mulmoclaude 2.3.0 → 2.4.1

package/server/api/auth/viewToken.ts

@@ -20,9 +20,10 @@
 // sends `Origin: null`), so the unguessable scoped token is what stands in
 // for both. See the exemptions in `server/index.ts`.
 
-import { createHmac, timingSafeEqual } from "node:crypto";
+import { createHmac } from "node:crypto";
 import type { Request, Response, NextFunction } from "express";
 import { getCurrentToken } from "./token.js";
+import { tokenEquals, UNAUTHORIZED_MESSAGE } from "@mulmoclaude/common/token-guard";
 import { unauthorized } from "../../utils/httpError.js";
 import { ONE_HOUR_MS } from "../../utils/time.js";
 import { isRecord, isUnknownArray } from "../../utils/types.js";
@@ -86,15 +87,7 @@ export function verifyViewToken(token: string, nowMs: number = Date.now()): View
   const payloadB64 = token.slice(0, dot);
   const providedSig = token.slice(dot + 1);
   const expectedSig = signPayload(payloadB64, key);
-  // Compare BYTE lengths (not string lengths) before timingSafeEqual — it
-  // throws a RangeError on a buffer-length mismatch, and a malformed signature
-  // with the same character count but multi-byte chars would otherwise crash
-  // the request (500) instead of failing closed. The lengths are non-secret
-  // (fixed-size HMAC), so the early-out leaks nothing useful.
-  const providedBuf = Buffer.from(providedSig);
-  const expectedBuf = Buffer.from(expectedSig);
-  if (providedBuf.length !== expectedBuf.length) return null;
-  if (!timingSafeEqual(providedBuf, expectedBuf)) return null;
+  if (!tokenEquals(providedSig, expectedSig)) return null;
   const payload = decodePayload(payloadB64);
   if (payload === null || nowMs >= payload.exp) return null;
   return payload;
@@ -129,12 +122,12 @@ export function requireViewToken(action: ViewCapability) {
   return function requireViewTokenMiddleware(req: Request, res: Response, next: NextFunction): void {
     const header = req.headers.authorization;
     if (typeof header !== "string" || !header.startsWith(BEARER_PREFIX)) {
-      unauthorized(res, "unauthorized");
+      unauthorized(res, UNAUTHORIZED_MESSAGE);
       return;
     }
     const payload = verifyViewToken(header.slice(BEARER_PREFIX.length));
     if (!payload || payload.slug !== req.params.slug || !payload.caps.includes(action)) {
-      unauthorized(res, "unauthorized");
+      unauthorized(res, UNAUTHORIZED_MESSAGE);
       return;
     }
     next();

package/server/api/routes/files.ts

@@ -219,7 +219,9 @@ export function isWritableTextFile(absPath: string): boolean {
   return !BLOCKED_UPLOAD_EXTENSIONS.has(path.extname(absPath).toLowerCase());
 }
 
-const MIME_BY_EXT: Record<string, string> = {
+// Exported so the header tests can prove every MIME this table emits is
+// classified as sandboxed or exempt; a new entry fails them until placed.
+export const MIME_BY_EXT: Record<string, string> = {
   ".png": "image/png",
   ".jpg": "image/jpeg",
   ".jpeg": "image/jpeg",
@@ -453,23 +455,38 @@ export const RAW_SECURITY_HEADERS: Readonly<Record<string, string>> = {
   "X-Content-Type-Options": "nosniff",
 };
 
-// PDF responses skip `Content-Security-Policy: sandbox`. Issue
-// #1299: WebKit refuses to render `sandbox`-opaque PDFs and forces
-// a download, breaking the Files preview iframe on Safari. The
-// PDF viewer (PDFium on Chromium, the WebKit PDF renderer, pdf.js
-// on Firefox) runs embedded AcroJS inside its own sandbox; the
-// response-level CSP was never the layer enforcing PDF script
-// isolation. `nosniff` is kept so the response can't be
-// re-interpreted as HTML.
-export const RAW_SECURITY_HEADERS_PDF: Readonly<Record<string, string>> = {
+// Two kinds of response skip `Content-Security-Policy: sandbox`,
+// each because a browser cannot show the file under it at all:
+// - PDF (#1299): WebKit refuses to render a `sandbox`-opaque PDF and
+//   forces a download, breaking the Files preview iframe on Safari.
+//   The PDF viewer (PDFium on Chromium, the WebKit PDF renderer,
+//   pdf.js on Firefox) runs embedded AcroJS inside its own sandbox;
+//   the response-level CSP was never the layer enforcing PDF script
+//   isolation.
+// - audio / video (#3437): opened as a top-level document, Chrome's
+//   media page re-requests the file in CORS mode from the sandbox's
+//   `null` origin, the request is blocked, and the player has
+//   nothing to play.
+// Neither can run script in the document that shows it: a media
+// file is decoded, not parsed as markup. `nosniff` is kept so the
+// response can't be re-interpreted as HTML.
+export const RAW_SECURITY_HEADERS_NO_SANDBOX: Readonly<Record<string, string>> = {
   "X-Content-Type-Options": "nosniff",
 };
 
-/** Pick the header set for a given MIME. PDF is the only special
- *  case today — every other MIME (`image/*`, `text/*`,
- *  `application/octet-stream`, …) keeps the sandbox CSP. */
+const SANDBOX_EXEMPT_MIME_PREFIXES = ["audio/", "video/"] as const;
+
+/** True for the MIMEs a browser can only show without the sandbox
+ *  CSP: `application/pdf` and the `audio/*` / `video/*` the route's
+ *  MIME table emits. Every other MIME (`image/*`, `text/*`,
+ *  `application/octet-stream`, …) must stay sandboxed — an SVG
+ *  served without it is stored XSS against the app origin. */
+export function isSandboxExemptMime(mime: string): boolean {
+  return mime === "application/pdf" || SANDBOX_EXEMPT_MIME_PREFIXES.some((prefix) => mime.startsWith(prefix));
+}
+
 export function rawSecurityHeadersForMime(mime: string): Readonly<Record<string, string>> {
-  return mime === "application/pdf" ? RAW_SECURITY_HEADERS_PDF : RAW_SECURITY_HEADERS;
+  return isSandboxExemptMime(mime) ? RAW_SECURITY_HEADERS_NO_SANDBOX : RAW_SECURITY_HEADERS;
 }
 
 function applyRawSecurityHeaders(res: Response, mime: string): void {
@@ -1254,9 +1271,9 @@ router.get(API_ROUTES.files.raw, (req: Request<object, unknown, unknown, PathQue
   res.setHeader("Content-Type", mime);
   // Sandbox the response so an `.svg` / `.html` with embedded
   // JavaScript can't escape into the localhost:3001 origin via
-  // direct navigation or <iframe>. PDFs get a narrower header set
-  // (no sandbox CSP) because Safari/WebKit refuses to render
-  // sandbox-opaque PDFs (#1299). See plans/done/
+  // direct navigation or <iframe>. PDFs (#1299) and audio / video
+  // (#3437) get a narrower header set (no sandbox CSP) because a
+  // browser cannot show them under it. See plans/done/
   // fix-files-raw-csp-sandbox.md for the full threat model.
   applyRawSecurityHeaders(res, mime);