roster-server 2.4.8 → 2.4.11

package/README.md

@@ -126,11 +126,6 @@ import { createScannerBlocker } from 'roster-server/plugins/scanner-blocker.js';
 const roster = new Roster(options);
 
 roster.use(createScannerBlocker({
-    windowMs: 60_000,
-    strikeThreshold: 3,
-    banDurationMs: 15 * 60_000,
-    maxTrackedClients: 10_000,
-    trustProxy: false,
     onBlock(event) {
         // Send event to the application's existing logger if desired.
     }
@@ -139,7 +134,7 @@ roster.use(createScannerBlocker({
 roster.start();
 ```
 
-All operational values are required. Keep `trustProxy: false` when RosterServer receives traffic directly. Set it to `true` only when a trusted reverse proxy overwrites `X-Forwarded-For`; otherwise clients can spoof the address used for bans.
+By default, the plugin uses a 60-second strike window, 3 strikes, a 15-minute ban, tracks up to 10,000 clients, and does not trust proxy headers. Pass only the values you need to override. Keep `trustProxy: false` when RosterServer receives traffic directly. Set it to `true` only when a trusted reverse proxy overwrites `X-Forwarded-For`; otherwise clients can spoof the address used for bans.
 
 The in-memory strike and ban state is bounded by `maxTrackedClients`, belongs to one RosterServer process, and is cleared on restart. Use the optional `onBlock(event)` callback to feed a shared firewall or Fail2ban when bans must persist or span multiple workers. Routes such as `/atom` and `/articles/config` are not classified as scanner probes.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "roster-server",
-  "version": "2.4.8",
+  "version": "2.4.11",
   "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
   "main": "index.js",
   "repository": {
@@ -36,6 +36,7 @@
     "@greenlock/manager": "^3.1.0",
     "@root/acme": "^3.1.0",
     "@root/csr": "^0.8.1",
+    "@root/encoding": "^1.0.1",
     "@root/keypairs": "^0.10.0",
     "@root/mkdirp": "^1.0.0",
     "@root/request": "^1.6.1",

package/plugins/scanner-blocker.js

@@ -2,7 +2,7 @@
 
 const PHP_PATH = /(?:^|\/)[^/]*\.php(?:$|\/)/i;
 const SCANNER_PATH = /(?:^|\/)(?:\.git|\.hg|\.svn|\.ssh|\.aws|cgi-bin|server-status|vendor\/phpunit|wp-admin|wp-content|wp-includes|wp-json)(?:\/|$)/i;
-const SCANNER_FILE = /(?:^|\/)(?:\.env(?:\.[^/]*)?|\.htaccess|composer\.(?:json|lock)|web\.config)(?:\/|$)/i;
+const SCANNER_FILE = /(?:^|\/)(?:\.env(?:\.[^/]*)?|\.htaccess|composer\.(?:json|lock)|security\.txt|web\.config)(?:\/|$)/i;
 
 function requirePositiveInteger(options, name) {
     const value = options[name];
@@ -61,28 +61,36 @@ function rejectRequest(req, res) {
     res.end(req.method === 'HEAD' ? undefined : body);
 }
 
-function createScannerBlocker(options) {
+function createScannerBlocker(options = {}) {
     if (!options || typeof options !== 'object') {
-        throw new Error('scanner-blocker options are required');
+        throw new Error('scanner-blocker options must be an object');
     }
 
-    const windowMs = requirePositiveInteger(options, 'windowMs');
-    const strikeThreshold = requirePositiveInteger(options, 'strikeThreshold');
-    const banDurationMs = requirePositiveInteger(options, 'banDurationMs');
-    const maxTrackedClients = requirePositiveInteger(options, 'maxTrackedClients');
-    if (typeof options.trustProxy !== 'boolean') {
+    const {
+        windowMs = 60_000,
+        strikeThreshold = 3,
+        banDurationMs = 15 * 60_000,
+        maxTrackedClients = 10_000,
+        trustProxy = false,
+        onBlock,
+        now
+    } = options;
+    const normalizedOptions = { windowMs, strikeThreshold, banDurationMs, maxTrackedClients };
+    requirePositiveInteger(normalizedOptions, 'windowMs');
+    requirePositiveInteger(normalizedOptions, 'strikeThreshold');
+    requirePositiveInteger(normalizedOptions, 'banDurationMs');
+    requirePositiveInteger(normalizedOptions, 'maxTrackedClients');
+    if (typeof trustProxy !== 'boolean') {
         throw new Error('trustProxy must be a boolean');
     }
-    if (options.onBlock !== undefined && typeof options.onBlock !== 'function') {
+    if (onBlock !== undefined && typeof onBlock !== 'function') {
         throw new Error('onBlock must be a function');
     }
-    if (options.now !== undefined && typeof options.now !== 'function') {
+    if (now !== undefined && typeof now !== 'function') {
         throw new Error('now must be a function');
     }
 
-    const trustProxy = options.trustProxy;
-    const onBlock = options.onBlock;
-    const now = options.now || Date.now;
+    const clock = now || Date.now;
     const clients = new Map();
 
     function removeExpiredClients(timestamp) {
@@ -109,7 +117,7 @@ function createScannerBlocker(options) {
     }
 
     return function scannerBlocker(req, res, context = {}) {
-        const timestamp = now();
+        const timestamp = clock();
         const ip = clientIp(req, trustProxy);
         let state = ip ? clients.get(ip) : null;
 

package/skills/roster-server/SKILL.md

@@ -178,17 +178,11 @@ const Roster = require('roster-server');
 const { createScannerBlocker } = require('roster-server/plugins/scanner-blocker.js');
 
 const roster = new Roster({ local: true, wwwPath: './www' });
-roster.use(createScannerBlocker({
-    windowMs: 60_000,
-    strikeThreshold: 3,
-    banDurationMs: 15 * 60_000,
-    maxTrackedClients: 10_000,
-    trustProxy: false
-}));
+roster.use(createScannerBlocker());
 roster.start();
 ```
 
-The plugin blocks common PHP, WordPress, repository, and sensitive-file probes before site handlers. All operational values are required. Set `trustProxy: true` only behind a trusted reverse proxy that overwrites `X-Forwarded-For`. Ban state is per process and in memory; use `onBlock` to integrate a shared firewall or Fail2ban.
+The plugin blocks common PHP, WordPress, repository, and sensitive-file probes before site handlers. Defaults are a 60-second window, 3 strikes, a 15-minute ban, 10,000 tracked clients, and `trustProxy: false`; pass only the values to override. Set `trustProxy: true` only behind a trusted reverse proxy that overwrites `X-Forwarded-For`. Ban state is per process and in memory; use `onBlock` to integrate a shared firewall or Fail2ban.
 
 ## Key Configuration Options
 

package/test/roster-server.test.js

@@ -8,6 +8,7 @@ const http = require('http');
 const os = require('os');
 const Roster = require('../index.js');
 const { createScannerBlocker } = require('../plugins/scanner-blocker.js');
+const HttpsMiddleware = require('../vendor/greenlock-express/https-middleware.js');
 const {
     wildcardRoot,
     hostMatchesWildcard,
@@ -40,6 +41,37 @@ function httpGet(host, port, pathname = '/') {
     });
 }
 
+describe('vendored HTTPS hostname middleware', () => {
+    function invoke(host) {
+        let appCalled = false;
+        let body;
+        const req = { headers: { host }, socket: {} };
+        const res = {
+            end(value) {
+                body = value;
+            }
+        };
+        HttpsMiddleware.create({}, () => {
+            appCalled = true;
+        })(req, res);
+        return { appCalled, body, req, res };
+    }
+
+    it('accepts a valid Host header with a numeric port', () => {
+        const result = invoke('example.com:8880');
+        assert.strictEqual(result.appCalled, true);
+        assert.strictEqual(result.res.statusCode, undefined);
+        assert.strictEqual(result.req.headers.host, 'example.com');
+    });
+
+    it('rejects a Host header with a non-numeric port', () => {
+        const result = invoke('example.com:invalid');
+        assert.strictEqual(result.appCalled, false);
+        assert.strictEqual(result.res.statusCode, 400);
+        assert.match(result.body, /Malformed HTTP Header/);
+    });
+});
+
 describe('wildcardRoot', () => {
     it('returns root domain for *.example.com', () => {
         assert.strictEqual(wildcardRoot('*.example.com'), 'example.com');

package/test/scanner-blocker.test.js

@@ -40,10 +40,20 @@ function blocker(overrides = {}) {
 }
 
 describe('scanner-blocker plugin', () => {
-    it('requires every operational option explicitly', () => {
-        assert.throws(() => createScannerBlocker(), /options are required/);
-        assert.throws(() => createScannerBlocker({}), /windowMs/);
-        assert.throws(() => blocker({ trustProxy: undefined }), /trustProxy/);
+    it('uses documented defaults and permits individual overrides', () => {
+        const plugin = createScannerBlocker();
+        invoke(plugin, { url: '/wp-login.php' });
+        invoke(plugin, { url: '/xmlrpc.php' });
+        assert.strictEqual(invoke(plugin, { url: '/ordinary' }).handled, false);
+        invoke(plugin, { url: '/install.php' });
+        assert.strictEqual(invoke(plugin, { url: '/ordinary' }).handled, true);
+
+        const overriddenPlugin = createScannerBlocker({ strikeThreshold: 1 });
+        invoke(overriddenPlugin, { url: '/wp-login.php' });
+        assert.strictEqual(invoke(overriddenPlugin, { url: '/ordinary' }).handled, true);
+
+        assert.throws(() => createScannerBlocker(null), /options must be an object/);
+        assert.throws(() => blocker({ trustProxy: 'false' }), /trustProxy/);
         assert.throws(() => blocker({ maxTrackedClients: 0 }), /maxTrackedClients/);
     });
 
@@ -51,9 +61,11 @@ describe('scanner-blocker plugin', () => {
         const urls = [
             '/install.php',
             '/user-new\\.php',
+            '/wp-login.php',
             '/wp-json',
             '/.git/config',
-            '/%252eenv'
+            '/%252eenv',
+            '/security.txt'
         ];
 
         for (const [index, url] of urls.entries()) {

package/vendor/greenlock-express/https-middleware.js

@@ -20,6 +20,7 @@ SanitizeHost.create = function(gl, app) {
         var hostname = HttpMiddleware.getHostname(req);
         // Replace the hostname, and get the safe version
         var safehost = HttpMiddleware.sanitizeHostname(req);
+        var normalizedHostname = hostname.toLowerCase().replace(/:\d+$/, "");
 
         // if no hostname, move along
         if (!hostname) {
@@ -28,7 +29,7 @@ SanitizeHost.create = function(gl, app) {
         }
 
         // if there were unallowed characters, complain
-        if (safehost.length !== hostname.length) {
+        if (safehost !== normalizedHostname) {
             res.statusCode = 400;
             res.end("Malformed HTTP Header: 'Host: " + hostname + "'");
             return;