kliner 0.1.0-beta → 0.1.0-beta.2

package/package.json

@@ -1,9 +1,11 @@
 {
   "name": "kliner",
-  "version": "0.1.0-beta",
+  "version": "0.1.0-beta.2",
   "description": "Developer-friendly service-worker web proxy framework",
   "type": "module",
-  "bin": { "kliner": "bin/cli.js" },
+  "bin": {
+    "kliner": "bin/cli.js"
+  },
   "main": "./src/server.js",
   "exports": {
     ".": "./src/server.js",
@@ -17,9 +19,12 @@
     "test": "node --test"
   },
   "license": "MIT",
-  "engines": { "node": ">=18.0.0" },
+  "engines": {
+    "node": ">=18.0.0"
+  },
   "dependencies": {
     "chalk": "^5.3.0",
+    "cheerio": "^1.2.0",
     "commander": "^12.1.0",
     "cors": "^2.8.5",
     "dotenv": "^16.4.0",
@@ -27,6 +32,16 @@
     "undici": "^6.19.0",
     "ws": "^8.18.0"
   },
-  "devDependencies": { "esbuild": "^0.23.0", "nodemon": "^3.1.0" },
-  "files": ["bin", "src", "scripts", "templates", "LICENSE", "README.md"]
-}
+  "devDependencies": {
+    "esbuild": "^0.23.0",
+    "nodemon": "^3.1.0"
+  },
+  "files": [
+    "bin",
+    "src",
+    "scripts",
+    "templates",
+    "LICENSE",
+    "README.md"
+  ]
+}

package/src/proxy.js

@@ -1,20 +1,64 @@
 import { request } from "undici";
+import { load } from "cheerio";
 import { decodeKlinerUrl, encodeKlinerUrl } from "./codec.js";
 import { isAllowed } from "./config.js";
 
 const hopByHop = new Set(["connection", "keep-alive", "proxy-authenticate", "proxy-authorization", "te", "trailer", "transfer-encoding", "upgrade"]);
 
-export function rewriteResponse(text, baseUrl, contentType) {
+export function sanitizeResponseHeader(name, value) {
+  const normalizedName = name.toLowerCase();
+  if (normalizedName === "x-frame-options") return null;
+  if (normalizedName !== "content-security-policy") return value;
+  const directives = String(value).split(";").filter((directive) => directive.trim().split(/\s+/, 1)[0].toLowerCase() !== "frame-ancestors");
+  return directives.join(";").trim() || null;
+}
+
+function rewriteTarget(value, baseUrl, servicePath) {
+  if (/^(?:data:|javascript:|mailto:|#|blob:|about:)/i.test(value)) return value;
+  try { return `${servicePath}${encodeKlinerUrl(new URL(value, baseUrl).href)}`; } catch { return value; }
+}
+
+function rewriteSrcset(value, baseUrl, servicePath) {
+  return value.split(",").map((candidate) => {
+    const parts = candidate.trim().split(/\s+/);
+    if (parts.length === 0) return candidate;
+    parts[0] = rewriteTarget(parts[0], baseUrl, servicePath);
+    return parts.join(" ");
+  }).join(", ");
+}
+
+export function rewriteResponse(text, baseUrl, contentType, servicePath = "/service/") {
   if (/text\/html/i.test(contentType)) {
-    return text.replace(/(\b(?:href|src|action|poster)\s*=\s*["'])([^"']+)(["'])/gi, (match, start, value, end) => {
-      if (/^(?:data:|javascript:|mailto:|#)/i.test(value)) return match;
-      return `${start}${new URL(value, baseUrl).href}${end}`;
+    const $ = load(text, { decodeEntities: false });
+    const documentBase = $("base[href]").first().attr("href");
+    const resolvedBase = documentBase ? new URL(documentBase, baseUrl).href : baseUrl;
+    $("a[href], area[href], link[href], img[src], script[src], iframe[src], frame[src], form[action], video[src], audio[src], source[src], track[src], object[data], [poster]").each((_index, element) => {
+      for (const attribute of ["href", "src", "action", "data", "poster"]) {
+        const value = $(element).attr(attribute);
+        if (value) $(element).attr(attribute, rewriteTarget(value, resolvedBase, servicePath));
+      }
     });
+    $("img[srcset], source[srcset]").each((_index, element) => {
+      const value = $(element).attr("srcset");
+      if (value) $(element).attr("srcset", rewriteSrcset(value, resolvedBase, servicePath));
+    });
+    $("meta[http-equiv]").each((_index, element) => {
+      if ($(element).attr("http-equiv")?.toLowerCase() !== "refresh") return;
+      const value = $(element).attr("content") ?? "";
+      $(element).attr("content", value.replace(/(url\s*=\s*)(.*)$/i, (_match, prefix, target) => `${prefix}${rewriteTarget(target.trim(), resolvedBase, servicePath)}`));
+    });
+    $("[style]").each((_index, element) => $(element).attr("style", rewriteCss($(element).attr("style"), resolvedBase, servicePath)));
+    $("style").each((_index, element) => $(element).text(rewriteCss($(element).text(), resolvedBase, servicePath)));
+    return $.html();
   }
-  if (/text\/css/i.test(contentType)) return text.replace(/url\(\s*(["']?)([^)"']+)\1\s*\)/gi, (match, quote, value) => `url(${quote}${new URL(value, baseUrl).href}${quote})`);
+  if (/text\/css/i.test(contentType)) return rewriteCss(text, baseUrl, servicePath);
   return text;
 }
 
+function rewriteCss(text = "", baseUrl, servicePath) {
+  return text.replace(/url\(\s*(["']?)([^)"']+)\1\s*\)/gi, (match, quote, value) => `url(${quote}${rewriteTarget(value.trim(), baseUrl, servicePath)}${quote})`);
+}
+
 export async function proxyRequest(req, res, config, logger = () => {}) {
   let target;
   try { target = new URL(decodeKlinerUrl(req.params[0] || req.params.encoded)); } catch (error) {
@@ -26,10 +70,18 @@ export async function proxyRequest(req, res, config, logger = () => {}) {
   try {
     const headers = { ...req.headers };
     delete headers.host; delete headers.connection; delete headers["content-length"];
-    const upstream = await request(target, { method: req.method, headers, body: ["GET", "HEAD"].includes(req.method) ? undefined : req, signal: controller.signal, maxRedirections: 5 });
+    headers["accept-encoding"] = "identity";
+    const upstream = await request(target, { method: req.method, headers, body: ["GET", "HEAD"].includes(req.method) ? undefined : req, signal: controller.signal });
     logger(req.method, target.href, upstream.statusCode, upstream.headers["content-type"]);
     for (const [name, value] of Object.entries(upstream.headers)) {
       if (hopByHop.has(name) || name === "content-length" || name === "content-encoding") continue;
+      const sanitized = sanitizeResponseHeader(name, value);
+      if (sanitized === null) continue;
+      if (name === "set-cookie") {
+        const cookies = Array.isArray(value) ? value : [value];
+        res.setHeader(name, cookies.map((cookie) => cookie.replace(/;\s*Domain=[^;]*/gi, "").replace(/;\s*SameSite=None/gi, "")));
+        continue;
+      }
       if (name === "location") {
         const redirect = new URL(value, target);
         if (isAllowed(redirect, config)) res.setHeader(name, `${config.servicePath}${encodeKlinerUrl(redirect.href)}`);
@@ -42,9 +94,10 @@ export async function proxyRequest(req, res, config, logger = () => {}) {
     if (/text\/html|text\/css/i.test(type)) {
       const body = await upstream.body.text();
       if (Buffer.byteLength(body) > config.maxResponseSize) throw Object.assign(new Error("Response too large"), { code: "KLINER_RESPONSE_TOO_LARGE" });
-      res.send(rewriteResponse(body, target.href, type));
+      res.send(rewriteResponse(body, target.href, type, config.servicePath));
     } else upstream.body.pipe(res);
   } catch (error) {
+    if (config.logging.level === "debug") console.error(error);
     if (res.headersSent) res.destroy(error);
     else res.status(error.name === "AbortError" ? 504 : 502).json({ error: error.name === "AbortError" ? "KLINER_TIMEOUT" : "KLINER_TARGET_UNREACHABLE" });
   } finally { clearTimeout(timeout); }

package/src/server.js

@@ -15,6 +15,7 @@ export async function createApp(config) {
   app.get("/status", (_req, res) => res.json({ status: "ok", allowlist: config.allowlist, servicePath: config.servicePath }));
   const clientPath = path.dirname(fileURLToPath(import.meta.url));
   app.get("/kli.js", (_req, res) => res.sendFile(path.join(clientPath, "client", "kli.js")));
+  app.use(express.static(path.join(clientPath, "..", "klinerdemo")));
   app.all(`${config.servicePath}:encoded(*)`, (req, res) => proxyRequest(req, res, config, (method, target, status, type) => {
     if (config.logging.level !== "silent") console.log(`[${new Date().toISOString().slice(11, 19)}] ${method} ${target} ${status} ${type ?? ""}`);
   }));