hookarmor 1.0.3 → 1.1.0

package/src/netguard.js

@@ -0,0 +1,117 @@
+const net = require('net');
+const dns = require('dns');
+
+// Outbound address policy for delivery targets and alert webhooks.
+// 'metadata' addresses are always blocked; 'private' ones only in strict mode.
+
+function parseIPv4(ip) {
+  const parts = ip.split('.');
+  if (parts.length !== 4) return null;
+  const octets = parts.map(Number);
+  return octets.every((o) => Number.isInteger(o) && o >= 0 && o <= 255) ? octets : null;
+}
+
+// Expand an IPv6 address (with optional embedded IPv4 tail) into 8 16-bit groups
+function parseIPv6(ip) {
+  let addr = ip.replace(/^\[|\]$/g, '').split('%')[0];
+  const v4Tail = addr.match(/(\d+\.\d+\.\d+\.\d+)$/);
+  if (v4Tail) {
+    const o = parseIPv4(v4Tail[1]);
+    if (!o) return null;
+    addr = addr.slice(0, -v4Tail[1].length) + `${((o[0] << 8) | o[1]).toString(16)}:${((o[2] << 8) | o[3]).toString(16)}`;
+  }
+  const halves = addr.split('::');
+  if (halves.length > 2) return null;
+  const head = halves[0] ? halves[0].split(':') : [];
+  const tail = halves.length === 2 && halves[1] ? halves[1].split(':') : [];
+  const fill = halves.length === 2 ? 8 - head.length - tail.length : 0;
+  const groups = [...head, ...Array(fill).fill('0'), ...tail].map((g) => parseInt(g, 16));
+  return groups.length === 8 && groups.every((g) => g >= 0 && g <= 0xffff) ? groups : null;
+}
+
+function classifyIPv4([a, b, c, d]) {
+  if (a === 169 && b === 254) return 'metadata'; // link-local, incl. AWS/GCP/Azure metadata
+  if (a === 100 && b === 100 && c === 100 && d === 200) return 'metadata'; // Alibaba metadata
+  if (
+    a === 0 || a === 10 || a === 127 ||
+    (a === 172 && b >= 16 && b <= 31) ||
+    (a === 192 && b === 168) ||
+    (a === 100 && b >= 64 && b <= 127) || // carrier-grade NAT
+    (a === 198 && (b === 18 || b === 19)) ||
+    a >= 224 // multicast, reserved, broadcast
+  ) return 'private';
+  return 'public';
+}
+
+function classifyIp(ip) {
+  const host = ip.replace(/^\[|\]$/g, '');
+  if (net.isIPv4(host)) return classifyIPv4(parseIPv4(host));
+  if (!net.isIPv6(host)) return 'invalid';
+  const g = parseIPv6(host);
+  if (!g) return 'invalid';
+  const v4 = [g[6] >> 8, g[6] & 0xff, g[7] >> 8, g[7] & 0xff];
+  // IPv4-mapped (::ffff:0:0/96) and NAT64 (64:ff9b::/96) carry an IPv4 address
+  if (g.slice(0, 5).every((x) => x === 0) && g[5] === 0xffff) return classifyIPv4(v4);
+  if (g[0] === 0x64 && g[1] === 0xff9b && g.slice(2, 6).every((x) => x === 0)) return classifyIPv4(v4);
+  if (g[0] === 0xfd00 && g[1] === 0x0ec2 && g.slice(2, 7).every((x) => x === 0) && g[7] === 0x254) return 'metadata'; // AWS IMDS IPv6
+  if (g.every((x) => x === 0)) return 'private'; // ::
+  if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return 'private'; // ::1
+  if ((g[0] & 0xfe00) === 0xfc00) return 'private'; // fc00::/7 unique local
+  if ((g[0] & 0xffc0) === 0xfe80) return 'private'; // fe80::/10 link-local
+  if ((g[0] & 0xff00) === 0xff00) return 'private'; // multicast
+  return 'public';
+}
+
+function isBlockedIp(ip, strict) {
+  const cls = classifyIp(ip);
+  return cls === 'invalid' || cls === 'metadata' || (strict && cls === 'private');
+}
+
+// Synchronous check of the URL itself (scheme, literal IPs, well-known internal names).
+// Hostnames are re-checked after DNS resolution at request time via guardedLookup().
+function checkUrl(urlString, strict = false) {
+  let parsed;
+  try {
+    parsed = new URL(urlString);
+  } catch (e) {
+    return { ok: false, reason: 'Invalid URL' };
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    return { ok: false, reason: 'Only http and https URLs are allowed' };
+  }
+  const host = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+  if (net.isIP(host)) {
+    return isBlockedIp(host, strict) ? { ok: false, reason: `Address ${host} is not allowed` } : { ok: true };
+  }
+  if (host === 'metadata.google.internal' || host === 'metadata') {
+    return { ok: false, reason: `Host ${host} is not allowed` };
+  }
+  if (strict && (host === 'localhost' || host.endsWith('.localhost') || host.endsWith('.internal') || host.endsWith('.local'))) {
+    return { ok: false, reason: `Host ${host} is not allowed` };
+  }
+  return { ok: true };
+}
+
+// DNS lookup for http.request that refuses blocked addresses, so a public hostname
+// cannot resolve (or re-resolve) to an internal address at delivery time.
+function guardedLookup(strict = false) {
+  return (hostname, options, callback) => {
+    if (typeof options === 'function') {
+      callback = options;
+      options = {};
+    }
+    dns.lookup(hostname, options, (err, address, family) => {
+      if (err) return callback(err);
+      const list = Array.isArray(address) ? address : [{ address, family }];
+      const blocked = list.find((a) => isBlockedIp(a.address, strict));
+      if (blocked) {
+        const e = new Error(`Destination ${hostname} resolves to blocked address ${blocked.address}`);
+        e.code = 'EBLOCKEDADDRESS';
+        return callback(e);
+      }
+      callback(null, address, family);
+    });
+  };
+}
+
+module.exports = { checkUrl, guardedLookup, isBlockedIp, classifyIp };

package/src/public/index.html

@@ -524,6 +524,10 @@
               <label>Discord / Slack Alert Webhook</label>
               <input type="text" id="inp-ep-alert" class="form-control" placeholder="https://discord.com/api/webhooks/...">
             </div>
+            <div class="form-group">
+              <label>Provider Signing Secret (optional; leave blank to keep the current one)</label>
+              <input type="password" id="inp-ep-secret" class="form-control" placeholder="whsec_..." autocomplete="off">
+            </div>
             <button class="btn btn-primary btn-sm" onclick="saveEndpoint()">Save Endpoint</button>
           </div>
 
@@ -677,6 +681,23 @@
     let cachedLeads = [];
     let ws = null;
 
+    // Escape untrusted values (webhook payloads, headers, target responses, signups) before HTML insertion
+    function esc(value) {
+      return String(value === undefined || value === null ? '' : value)
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+    }
+
+    // CSV cell: quote, double inner quotes, and neutralise spreadsheet formula prefixes (=+-@)
+    function csvCell(value) {
+      let v = String(value === undefined || value === null ? '' : value);
+      if (/^[=+\-@\t\r]/.test(v)) v = "'" + v;
+      return `"${v.replace(/"/g, '""')}"`;
+    }
+
     function getApiKey() {
       // Stored strictly in ephemeral sessionStorage (destroyed when tab is closed)
       return sessionStorage.getItem('ha_admin_session') || '';
@@ -731,6 +752,10 @@
       if (key && key.trim()) {
         sessionStorage.setItem('ha_admin_session', key.trim());
         updateAdminUI();
+        if (ws) ws.close();
+        loadEndpoints();
+        loadStats();
+        loadEvents();
       }
     }
 
@@ -750,10 +775,10 @@
       } else {
         tbody.innerHTML = cachedLeads.map(l => `
           <tr>
-            <td style="padding: 0.6rem 0.8rem; font-family: var(--font-mono); font-size: 0.8rem;">#${l.id}</td>
-            <td style="padding: 0.6rem 0.8rem; font-weight: 600; color: #60a5fa;">${l.email}</td>
-            <td style="padding: 0.6rem 0.8rem; color: var(--text-muted); font-size: 0.8rem;">${l.source}</td>
-            <td style="padding: 0.6rem 0.8rem; color: var(--text-muted); font-size: 0.8rem;">${l.created_at}</td>
+            <td style="padding: 0.6rem 0.8rem; font-family: var(--font-mono); font-size: 0.8rem;">#${esc(l.id)}</td>
+            <td style="padding: 0.6rem 0.8rem; font-weight: 600; color: #60a5fa;">${esc(l.email)}</td>
+            <td style="padding: 0.6rem 0.8rem; color: var(--text-muted); font-size: 0.8rem;">${esc(l.source)}</td>
+            <td style="padding: 0.6rem 0.8rem; color: var(--text-muted); font-size: 0.8rem;">${esc(l.created_at)}</td>
           </tr>
         `).join('');
       }
@@ -769,7 +794,7 @@
         alert('No leads to export.');
         return;
       }
-      const csvContent = 'id,email,source,created_at\n' + cachedLeads.map(l => `${l.id},"${l.email}","${l.source}","${l.created_at}"`).join('\n');
+      const csvContent = 'id,email,source,created_at\n' + cachedLeads.map(l => [l.id, l.email, l.source, l.created_at].map(csvCell).join(',')).join('\n');
       const blob = new Blob([csvContent], { type: 'text/csv;charset=utf-8;' });
       const url = URL.createObjectURL(blob);
       const link = document.createElement('a');
@@ -875,18 +900,19 @@
 
         container.innerHTML = cachedEndpoints.map(ep => `
           <div class="endpoint-item">
-            <div class="endpoint-name">${ep.name}</div>
-            <div class="endpoint-url" title="Ingress URL">${window.location.origin}/in/${ep.id}</div>
-            <div class="target-url">🎯 <strong>Target:</strong> ${ep.target_url}</div>
+            <div class="endpoint-name">${esc(ep.name)}</div>
+            <div class="endpoint-url" title="Ingress URL">${esc(window.location.origin)}/in/${esc(ep.id)}</div>
+            <div class="target-url">🎯 <strong>Target:</strong> ${esc(ep.target_url)}</div>
             <div style="font-size: 0.72rem; color: var(--text-muted); display: flex; gap: 0.75rem;">
               <span>Auto-Retry: <strong>${ep.auto_retry ? 'Yes' : 'No'}</strong></span>
-              <span>Max: <strong>${ep.max_retries} attempts</strong></span>
+              <span>Max: <strong>${esc(ep.max_retries)} attempts</strong></span>
+              <span>Signed: <strong>${ep.has_secret ? 'Yes' : 'No'}</strong></span>
             </div>
           </div>
         `).join('');
 
         simSelect.innerHTML = cachedEndpoints.map(ep => `
-          <option value="${ep.id}">${ep.name} (/in/${ep.id})</option>
+          <option value="${esc(ep.id)}">${esc(ep.name)} (/in/${esc(ep.id)})</option>
         `).join('');
       } catch (e) {
         console.error(e);
@@ -896,7 +922,7 @@
     async function loadEvents() {
       try {
         let url = '/api/events?limit=50';
-        if (currentFilter) url += `&status=${currentFilter}`;
+        if (currentFilter) url += `&status=${encodeURIComponent(currentFilter)}`;
         const res = await fetch(url, { headers: getAuthHeaders() });
         const events = await res.json();
         const tbody = document.getElementById('events-table-body');
@@ -916,22 +942,22 @@
           const badgeClass = evt.status === 'delivered' ? 'badge-delivered' : (evt.status === 'failed' ? 'badge-failed' : 'badge-pending');
           const time = new Date(evt.created_at).toLocaleTimeString();
           const latency = evt.last_latency_ms ? `${evt.last_latency_ms}ms` : '-';
-          const providerClass = evt.provider.includes('stripe') ? 'stripe' : (evt.provider.includes('shopify') ? 'shopify' : (evt.provider.includes('github') ? 'github' : ''));
+          const providerClass = String(evt.provider || '').includes('stripe') ? 'stripe' : (evt.provider.includes('shopify') ? 'shopify' : (evt.provider.includes('github') ? 'github' : ''));
 
           return `
             <tr>
-              <td><span class="badge ${badgeClass}">${evt.status}</span></td>
+              <td><span class="badge ${badgeClass}">${esc(evt.status)}</span></td>
               <td>
-                <span class="badge-provider ${providerClass}">${evt.provider}</span>
-                <span style="font-weight: 600; margin-left: 0.35rem;">${evt.event_type || evt.id}</span>
+                <span class="badge-provider ${providerClass}">${esc(evt.provider)}</span>
+                <span style="font-weight: 600; margin-left: 0.35rem;">${esc(evt.event_type || evt.id)}</span>
               </td>
-              <td><span class="code-mono" style="color: var(--text-muted);">${evt.endpoint_id}</span></td>
-              <td><span class="code-mono">${latency}</span></td>
-              <td><span class="code-mono">${evt.attempts}</span></td>
-              <td style="color: var(--text-muted);">${time}</td>
+              <td><span class="code-mono" style="color: var(--text-muted);">${esc(evt.endpoint_id)}</span></td>
+              <td><span class="code-mono">${esc(latency)}</span></td>
+              <td><span class="code-mono">${esc(evt.attempts)}</span></td>
+              <td style="color: var(--text-muted);">${esc(time)}</td>
               <td style="display: flex; gap: 0.5rem;">
-                <button class="btn btn-secondary btn-sm" onclick="inspectEvent('${evt.id}')">Inspect</button>
-                <button class="btn btn-primary btn-sm" onclick="replayEvent('${evt.id}')">Replay</button>
+                <button class="btn btn-secondary btn-sm" data-action="inspect" data-id="${esc(evt.id)}">Inspect</button>
+                <button class="btn btn-primary btn-sm" data-action="replay" data-id="${esc(evt.id)}">Replay</button>
               </td>
             </tr>
           `;
@@ -958,6 +984,7 @@
       const name = document.getElementById('inp-ep-name').value.trim();
       const targetUrl = document.getElementById('inp-ep-target').value.trim();
       const alertWebhookUrl = document.getElementById('inp-ep-alert').value.trim();
+      const secret = document.getElementById('inp-ep-secret').value.trim();
 
       if (!id || !name || !targetUrl) {
         alert('Please fill out ID, Name, and Target URL');
@@ -967,13 +994,19 @@
       const res = await fetch('/api/endpoints', {
         method: 'POST',
         headers: getAuthHeaders({ 'Content-Type': 'application/json' }),
-        body: JSON.stringify({ id, name, targetUrl, alertWebhookUrl, autoRetry: 1, maxRetries: 5 })
+        body: JSON.stringify({ id, name, targetUrl, alertWebhookUrl, autoRetry: 1, maxRetries: 5, ...(secret ? { secret } : {}) })
       });
 
       if (res.status === 401) {
         alert('Admin authorization required to create endpoints. Please click "Admin Login" in top right.');
         return;
       }
+      if (!res.ok) {
+        const data = await res.json().catch(() => ({}));
+        alert(`Could not save endpoint: ${data.error || 'HTTP ' + res.status}`);
+        return;
+      }
+      document.getElementById('inp-ep-secret').value = '';
 
       toggleNewEndpointForm();
       await loadEndpoints();
@@ -981,9 +1014,11 @@
 
     async function replayEvent(id) {
       try {
-        const res = await fetch(`/api/events/${id}/replay`, { method: 'POST', headers: getAuthHeaders() });
+        const res = await fetch(`/api/events/${encodeURIComponent(id)}/replay`, { method: 'POST', headers: getAuthHeaders({ 'Content-Type': 'application/json' }), body: '{}' });
         const data = await res.json();
-        if (data.success) {
+        if (!res.ok) {
+          alert(`Replay not started: ${data.error || 'HTTP ' + res.status}`);
+        } else if (data.success) {
           alert(`✅ Event ${id} successfully replayed! (HTTP ${data.statusCode})`);
         } else {
           alert(`❌ Replay attempted: Destination returned HTTP ${data.statusCode} (${data.errorMessage || 'Failed'})`);
@@ -998,9 +1033,14 @@
     async function replayAllFailed() {
       if (!confirm('Replay all failed Dead-Letter Queue events now?')) return;
       try {
-        const res = await fetch('/api/events/replay-all', { method: 'POST', headers: getAuthHeaders({ 'Content-Type': 'application/json' }) });
+        const res = await fetch('/api/events/replay-all', { method: 'POST', headers: getAuthHeaders({ 'Content-Type': 'application/json' }), body: '{}' });
         const data = await res.json();
-        alert(`🔄 Dispatched replay for ${data.replayedCount} dead-letter events.`);
+        if (!res.ok) {
+          alert(`Bulk replay not started: ${data.error || 'HTTP ' + res.status}`);
+          return;
+        }
+        const more = data.remaining > 0 ? ` (${data.remaining} more still queued; run again to continue)` : '';
+        alert(`🔄 Dispatched replay for ${data.replayedCount} dead-letter events.${more}`);
         await loadEvents();
         await loadStats();
       } catch (e) {
@@ -1010,42 +1050,46 @@
 
     async function inspectEvent(id) {
       try {
-        const res = await fetch(`/api/events/${id}`, { headers: getAuthHeaders() });
+        const res = await fetch(`/api/events/${encodeURIComponent(id)}`, { headers: getAuthHeaders() });
         const evt = await res.json();
         document.getElementById('modal-event-title').textContent = `Inspection: ${evt.id}`;
         
         let attemptsHtml = '<p style="color: var(--text-muted); font-size: 0.85rem;">No attempts recorded.</p>';
         if (evt.attempts && evt.attempts.length > 0) {
-          attemptsHtml = evt.attempts.map((att, i) => `
+          attemptsHtml = evt.attempts.map((att, i) => {
+            const errorHtml = att.error_message ? `<div style="color: var(--accent-rose); margin-top: 0.25rem;">${esc(att.error_message)}</div>` : '';
+            const bodyHtml = att.response_body ? `<div class="code-block" style="margin-top: 0.5rem; max-height: 120px;">${esc(att.response_body)}</div>` : '';
+            return `
             <div style="background: #090d16; padding: 0.75rem; border-radius: 6px; border: 1px solid var(--border); font-size: 0.8rem;">
               <div style="display: flex; justify-content: space-between; margin-bottom: 0.35rem;">
                 <strong>Attempt #${evt.attempts.length - i}</strong>
                 <span class="badge ${att.status_code >= 200 && att.status_code < 300 ? 'badge-delivered' : 'badge-failed'}">
-                  HTTP ${att.status_code || 'Err'} (${att.latency_ms}ms)
+                  HTTP ${esc(att.status_code || 'Err')} (${esc(att.latency_ms)}ms)
                 </span>
               </div>
-              <div style="color: var(--text-muted);">${att.attempted_at}</div>
-              ${att.error_message ? `<div style="color: var(--accent-rose); margin-top: 0.25rem;">${att.error_message}</div>` : ''}
-              ${att.response_body ? `<div class="code-block" style="margin-top: 0.5rem; max-height: 120px;">${att.response_body}</div>` : ''}
+              <div style="color: var(--text-muted);">${esc(att.attempted_at)}</div>
+              ${errorHtml}
+              ${bodyHtml}
             </div>
-          `).join('');
+          `;
+          }).join('');
         }
 
         document.getElementById('modal-event-body').innerHTML = `
           <div style="display: flex; gap: 1rem; align-items: center;">
-            <span class="badge ${evt.status === 'delivered' ? 'badge-delivered' : 'badge-failed'}">${evt.status}</span>
-            <span style="font-weight: 700;">${evt.event_type || 'Custom Payload'}</span>
-            <span style="color: var(--text-muted); font-size: 0.8rem;">Received: ${evt.created_at}</span>
+            <span class="badge ${evt.status === 'delivered' ? 'badge-delivered' : 'badge-failed'}">${esc(evt.status)}</span>
+            <span style="font-weight: 700;">${esc(evt.event_type || 'Custom Payload')}</span>
+            <span style="color: var(--text-muted); font-size: 0.8rem;">Received: ${esc(evt.created_at)}</span>
           </div>
 
           <div>
             <h4 style="font-size: 0.85rem; margin-bottom: 0.4rem; color: var(--text-muted);">Incoming Headers</h4>
-            <div class="code-block">${JSON.stringify(evt.headers, null, 2)}</div>
+            <div class="code-block">${esc(JSON.stringify(evt.headers, null, 2))}</div>
           </div>
 
           <div>
             <h4 style="font-size: 0.85rem; margin-bottom: 0.4rem; color: var(--text-muted);">Raw Body Payload</h4>
-            <div class="code-block">${evt.raw_body}</div>
+            <div class="code-block">${esc(evt.raw_body)}</div>
           </div>
 
           <div>
@@ -1055,7 +1099,7 @@
 
           <div style="display: flex; justify-content: flex-end; gap: 0.75rem;">
             <button class="btn btn-secondary" onclick="closeInspectorModal()">Close</button>
-            <button class="btn btn-primary" onclick="replayEvent('${evt.id}')">Replay Event</button>
+            <button class="btn btn-primary" data-action="replay" data-id="${esc(evt.id)}">Replay Event</button>
           </div>
         `;
         document.getElementById('inspector-modal').style.display = 'flex';
@@ -1104,7 +1148,7 @@
       const payloadStr = document.getElementById('sim-payload').value;
 
       try {
-        const res = await fetch(`/in/${epId}`, {
+        const res = await fetch(`/in/${encodeURIComponent(epId)}`, {
           method: 'POST',
           headers,
           body: payloadStr
@@ -1132,6 +1176,10 @@
     function initWebSocket() {
       const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
       ws = new WebSocket(`${protocol}//${window.location.host}/ws`);
+      ws.onopen = () => {
+        const key = getApiKey();
+        if (key) ws.send(JSON.stringify({ type: 'auth', token: key }));
+      };
       ws.onmessage = (e) => {
         const msg = JSON.parse(e.data);
         if (msg.type === 'event:received' || msg.type === 'delivery') {
@@ -1144,6 +1192,14 @@
       };
     }
 
+    // Event-table and inspector buttons carry ids in data attributes instead of inline handlers
+    document.addEventListener('click', (e) => {
+      const btn = e.target.closest('[data-action]');
+      if (!btn) return;
+      if (btn.dataset.action === 'inspect') inspectEvent(btn.dataset.id);
+      if (btn.dataset.action === 'replay') replayEvent(btn.dataset.id);
+    });
+
     // Startup
     window.addEventListener('DOMContentLoaded', async () => {
       checkAdminAuth();