roster-server 2.4.10 → 2.4.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "roster-server",
-  "version": "2.4.10",
+  "version": "2.4.11",
   "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
   "main": "index.js",
   "repository": {
@@ -36,6 +36,7 @@
     "@greenlock/manager": "^3.1.0",
     "@root/acme": "^3.1.0",
     "@root/csr": "^0.8.1",
+    "@root/encoding": "^1.0.1",
     "@root/keypairs": "^0.10.0",
     "@root/mkdirp": "^1.0.0",
     "@root/request": "^1.6.1",

package/plugins/scanner-blocker.js

@@ -2,7 +2,7 @@
 
 const PHP_PATH = /(?:^|\/)[^/]*\.php(?:$|\/)/i;
 const SCANNER_PATH = /(?:^|\/)(?:\.git|\.hg|\.svn|\.ssh|\.aws|cgi-bin|server-status|vendor\/phpunit|wp-admin|wp-content|wp-includes|wp-json)(?:\/|$)/i;
-const SCANNER_FILE = /(?:^|\/)(?:\.env(?:\.[^/]*)?|\.htaccess|composer\.(?:json|lock)|web\.config)(?:\/|$)/i;
+const SCANNER_FILE = /(?:^|\/)(?:\.env(?:\.[^/]*)?|\.htaccess|composer\.(?:json|lock)|security\.txt|web\.config)(?:\/|$)/i;
 
 function requirePositiveInteger(options, name) {
     const value = options[name];

package/test/roster-server.test.js

@@ -8,6 +8,7 @@ const http = require('http');
 const os = require('os');
 const Roster = require('../index.js');
 const { createScannerBlocker } = require('../plugins/scanner-blocker.js');
+const HttpsMiddleware = require('../vendor/greenlock-express/https-middleware.js');
 const {
     wildcardRoot,
     hostMatchesWildcard,
@@ -40,6 +41,37 @@ function httpGet(host, port, pathname = '/') {
     });
 }
 
+describe('vendored HTTPS hostname middleware', () => {
+    function invoke(host) {
+        let appCalled = false;
+        let body;
+        const req = { headers: { host }, socket: {} };
+        const res = {
+            end(value) {
+                body = value;
+            }
+        };
+        HttpsMiddleware.create({}, () => {
+            appCalled = true;
+        })(req, res);
+        return { appCalled, body, req, res };
+    }
+
+    it('accepts a valid Host header with a numeric port', () => {
+        const result = invoke('example.com:8880');
+        assert.strictEqual(result.appCalled, true);
+        assert.strictEqual(result.res.statusCode, undefined);
+        assert.strictEqual(result.req.headers.host, 'example.com');
+    });
+
+    it('rejects a Host header with a non-numeric port', () => {
+        const result = invoke('example.com:invalid');
+        assert.strictEqual(result.appCalled, false);
+        assert.strictEqual(result.res.statusCode, 400);
+        assert.match(result.body, /Malformed HTTP Header/);
+    });
+});
+
 describe('wildcardRoot', () => {
     it('returns root domain for *.example.com', () => {
         assert.strictEqual(wildcardRoot('*.example.com'), 'example.com');

package/test/scanner-blocker.test.js

@@ -61,9 +61,11 @@ describe('scanner-blocker plugin', () => {
         const urls = [
             '/install.php',
             '/user-new\\.php',
+            '/wp-login.php',
             '/wp-json',
             '/.git/config',
-            '/%252eenv'
+            '/%252eenv',
+            '/security.txt'
         ];
 
         for (const [index, url] of urls.entries()) {

package/vendor/greenlock-express/https-middleware.js

@@ -20,6 +20,7 @@ SanitizeHost.create = function(gl, app) {
         var hostname = HttpMiddleware.getHostname(req);
         // Replace the hostname, and get the safe version
         var safehost = HttpMiddleware.sanitizeHostname(req);
+        var normalizedHostname = hostname.toLowerCase().replace(/:\d+$/, "");
 
         // if no hostname, move along
         if (!hostname) {
@@ -28,7 +29,7 @@ SanitizeHost.create = function(gl, app) {
         }
 
         // if there were unallowed characters, complain
-        if (safehost.length !== hostname.length) {
+        if (safehost !== normalizedHostname) {
             res.statusCode = 400;
             res.end("Malformed HTTP Header: 'Host: " + hostname + "'");
             return;