termdock 1.0.0

package/dist/server/utils/localAccess.js

@@ -0,0 +1,211 @@
+import os from 'os';
+import multicastDns from 'multicast-dns';
+import { LOCAL_ACCESS } from '../config.js';
+import { createAutoLocalAccessName, getLocalAccessSetting, getLocalAccessSettingAsync, normalizeLocalAccessName, setLocalAccessSettingAsync, } from './settings.js';
+import { isAuthEnabled } from './authProtection.js';
+const LOCALHOST_NAMES = new Set(['localhost', '127.0.0.1', '::1']);
+function hostnameForName(name) {
+    return `${name}.${LOCAL_ACCESS.domainSuffix}`;
+}
+function normalizeQuestionName(name) {
+    return name.endsWith('.') ? name.slice(0, -1).toLowerCase() : name.toLowerCase();
+}
+export function isLoopbackHost(host) {
+    return LOCALHOST_NAMES.has(host) || host.startsWith('127.');
+}
+function interfaceLabel(name) {
+    if (name === 'en0')
+        return 'Wi-Fi';
+    if (name.startsWith('en'))
+        return `Network adapter ${name}`;
+    if (name.startsWith('bridge'))
+        return `Bridge ${name}`;
+    return name;
+}
+export function getLanIPv4Interfaces() {
+    const interfaces = os.networkInterfaces();
+    const addresses = [];
+    for (const [name, entries] of Object.entries(interfaces)) {
+        for (const entry of entries ?? []) {
+            if (entry.family !== 'IPv4' || entry.internal)
+                continue;
+            if (entry.address.startsWith('169.254.'))
+                continue;
+            addresses.push({ name, address: entry.address, family: 'IPv4', label: interfaceLabel(name) });
+        }
+    }
+    const seen = new Set();
+    return addresses.filter((entry) => {
+        if (seen.has(entry.address))
+            return false;
+        seen.add(entry.address);
+        return true;
+    });
+}
+export function getLanIPv4Addresses() {
+    return getLanIPv4Interfaces().map((entry) => entry.address);
+}
+function buildState(setting, options, status, reason) {
+    const hostname = hostnameForName(setting.name);
+    const interfaces = getLanIPv4Interfaces();
+    const lanAddresses = interfaces.map((entry) => entry.address);
+    const onboardingHost = lanAddresses[0] ?? null;
+    const fallbackHostname = onboardingHost ?? hostname;
+    return {
+        name: setting.name,
+        source: setting.source,
+        hostname,
+        fallbackHostname,
+        url: `${options.scheme}://${hostname}:${options.port}`,
+        fallbackUrl: `${options.scheme}://${fallbackHostname}:${options.port}`,
+        onboardingUrl: onboardingHost ? `http://${onboardingHost}:${options.onboardingPort ?? options.port}/onboarding` : null,
+        status,
+        reason,
+        httpsEnabled: options.scheme === 'https',
+        caAvailable: Boolean(options.caCertPath),
+        lanAddresses,
+        interfaces,
+    };
+}
+async function wait(ms) {
+    await new Promise((resolve) => setTimeout(resolve, ms));
+}
+export class LocalAccessManager {
+    mdns = null;
+    state = null;
+    options = null;
+    getState() {
+        const options = this.options ?? { host: '0.0.0.0', port: 9834, scheme: 'http' };
+        if (this.state)
+            return this.state;
+        return buildState(getLocalAccessSetting(), options, 'disabled', 'Local access has not started yet.');
+    }
+    async start(options) {
+        this.options = options;
+        await this.stop();
+        let setting = await getLocalAccessSettingAsync();
+        const lanAddresses = getLanIPv4Addresses();
+        if (isLoopbackHost(options.host)) {
+            this.state = buildState(setting, options, 'loopback-only', 'Server is bound to loopback only.');
+            return this.state;
+        }
+        if (lanAddresses.length === 0) {
+            this.state = buildState(setting, options, 'disabled', 'No LAN IPv4 address was found.');
+            return this.state;
+        }
+        if (!isAuthEnabled()) {
+            this.state = buildState(setting, options, 'needs-auth', 'Set an access password before advertising on the LAN.');
+            return this.state;
+        }
+        for (let attempt = 0; attempt < 5; attempt += 1) {
+            const hostnames = [hostnameForName(setting.name)];
+            const conflict = await this.hasConflict(hostnames, lanAddresses);
+            if (!conflict)
+                break;
+            if (setting.source === 'manual') {
+                this.state = buildState(setting, options, 'conflict', `${hostnames.join(' / ')} is already in use on this LAN.`);
+                return this.state;
+            }
+            setting = { name: createAutoLocalAccessName(), source: 'auto' };
+            await setLocalAccessSettingAsync(setting);
+        }
+        this.mdns = multicastDns({ loopback: true, reuseAddr: true });
+        this.mdns.on('query', (packet) => this.handleQuery(packet));
+        this.state = buildState(setting, options, 'active', null);
+        return this.state;
+    }
+    async updateName(input, source) {
+        const normalized = normalizeLocalAccessName(input);
+        if (!normalized) {
+            const current = this.getState();
+            this.state = { ...current, status: 'error', reason: 'Invalid local access name.' };
+            return this.state;
+        }
+        await setLocalAccessSettingAsync({ name: normalized, source });
+        if (!this.options) {
+            this.state = buildState({ name: normalized, source }, { host: '0.0.0.0', port: 9834, scheme: 'http' }, 'disabled', 'Local access has not started yet.');
+            return this.state;
+        }
+        return this.start(this.options);
+    }
+    async resetAutoName() {
+        await setLocalAccessSettingAsync({ name: createAutoLocalAccessName(), source: 'auto' });
+        if (!this.options) {
+            const setting = await getLocalAccessSettingAsync();
+            this.state = buildState(setting, { host: '0.0.0.0', port: 9834, scheme: 'http' }, 'disabled', 'Local access has not started yet.');
+            return this.state;
+        }
+        return this.start(this.options);
+    }
+    stop() {
+        return new Promise((resolve) => {
+            const mdns = this.mdns;
+            this.mdns = null;
+            if (!mdns) {
+                resolve();
+                return;
+            }
+            try {
+                mdns.destroy(resolve);
+            }
+            catch {
+                resolve();
+            }
+        });
+    }
+    handleQuery(packet) {
+        const state = this.state;
+        if (!state || state.status !== 'active' || !this.mdns)
+            return;
+        const hostnames = new Set([state.hostname.toLowerCase()]);
+        const wantsAnswer = (packet.questions ?? []).some((question) => {
+            const qName = normalizeQuestionName(question.name);
+            return hostnames.has(qName) && (question.type === 'A' || question.type === 'ANY');
+        });
+        if (!wantsAnswer)
+            return;
+        const answers = Array.from(hostnames).flatMap((hostname) => state.lanAddresses.map((address) => ({
+            name: hostname,
+            type: 'A',
+            ttl: LOCAL_ACCESS.mdnsTtlSeconds,
+            data: address,
+        })));
+        try {
+            this.mdns.respond({ answers });
+        }
+        catch (error) {
+            console.warn('[local-access] failed to respond to mDNS query:', error);
+        }
+    }
+    async hasConflict(hostnames, localAddresses) {
+        const mdns = multicastDns({ loopback: false, reuseAddr: true });
+        const localSet = new Set(localAddresses);
+        let conflict = false;
+        const targets = new Set(hostnames.map((hostname) => hostname.toLowerCase()));
+        mdns.on('response', (packet) => {
+            for (const answer of packet.answers ?? []) {
+                const name = normalizeQuestionName(answer.name);
+                if (!targets.has(name) || answer.type !== 'A')
+                    continue;
+                if (typeof answer.data === 'string' && !localSet.has(answer.data)) {
+                    conflict = true;
+                }
+            }
+        });
+        try {
+            mdns.query(hostnames.map((name) => ({ name, type: 'A' })));
+            await wait(650);
+        }
+        catch {
+            return false;
+        }
+        finally {
+            try {
+                mdns.destroy();
+            }
+            catch { /* ignore */ }
+        }
+        return conflict;
+    }
+}
+export const localAccessManager = new LocalAccessManager();

package/dist/server/utils/pathValidator.js

@@ -0,0 +1,272 @@
+import path from 'path';
+import fs from 'fs';
+/**
+ * 安全路径验证器
+ * 防止路径遍历攻击，限制访问范围
+ */
+export class PathValidator {
+    allowedPaths;
+    defaultAllowedPaths;
+    constructor() {
+        // 默认允许的路径
+        this.defaultAllowedPaths = [
+            // 用户主目录
+            process.env.HOME || process.env.USERPROFILE || '/home',
+            // 临时目录
+            '/tmp',
+            // 当前工作目录
+            process.cwd(),
+        ].filter(Boolean).map(p => this.normalizeAllowedPath(p));
+        this.allowedPaths = new Set(this.defaultAllowedPaths);
+        // 从环境变量读取额外的允许路径（平台分隔符：Windows 为 ";"，POSIX 为 ":"，
+        // 不能用 ":" 硬拆，否则 "C:\foo" 这类盘符路径会被拆碎）
+        const extraPaths = process.env.ALLOWED_PATHS?.split(path.delimiter).filter(Boolean) || [];
+        extraPaths.forEach(p => {
+            try {
+                this.allowedPaths.add(this.normalizeAllowedPath(p));
+            }
+            catch (error) {
+                console.warn(`Invalid allowed path: ${p}`, error);
+            }
+        });
+    }
+    /**
+     * 验证和规范化路径（仅允许目录）
+     * @param requestedPath 请求的路径
+     * @returns 安全、规范化的路径
+     * @throws Error 如果路径不安全
+     */
+    validate(requestedPath) {
+        if (!requestedPath || typeof requestedPath !== 'string') {
+            throw new Error('Path must be a non-empty string');
+        }
+        // 解析路径，去除相对路径
+        let resolvedPath;
+        try {
+            resolvedPath = path.resolve(requestedPath);
+        }
+        catch (error) {
+            throw new Error(`Invalid path format: ${requestedPath}`);
+        }
+        // 检查路径是否存在
+        if (!fs.existsSync(resolvedPath)) {
+            throw new Error(`Directory does not exist: ${resolvedPath}`);
+        }
+        const realPath = fs.realpathSync(resolvedPath);
+        // 检查是否为目录
+        try {
+            const stat = fs.statSync(realPath);
+            if (!stat.isDirectory()) {
+                throw new Error(`Path is not a directory: ${realPath}`);
+            }
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes('not a directory')) {
+                throw error;
+            }
+            throw new Error(`Cannot access directory: ${realPath}`);
+        }
+        // 检查路径是否在允许的范围内
+        if (!this.isInAllowedPaths(realPath)) {
+            console.warn(`Access denied: ${realPath} is not in allowed paths`);
+            throw new Error('Access denied: directory not allowed');
+        }
+        // 额外的安全检查：避免系统关键目录
+        this.checkDangerousPatterns(realPath);
+        return realPath;
+    }
+    /**
+     * 异步验证和规范化路径（仅允许目录）。用于 HTTP 热路径，避免同步 fs I/O 阻塞 event loop。
+     */
+    async validateAsync(requestedPath) {
+        if (!requestedPath || typeof requestedPath !== 'string') {
+            throw new Error('Path must be a non-empty string');
+        }
+        let resolvedPath;
+        try {
+            resolvedPath = path.resolve(requestedPath);
+        }
+        catch (error) {
+            throw new Error(`Invalid path format: ${requestedPath}`);
+        }
+        let realPath;
+        try {
+            realPath = await fs.promises.realpath(resolvedPath);
+        }
+        catch {
+            throw new Error(`Directory does not exist: ${resolvedPath}`);
+        }
+        try {
+            const stat = await fs.promises.stat(realPath);
+            if (!stat.isDirectory()) {
+                throw new Error(`Path is not a directory: ${realPath}`);
+            }
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes('not a directory')) {
+                throw error;
+            }
+            throw new Error(`Cannot access directory: ${realPath}`);
+        }
+        if (!this.isInAllowedPaths(realPath)) {
+            console.warn(`Access denied: ${realPath} is not in allowed paths`);
+            throw new Error('Access denied: directory not allowed');
+        }
+        this.checkDangerousPatterns(realPath);
+        return realPath;
+    }
+    /**
+     * 验证和规范化路径（允许文件和目录）
+     * @param requestedPath 请求的路径
+     * @returns 安全、规范化的路径
+     * @throws Error 如果路径不安全
+     */
+    validatePath(requestedPath) {
+        if (!requestedPath || typeof requestedPath !== 'string') {
+            throw new Error('Path must be a non-empty string');
+        }
+        let resolvedPath;
+        try {
+            resolvedPath = path.resolve(requestedPath);
+        }
+        catch (error) {
+            throw new Error(`Invalid path format: ${requestedPath}`);
+        }
+        if (!fs.existsSync(resolvedPath)) {
+            throw new Error(`Path does not exist: ${resolvedPath}`);
+        }
+        const realPath = fs.realpathSync(resolvedPath);
+        // 对最终真实路径做白名单校验，避免允许目录内的 symlink 指向敏感位置。
+        try {
+            if (!this.isInAllowedPaths(realPath)) {
+                console.warn(`Access denied: ${realPath} is not in allowed paths`);
+                throw new Error('Access denied: path not allowed');
+            }
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes('not allowed')) {
+                throw error;
+            }
+            throw new Error(`Cannot access path: ${realPath}`);
+        }
+        this.checkDangerousPatterns(realPath);
+        return realPath;
+    }
+    /**
+     * 异步验证和规范化路径（允许文件和目录）。用于 HTTP 热路径，避免同步 fs I/O 阻塞 event loop。
+     */
+    async validatePathAsync(requestedPath) {
+        if (!requestedPath || typeof requestedPath !== 'string') {
+            throw new Error('Path must be a non-empty string');
+        }
+        let resolvedPath;
+        try {
+            resolvedPath = path.resolve(requestedPath);
+        }
+        catch (error) {
+            throw new Error(`Invalid path format: ${requestedPath}`);
+        }
+        let realPath;
+        try {
+            realPath = await fs.promises.realpath(resolvedPath);
+        }
+        catch {
+            throw new Error(`Path does not exist: ${resolvedPath}`);
+        }
+        try {
+            if (!this.isInAllowedPaths(realPath)) {
+                console.warn(`Access denied: ${realPath} is not in allowed paths`);
+                throw new Error('Access denied: path not allowed');
+            }
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes('not allowed')) {
+                throw error;
+            }
+            throw new Error(`Cannot access path: ${realPath}`);
+        }
+        this.checkDangerousPatterns(realPath);
+        return realPath;
+    }
+    isInAllowedPaths(resolvedPath) {
+        for (const allowedPath of this.allowedPaths) {
+            if (this.isSameOrChildPath(allowedPath, resolvedPath)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    isSameOrChildPath(parentPath, childPath) {
+        const relativePath = path.relative(parentPath, childPath);
+        return relativePath === '' || (!relativePath.startsWith('..') &&
+            !path.isAbsolute(relativePath));
+    }
+    normalizeAllowedPath(inputPath) {
+        const resolved = path.resolve(inputPath);
+        try {
+            return fs.realpathSync(resolved);
+        }
+        catch {
+            return resolved;
+        }
+    }
+    checkDangerousPatterns(resolvedPath) {
+        const dangerousPatterns = [
+            '/bin', '/sbin', '/usr/bin', '/usr/sbin',
+            '/etc', '/var', '/lib', '/proc', '/sys',
+            '/boot', '/root', '/dev'
+        ];
+        for (const pattern of dangerousPatterns) {
+            if (this.isSameOrChildPath(pattern, resolvedPath)) {
+                console.warn(`Access denied: ${resolvedPath} is a system directory`);
+                throw new Error('Access denied: system directories are restricted');
+            }
+        }
+    }
+    /**
+     * 添加允许的路径
+     */
+    addAllowedPath(pathToAdd) {
+        const resolved = this.normalizeAllowedPath(pathToAdd);
+        this.allowedPaths.add(resolved);
+    }
+    /**
+     * 将终端会话的 cwd 动态加入白名单（静默失败）。
+     * 终端里的 shell 本身不受路径限制，用户 cd 到哪，侧边栏/文件 API 就应能
+     * 浏览哪（默认白名单只有 HOME/cwd，Windows 上切到其它盘符会全部拒绝）。
+     * 仅在路径真实存在且是目录时放行。
+     */
+    async allowSessionCwd(cwdPath) {
+        if (!cwdPath || typeof cwdPath !== 'string')
+            return;
+        try {
+            const stat = await fs.promises.stat(cwdPath);
+            if (stat.isDirectory()) {
+                this.addAllowedPath(cwdPath);
+            }
+        }
+        catch {
+            // 路径不存在或不可读——不放行
+        }
+    }
+    /**
+     * 获取所有允许的路径
+     */
+    getAllowedPaths() {
+        return Array.from(this.allowedPaths);
+    }
+    /**
+     * 检查路径是否在允许范围内（不抛出异常）
+     */
+    isPathAllowed(requestedPath) {
+        try {
+            this.validate(requestedPath);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+// 单例实例
+export const pathValidator = new PathValidator();

package/dist/server/utils/requestSecurity.js

@@ -0,0 +1,103 @@
+import { getLanIPv4Addresses, localAccessManager } from './localAccess.js';
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
+function stripPort(hostHeader) {
+    const raw = (hostHeader ?? '').trim().toLowerCase();
+    if (!raw)
+        return '';
+    if (raw.startsWith('[')) {
+        const end = raw.indexOf(']');
+        return end >= 0 ? raw.slice(1, end) : raw;
+    }
+    return raw.split(':')[0] ?? raw;
+}
+// 额外主机白名单：TERMDOCK_ALLOWED_HOSTS=逗号分隔的主机名/IP（带端口也行，
+// 端口会被剥掉）。用于公网域名 / 反向代理 / 内网穿透等默认白名单覆盖不到的入口，
+// 例如 TERMDOCK_ALLOWED_HOSTS=term.example.com,10.8.0.2
+let cachedEnvHosts = null;
+function getEnvExtraHosts() {
+    const raw = process.env.TERMDOCK_ALLOWED_HOSTS ?? '';
+    if (!cachedEnvHosts || cachedEnvHosts.raw !== raw) {
+        cachedEnvHosts = {
+            raw,
+            hosts: raw
+                .split(',')
+                .map((entry) => stripPort(entry.trim().toLowerCase()))
+                .filter((entry) => entry.length > 0),
+        };
+    }
+    return cachedEnvHosts.hosts;
+}
+export function getAllowedHosts() {
+    const hosts = new Set(LOOPBACK_HOSTS);
+    for (const address of getLanIPv4Addresses()) {
+        hosts.add(address.toLowerCase());
+    }
+    const localAccess = localAccessManager.getState();
+    if (localAccess.hostname) {
+        hosts.add(localAccess.hostname.toLowerCase());
+    }
+    for (const host of getEnvExtraHosts()) {
+        hosts.add(host);
+    }
+    return hosts;
+}
+export function isAllowedHost(hostHeader) {
+    const host = stripPort(hostHeader);
+    if (!host)
+        return false;
+    return getAllowedHosts().has(host);
+}
+export function validateHostMiddleware(req, res, next) {
+    if (!isAllowedHost(req.headers.host)) {
+        res.status(421).json({ error: 'Host is not allowed', code: 'HOST_NOT_ALLOWED' });
+        return;
+    }
+    next();
+}
+export function isAllowedOrigin(originHeader, _hostHeader) {
+    // 与下方 isUpgradeOriginAllowed 同理：dev 模式下 Vite proxy (9833 → 9835) 用
+    // changeOrigin: true 把 Host 改写成 `localhost:9835`，而浏览器 Origin 仍是
+    // `http://192.168.x.x:9833`，强制 Origin === Host 会让 LAN 访问的所有 POST
+    // （包括登录）全部 403。Origin 头由浏览器控制、无法被网页攻击者伪造，所以只
+    // 要求 origin host 落在 allowedHosts 白名单内即可，防 CSRF 的强度不变。
+    // 注意：反向代理场景下 Host 头可能是内部地址，不用它来 gate Origin 检查，
+    // 否则 TERMDOCK_ALLOWED_HOSTS 只包含公网域名时会误杀正常登录请求。
+    if (!originHeader)
+        return true;
+    try {
+        const originHost = stripPort(new URL(originHeader).host);
+        if (!originHost)
+            return false;
+        return getAllowedHosts().has(originHost);
+    }
+    catch {
+        return false;
+    }
+}
+export function validateOriginMiddleware(req, res, next) {
+    if (!isAllowedOrigin(req.headers.origin, req.headers.host)) {
+        res.status(403).json({ error: 'Origin is not allowed', code: 'ORIGIN_NOT_ALLOWED' });
+        return;
+    }
+    next();
+}
+export function isUpgradeOriginAllowed(originHeader, _hostHeader) {
+    // WS 升级请求：Origin 头是浏览器实际发出的（不可伪造），而 Host 头可能被前置代理改写。
+    // 在 dev 模式下 Vite proxy (9833 → 9835) 用 changeOrigin: true 会把 Host 改写成
+    // `localhost:9835`，但 Origin 仍是 `http://192.168.x.x:9833`。这种 mismatch
+    // 会让正常 LAN 访问全部 403、WS 退化为持续 reconnecting。
+    // 这里只要求 origin host 落在 allowedHosts 里（loopback + LAN IPv4 + mDNS 域名），
+    // 不强制等于 request.headers.host。Origin 校验保持原强度（必须能解析出 host、
+    // 且 host 在白名单内），所以攻击者把 Origin 改成任意地址仍然过不了。
+    if (!originHeader)
+        return true;
+    try {
+        const originHost = stripPort(new URL(originHeader).host);
+        if (!originHost)
+            return false;
+        return getAllowedHosts().has(originHost);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/server/utils/serverLogger.js

@@ -0,0 +1,57 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+const TERMDOCK_DIR = path.join(os.homedir(), '.termdock');
+const DEFAULT_MAX_BYTES = 10 * 1024 * 1024;
+const writeChains = new Map();
+const rotateInProgress = new Set();
+async function rotateIfNeeded(filePath, maxBytes) {
+    if (rotateInProgress.has(filePath))
+        return;
+    rotateInProgress.add(filePath);
+    try {
+        const stat = await fs.promises.stat(filePath).catch(() => null);
+        if (!stat || stat.size < maxBytes)
+            return;
+        const rotatedPath = `${filePath}.1`;
+        await fs.promises.rm(rotatedPath, { force: true }).catch(() => undefined);
+        await fs.promises.rename(filePath, rotatedPath).catch(() => undefined);
+    }
+    finally {
+        rotateInProgress.delete(filePath);
+    }
+}
+function enqueueWrite(filePath, line, maxBytes) {
+    const previous = writeChains.get(filePath) ?? Promise.resolve();
+    const next = previous
+        .catch(() => undefined)
+        .then(async () => {
+        await fs.promises.mkdir(TERMDOCK_DIR, { recursive: true });
+        await rotateIfNeeded(filePath, maxBytes);
+        await fs.promises.appendFile(filePath, line, 'utf8');
+    })
+        .catch(() => undefined);
+    writeChains.set(filePath, next);
+}
+export function getTermdockLogPath(name) {
+    return path.join(TERMDOCK_DIR, name);
+}
+export function writeJsonLog(name, entry, maxBytes = DEFAULT_MAX_BYTES) {
+    const filePath = getTermdockLogPath(name);
+    const line = JSON.stringify({
+        ts: new Date().toISOString(),
+        pid: process.pid,
+        ...entry,
+    }) + '\n';
+    enqueueWrite(filePath, line, maxBytes);
+}
+export function writeTextLog(name, line, maxBytes = DEFAULT_MAX_BYTES) {
+    const filePath = getTermdockLogPath(name);
+    enqueueWrite(filePath, `${line.replace(/\n$/, '')}\n`, maxBytes);
+}
+export function writeErrorLog(entry) {
+    writeJsonLog('errors.log', entry);
+}
+export function writeDiffTraceLog(entry) {
+    writeJsonLog('diff-trace.log', entry);
+}