repeats across workspaces, so every sample names both. */
 function labels(server) {
-	return `server="${server.id}",workspace="${server.workspaceId ?? ""}"`;
+	return `server="${labelValue(server.id)}",workspace="${labelValue(server.workspaceId ?? "")}"`;
 }
 /**
 * Prometheus text for whatever wants to scrape the panel (Beszel, Grafana,
@@ -6061,7 +6077,7 @@ function createMetricsRoute(deps) {
 		metric("hh_server_response_ms", "Last health probe latency in milliseconds", servers.filter((server) => server.responseMs !== null).map((server) => `hh_server_response_ms{${labels(server)}} ${server.responseMs}`));
 		metric("hh_server_rss_bytes", "RSS of the server process tree", servers.filter((server) => server.resources?.rssBytes != null).map((server) => `hh_server_rss_bytes{${labels(server)}} ${server.resources.rssBytes}`));
 		metric("hh_server_cpu_percent", "CPU percent of the server process tree", servers.filter((server) => server.resources?.cpuPercent != null).map((server) => `hh_server_cpu_percent{${labels(server)}} ${server.resources.cpuPercent}`));
-		metric("hh_host_disk_used_percent", "Disk usage percent per configured path", host.disks.map((disk) => `hh_host_disk_used_percent{mount="${disk.path}"} ${disk.usedPercent.toFixed(2)}`));
+		metric("hh_host_disk_used_percent", "Disk usage percent per configured path", host.disks.map((disk) => `hh_host_disk_used_percent{mount="${labelValue(disk.path)}"} ${disk.usedPercent.toFixed(2)}`));
 		metric("hh_host_memory_used_percent", "Memory usage percent", [`hh_host_memory_used_percent ${host.memoryUsedPercent.toFixed(2)}`]);
 		metric("hh_host_swap_used_percent", "Swap usage percent", [`hh_host_swap_used_percent ${host.swapUsedPercent.toFixed(2)}`]);
 		metric("hh_host_load1_per_cpu", "1 minute load average per cpu", [`hh_host_load1_per_cpu ${((host.loadAvg[0] ?? 0) / Math.max(1, host.cpus)).toFixed(3)}`]);
@@ -6561,7 +6577,29 @@ function splitCommandLine(line) {
 	let current = "";
 	let quoted = false;
 	let started = false;
-	for (const char of line.trim()) {
+	const chars = [...line.trim()];
+	for (let index = 0; index < chars.length; index += 1) {
+		const char = chars[index];
+		if (char === "\\") {
+			let run = 0;
+			while (chars[index + run] === "\\") run += 1;
+			if (chars[index + run] !== "\"") {
+				current += "\\".repeat(run);
+				started = true;
+				index += run - 1;
+				continue;
+			}
+			current += "\\".repeat(Math.floor(run / 2));
+			started = true;
+			if (run % 2 === 1) {
+				current += "\"";
+				index += run;
+				continue;
+			}
+			quoted = !quoted;
+			index += run;
+			continue;
+		}
 		if (char === "\"") {
 			quoted = !quoted;
 			started = true;
@@ -9425,7 +9463,7 @@ function createServersRoute(deps) {
 		responses: {
 			201: {
 				description: "Created",
-				content: jsonBody(serverResponse)
+				content: jsonBody(storedServerResponse)
 			},
 			400: ERROR_RESPONSES[400]
 		}
@@ -9618,7 +9656,7 @@ function createServersRoute(deps) {
 		responses: {
 			200: {
 				description: "The server",
-				content: jsonBody(serverResponse)
+				content: jsonBody(storedServerResponse)
 			},
 			400: ERROR_RESPONSES[400],
 			404: ERROR_RESPONSES[404]
@@ -9660,7 +9698,7 @@ function createServersRoute(deps) {
 		}
 	});
 }
-var idParam$1, MAX_PENDING_WRITES, serverResponse, serversResponse, okResponse, bufferedLogsQuery;
+var idParam$1, MAX_PENDING_WRITES, serverResponse, serversResponse, storedServerResponse, okResponse, bufferedLogsQuery;
 var init_$_routes$1 = __esmMin((() => {
 	init_store();
 	init_action_result();
@@ -9674,6 +9712,7 @@ var init_$_routes$1 = __esmMin((() => {
 	MAX_PENDING_WRITES = 200;
 	serverResponse = type({ server: serverViewSchema });
 	serversResponse = type({ servers: serverViewSchema.array() });
+	storedServerResponse = type({ server: serverSchema });
 	okResponse = type({ ok: "boolean" });
 	bufferedLogsQuery = logQuerySchema.merge(workspaceQuerySchema);
 }));
@@ -9736,6 +9775,11 @@ function createSettingsRoute(deps) {
 			statusCode: 400,
 			code: "EXPOSURE_BLOCKED"
 		});
+		const proxyExposure = checkProxyExposure(deps.proxy.config, patch.control?.auth?.enabled ?? current.auth.enabled, deps.auth.passwordSet, deps.auth.usingDefaultPassword);
+		if (proxyExposure !== null) throw new DetailedError(proxyExposure, {
+			statusCode: 400,
+			code: "PROXY_EXPOSURE_BLOCKED"
+		});
 		const previous = {
 			trustProxy: current.auth.trustProxy,
 			tlsEnabled: current.tls.enabled