roster-server 2.4.10 → 2.4.12

package/index.js

@@ -322,6 +322,7 @@ class Roster {
             return;
         }
 
+        const siteKeyForDomain = (domain) => this.defaultPort === 443 ? domain : `${domain}:443`;
         const sites = fs.readdirSync(this.wwwPath, { withFileTypes: true })
             .filter(dirent => dirent.isDirectory());
 
@@ -350,7 +351,7 @@ class Roster {
                     continue;
                 }
                 this.domains.push(domain);
-                this.sites[domain] = siteApp;
+                this.sites[siteKeyForDomain(domain)] = siteApp;
                 const root = wildcardRoot(domain);
                 if (root) this.wildcardZones.add(root);
                 log.info(`(✔) Loaded wildcard site: https://${domain}${type === 'static' ? ' (static)' : ''}`);
@@ -358,7 +359,7 @@ class Roster {
                 const domainEntries = [domain, `www.${domain}`];
                 this.domains.push(...domainEntries);
                 domainEntries.forEach(d => {
-                    this.sites[d] = siteApp;
+                    this.sites[siteKeyForDomain(d)] = siteApp;
                 });
                 log.info(`(✔) Loaded site: https://${domain}${type === 'static' ? ' (static)' : ''}`);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "roster-server",
-  "version": "2.4.10",
+  "version": "2.4.12",
   "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
   "main": "index.js",
   "repository": {
@@ -36,6 +36,7 @@
     "@greenlock/manager": "^3.1.0",
     "@root/acme": "^3.1.0",
     "@root/csr": "^0.8.1",
+    "@root/encoding": "^1.0.1",
     "@root/keypairs": "^0.10.0",
     "@root/mkdirp": "^1.0.0",
     "@root/request": "^1.6.1",

package/plugins/scanner-blocker.js

@@ -2,7 +2,7 @@
 
 const PHP_PATH = /(?:^|\/)[^/]*\.php(?:$|\/)/i;
 const SCANNER_PATH = /(?:^|\/)(?:\.git|\.hg|\.svn|\.ssh|\.aws|cgi-bin|server-status|vendor\/phpunit|wp-admin|wp-content|wp-includes|wp-json)(?:\/|$)/i;
-const SCANNER_FILE = /(?:^|\/)(?:\.env(?:\.[^/]*)?|\.htaccess|composer\.(?:json|lock)|web\.config)(?:\/|$)/i;
+const SCANNER_FILE = /(?:^|\/)(?:\.env(?:\.[^/]*)?|\.htaccess|composer\.(?:json|lock)|security\.txt|web\.config)(?:\/|$)/i;
 
 function requirePositiveInteger(options, name) {
     const value = options[name];

package/test/roster-server.test.js

@@ -8,6 +8,7 @@ const http = require('http');
 const os = require('os');
 const Roster = require('../index.js');
 const { createScannerBlocker } = require('../plugins/scanner-blocker.js');
+const HttpsMiddleware = require('../vendor/greenlock-express/https-middleware.js');
 const {
     wildcardRoot,
     hostMatchesWildcard,
@@ -40,6 +41,37 @@ function httpGet(host, port, pathname = '/') {
     });
 }
 
+describe('vendored HTTPS hostname middleware', () => {
+    function invoke(host) {
+        let appCalled = false;
+        let body;
+        const req = { headers: { host }, socket: {} };
+        const res = {
+            end(value) {
+                body = value;
+            }
+        };
+        HttpsMiddleware.create({}, () => {
+            appCalled = true;
+        })(req, res);
+        return { appCalled, body, req, res };
+    }
+
+    it('accepts a valid Host header with a numeric port', () => {
+        const result = invoke('example.com:8880');
+        assert.strictEqual(result.appCalled, true);
+        assert.strictEqual(result.res.statusCode, undefined);
+        assert.strictEqual(result.req.headers.host, 'example.com');
+    });
+
+    it('rejects a Host header with a non-numeric port', () => {
+        const result = invoke('example.com:invalid');
+        assert.strictEqual(result.appCalled, false);
+        assert.strictEqual(result.res.statusCode, 400);
+        assert.match(result.body, /Malformed HTTP Header/);
+    });
+});
+
 describe('wildcardRoot', () => {
     it('returns root domain for *.example.com', () => {
         assert.strictEqual(wildcardRoot('*.example.com'), 'example.com');
@@ -481,6 +513,51 @@ describe('Roster local mode (local: true)', () => {
 });
 
 describe('Roster loadSites', () => {
+    it('keeps discovered sites on 443 when the same domain is registered on other ports', async () => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'roster-test-'));
+        const wwwPath = path.join(tmpDir, 'www');
+        const siteDir = path.join(wwwPath, 'persist.example.com');
+        fs.mkdirSync(siteDir, { recursive: true });
+        fs.writeFileSync(path.join(siteDir, 'index.html'), '<html>static-443</html>', 'utf8');
+
+        const roster = new Roster({ wwwPath, local: true, port: 8880 });
+        roster.register('persist.example.com', () => (req, res) => {
+            res.writeHead(200);
+            res.end('app-8880');
+        });
+        roster.register('persist.example.com:8882', () => (req, res) => {
+            res.writeHead(200);
+            res.end('socket-8882');
+        });
+
+        try {
+            await roster.init();
+
+            const dispatch = (port) => {
+                let statusCode;
+                let body = '';
+                const res = {
+                    writeHead: (status) => { statusCode = status; },
+                    end: (value) => { body = value ? value.toString() : ''; }
+                };
+                roster.requestHandler(port)(
+                    { headers: { host: 'persist.example.com' }, method: 'GET', url: '/' },
+                    res
+                );
+                return { statusCode, body };
+            };
+
+            assert.deepStrictEqual(dispatch(443), {
+                statusCode: 200,
+                body: '<html>static-443</html>'
+            });
+            assert.deepStrictEqual(dispatch(8880), { statusCode: 200, body: 'app-8880' });
+            assert.deepStrictEqual(dispatch(8882), { statusCode: 200, body: 'socket-8882' });
+        } finally {
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+    });
+
     it('loads site from www directory and registers domain + www', async () => {
         const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'roster-test-'));
         const wwwPath = path.join(tmpDir, 'www');

package/test/scanner-blocker.test.js

@@ -61,9 +61,11 @@ describe('scanner-blocker plugin', () => {
         const urls = [
             '/install.php',
             '/user-new\\.php',
+            '/wp-login.php',
             '/wp-json',
             '/.git/config',
-            '/%252eenv'
+            '/%252eenv',
+            '/security.txt'
         ];
 
         for (const [index, url] of urls.entries()) {

package/vendor/greenlock-express/https-middleware.js

@@ -20,6 +20,7 @@ SanitizeHost.create = function(gl, app) {
         var hostname = HttpMiddleware.getHostname(req);
         // Replace the hostname, and get the safe version
         var safehost = HttpMiddleware.sanitizeHostname(req);
+        var normalizedHostname = hostname.toLowerCase().replace(/:\d+$/, "");
 
         // if no hostname, move along
         if (!hostname) {
@@ -28,7 +29,7 @@ SanitizeHost.create = function(gl, app) {
         }
 
         // if there were unallowed characters, complain
-        if (safehost.length !== hostname.length) {
+        if (safehost !== normalizedHostname) {
             res.statusCode = 400;
             res.end("Malformed HTTP Header: 'Host: " + hostname + "'");
             return;