ticketlens 0.10.2 → 0.10.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/SKILL.md

@@ -1,4 +1,4 @@
-<!-- jtb-skill-version: 0.10.2 -->
+<!-- jtb-skill-version: 0.10.4 -->
 ---
 name: jtb
 description: Fetch a Jira ticket's full context (description, comments, linked issues, code references) and assemble a structured TicketBrief for implementation planning. Use when user types /jtb, mentions a Jira ticket key, or wants to plan work from a Jira ticket.

package/skills/jtb/scripts/lib/attachment-downloader.mjs

@@ -6,24 +6,43 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { buildAuthHeader } from './jira-client.mjs';
+import { buildAuthHeader, isSafeRedirectUrl, validateResolvedHost, defaultLookupFor } from './jira-client.mjs';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
 const MAX_ATTACHMENTS = 20;
 const MAX_FILE_BYTES = 10 * 1024 * 1024; // 10 MB
+const MAX_REDIRECT_HOPS = 2;
 
-// Blocks redirect targets to private/internal addresses (SSRF via redirect).
-// Mirrors BLOCKED_PATTERNS in jira-client.mjs; kept local to avoid coupling.
-const BLOCKED_REDIRECT_PATTERNS = [
-  /^127\./, /^10\./, /^172\.(1[6-9]|2\d|3[01])\./, /^192\.168\./,
-  /^169\.254\./, /^0\.0\.0\.0$/, /^::1$/, /^::ffff:/i, /^fc00:/i, /^fe80:/i, /^localhost$/i,
-];
-
-function isSafeRedirectUrl(url) {
-  let parsed;
-  try { parsed = new URL(url); } catch { return false; }
-  if (parsed.protocol !== 'https:') return false;
-  const hostname = parsed.hostname.replace(/^\[|\]$/g, '');
-  return !BLOCKED_REDIRECT_PATTERNS.some(re => re.test(hostname));
+/**
+ * DNS-validates the initial URL, then follows any redirect chain manually,
+ * re-validating (blocklist + DNS) EVERY hop — not just the first.
+ * `redirect:'follow'` on the first hop's target would let that host issue a
+ * second, unvalidated redirect straight through (audit 2026-07-07 §4.1
+ * code-review remediation). Auth headers are only ever sent on the initial
+ * request — every hop after that is auth-less, matching Jira Cloud's
+ * presigned-URL CDN redirect model.
+ */
+async function followValidatedRedirects(initialUrl, fetcher, lookup, headers) {
+  let url = initialUrl;
+  await validateResolvedHost(new URL(url).hostname, lookup);
+  let response = await fetcher(url, { headers, redirect: 'manual' });
+  let hops = 0;
+  while (response.status >= 300 && response.status < 400) {
+    hops++;
+    if (hops > MAX_REDIRECT_HOPS) {
+      throw new Error(`Too many redirects (>${MAX_REDIRECT_HOPS}) following ${initialUrl}`);
+    }
+    const location = response.headers?.get?.('location');
+    if (!location) throw new Error('Redirect without Location header');
+    const redirectUrl = new URL(location, url).href;
+    if (!isSafeRedirectUrl(redirectUrl)) {
+      throw new Error(`Redirect to blocked host (${new URL(redirectUrl).hostname}) rejected`);
+    }
+    await validateResolvedHost(new URL(redirectUrl).hostname, lookup);
+    url = redirectUrl;
+    // Safe CDN/S3 redirect — follow without auth (presigned URLs are self-authorizing)
+    response = await fetcher(url, { redirect: 'manual' });
+  }
+  return response;
 }
 
 /**
@@ -41,6 +60,7 @@ export async function downloadAttachments(ticket, opts = {}) {
   const {
     env = process.env,
     fetcher = globalThis.fetch,
+    lookup = defaultLookupFor(fetcher),
     configDir = DEFAULT_CONFIG_DIR,
     noCache = false,
     onProgress = null,
@@ -98,23 +118,7 @@ export async function downloadAttachments(ticket, opts = {}) {
       onProgress?.(`  download  ${a.filename}`);
       try {
         const headers = buildAuthHeader(env);
-        // Probe with redirect:'manual' to intercept any redirect before following it.
-        // Validates the redirect target against BLOCKED_REDIRECT_PATTERNS so a
-        // Jira-origin URL that redirects to a private IP (e.g. 169.254.x.x) is rejected.
-        const probe = await fetcher(a.content, { headers, redirect: 'manual' });
-        let response;
-        if (probe.status >= 300 && probe.status < 400) {
-          const location = probe.headers?.get?.('location');
-          if (!location) throw new Error('Redirect without Location header');
-          const redirectUrl = new URL(location, a.content).href;
-          if (!isSafeRedirectUrl(redirectUrl)) {
-            throw new Error(`Redirect to blocked host (${new URL(redirectUrl).hostname}) rejected`);
-          }
-          // Safe CDN/S3 redirect — follow without auth (presigned URLs are self-authorizing)
-          response = await fetcher(redirectUrl, { redirect: 'follow' });
-        } else {
-          response = probe;
-        }
+        const response = await followValidatedRedirects(a.content, fetcher, lookup, headers);
         if (!response.ok) throw new Error(`HTTP ${response.status} (${response.statusText})`);
         const buffer = await response.arrayBuffer();
         fs.writeFileSync(localPath, Buffer.from(buffer));

package/skills/jtb/scripts/lib/jira-client.mjs

@@ -5,6 +5,7 @@
  */
 
 import { adfToText } from './adf-converter.mjs';
+import { lookup as dnsLookup } from 'node:dns/promises';
 
 function toText(value) {
   if (value == null) return null;
@@ -100,21 +101,30 @@ export function normalizeTicket(raw) {
   };
 }
 
-// RFC-1918 + link-local + loopback + localhost blocked to prevent SSRF.
+// RFC-1918 + link-local + loopback + localhost + IPv6 ULA/link-local + CGN NAT
+// blocked to prevent SSRF. Each pattern matches the FULL CIDR range, not a
+// single literal value — a narrower match (e.g. exact "fc00:") lets addresses
+// elsewhere in the same reserved block sail through (audit 2026-07-07 §4.1
+// code-review remediation).
 const BLOCKED_PATTERNS = [
-  /^127\./,
-  /^10\./,
-  /^172\.(1[6-9]|2\d|3[01])\./,
-  /^192\.168\./,
-  /^169\.254\./,
-  /^0\.0\.0\.0$/,
-  /^::1$/,
-  /^::ffff:/i,
-  /^fc00:/i,
-  /^fe80:/i,
+  /^127\./,                                  // 127.0.0.0/8 loopback
+  /^10\./,                                   // 10.0.0.0/8 RFC1918
+  /^172\.(1[6-9]|2\d|3[01])\./,               // 172.16.0.0/12 RFC1918
+  /^192\.168\./,                             // 192.168.0.0/16 RFC1918
+  /^169\.254\./,                             // 169.254.0.0/16 link-local + cloud metadata
+  /^0\./,                                    // 0.0.0.0/8 "this network"
+  /^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./, // 100.64.0.0/10 Carrier-Grade NAT
+  /^::1$/,                                   // IPv6 loopback
+  /^::ffff:/i,                               // IPv4-mapped IPv6
+  /^f[cd][0-9a-f]{2}:/i,                     // fc00::/7 Unique Local Address (covers real-world fd00::/8)
+  /^fe[89ab][0-9a-f]:/i,                     // fe80::/10 link-local
   /^localhost$/i,
 ];
 
+function normalizeHostname(hostname) {
+  return hostname.replace(/^\[|\]$/g, '').replace(/\.$/, '');
+}
+
 export function validateBaseUrl(url) {
   let parsed;
   try { parsed = new URL(url); } catch {
@@ -123,12 +133,112 @@ export function validateBaseUrl(url) {
   if (parsed.protocol !== 'https:') {
     throw new Error(`JIRA_BASE_URL must use HTTPS (got ${parsed.protocol})`);
   }
-  const hostname = parsed.hostname.replace(/^\[|\]$/g, '');
+  const hostname = normalizeHostname(parsed.hostname);
   if (BLOCKED_PATTERNS.some(re => re.test(hostname))) {
     throw new Error(`JIRA_BASE_URL hostname is blocked (${hostname})`);
   }
 }
 
+/**
+ * Validates a redirect target URL: HTTPS + hostname not in the private/internal
+ * blocklist. Shared by attachment-downloader (CDN redirect follow) — the API
+ * client itself never follows redirects (see guardedFetch).
+ */
+export function isSafeRedirectUrl(url) {
+  let parsed;
+  try { parsed = new URL(url); } catch { return false; }
+  if (parsed.protocol !== 'https:') return false;
+  const hostname = normalizeHostname(parsed.hostname);
+  return !BLOCKED_PATTERNS.some(re => re.test(hostname));
+}
+
+/**
+ * Shared default for the `lookup` opt across every call site: the real DNS
+ * resolver only when the caller is using the real fetch (production), null
+ * for mocked fetchers (tests — no socket opens, nothing to protect).
+ */
+export function defaultLookupFor(fetcher) {
+  return fetcher === globalThis.fetch ? dnsLookup : null;
+}
+
+// Per-lookup-fn DNS validation cache: WeakMap<lookupFn, Map<hostname, Promise<void>>>.
+// Keying by the lookup function isolates test stubs from each other and from the
+// real resolver, with zero reset hooks needed. Entries are deleted once their
+// promise settles (see below) — this dedupes only genuinely concurrent lookups,
+// never sequential ones.
+const dnsValidationCaches = new WeakMap();
+
+/**
+ * DNS-rebinding guard: resolves `hostname` and rejects if ANY returned address
+ * matches BLOCKED_PATTERNS. The upfront validateBaseUrl check only sees the
+ * hostname *string*; a passing hostname can still resolve to 127.0.0.1 or
+ * 169.254.169.254 at connect time. Fail-closed: resolver errors propagate.
+ *
+ * Cache entries are deleted as soon as their promise settles, so the cache
+ * only dedupes calls that are truly in flight at the same instant (e.g. a
+ * Promise.all fan-out over linked tickets) — it never lets a sequential call
+ * reuse a stale verdict. A cache with no expiry would hand a DNS-rebinding
+ * attacker the whole CLI run's wall-clock duration to flip the record after
+ * the first (validated) resolution; this way each sequential call re-resolves.
+ *
+ * Known residual: TOCTOU between this lookup and fetch's own resolution within
+ * a SINGLE call — a TTL-0 rebinder can still race that one connection. Full
+ * IP-pinning needs a custom undici Agent, which would break the zero-dependency
+ * constraint. This check raises the bar; it does not eliminate a single-call race.
+ *
+ * `lookup` is null when the fetcher is mocked (tests) — no socket opens, so
+ * there is nothing to protect. Production always uses globalThis.fetch, which
+ * always gets the real resolver (see defaultLookupFor).
+ */
+export async function validateResolvedHost(hostname, lookup) {
+  if (!lookup) return;
+  let cache = dnsValidationCaches.get(lookup);
+  if (!cache) {
+    cache = new Map();
+    dnsValidationCaches.set(lookup, cache);
+  }
+  if (!cache.has(hostname)) {
+    const validation = (async () => {
+      const addresses = await lookup(hostname, { all: true });
+      for (const { address } of addresses) {
+        if (BLOCKED_PATTERNS.some(re => re.test(address))) {
+          throw new Error(`Hostname ${hostname} resolves to a blocked address (${address}) — refusing to connect`);
+        }
+      }
+    })();
+    validation.catch(() => {}).finally(() => cache.delete(hostname));
+    cache.set(hostname, validation);
+  }
+  return cache.get(hostname);
+}
+
+/**
+ * Single enforcement point for all Jira API calls:
+ *  1. DNS-validate the target host (when a resolver is available).
+ *  2. Force redirect:'manual' — call sites cannot forget or override it.
+ *  3. Refuse ANY 3xx. A redirect on a REST endpoint means JIRA_BASE_URL is
+ *     misconfigured, not normal Jira behavior. Refusing (instead of following)
+ *     means credentials can never cross a redirect — this deliberately keeps
+ *     fetch's own auth-strip protection irrelevant rather than overriding it.
+ * Error message carries the redirect target's HOSTNAME only — Location values
+ * can contain presigned tokens in path/query.
+ */
+export async function guardedFetch(url, fetchOpts, { fetcher, lookup }) {
+  await validateResolvedHost(new URL(url).hostname, lookup);
+  const response = await fetcher(url, { ...fetchOpts, redirect: 'manual' });
+  if (response.status >= 300 && response.status < 400) {
+    let target = 'unknown host';
+    const location = response.headers?.get?.('location');
+    if (location) {
+      try { target = new URL(location, url).hostname; } catch {}
+    }
+    const err = new Error(`Jira API redirected to ${target} — refusing to follow; check JIRA_BASE_URL`);
+    err.status = response.status;
+    throw err;
+  }
+  return response;
+}
+
 export function buildAuthHeader(env) {
   if (env.JIRA_PAT) {
     return { Authorization: `Bearer ${env.JIRA_PAT}` };
@@ -138,7 +248,7 @@ export function buildAuthHeader(env) {
 }
 
 export async function fetchCurrentUser(opts = {}) {
-  const { env = process.env, fetcher = globalThis.fetch, apiVersion = 2, timeoutMs = 10_000 } = opts;
+  const { env = process.env, fetcher = globalThis.fetch, lookup = defaultLookupFor(fetcher), apiVersion = 2, timeoutMs = 10_000 } = opts;
   validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
@@ -146,7 +256,7 @@ export async function fetchCurrentUser(opts = {}) {
   const url = `${baseUrl}/rest/api/${apiVersion}/myself`;
   const fetchOpts = { headers };
   if (timeoutMs) fetchOpts.signal = AbortSignal.timeout(timeoutMs);
-  const response = await fetcher(url, fetchOpts);
+  const response = await guardedFetch(url, fetchOpts, { fetcher, lookup });
 
   if (!response.ok) {
     const err = new Error(`Jira API error ${response.status} fetching current user`);
@@ -164,7 +274,7 @@ export async function fetchCurrentUser(opts = {}) {
 }
 
 export async function fetchStatuses(opts = {}) {
-  const { env = process.env, fetcher = globalThis.fetch, apiVersion = 2, timeoutMs = 10_000 } = opts;
+  const { env = process.env, fetcher = globalThis.fetch, lookup = defaultLookupFor(fetcher), apiVersion = 2, timeoutMs = 10_000 } = opts;
   validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
@@ -172,7 +282,7 @@ export async function fetchStatuses(opts = {}) {
   const url = `${baseUrl}/rest/api/${apiVersion}/status`;
   const fetchOpts = { headers };
   if (timeoutMs) fetchOpts.signal = AbortSignal.timeout(timeoutMs);
-  const response = await fetcher(url, fetchOpts);
+  const response = await guardedFetch(url, fetchOpts, { fetcher, lookup });
 
   if (!response.ok) {
     const err = new Error(`Jira API error ${response.status} fetching statuses`);
@@ -185,7 +295,7 @@ export async function fetchStatuses(opts = {}) {
 }
 
 export async function searchTickets(jql, opts = {}) {
-  const { env = process.env, fetcher = globalThis.fetch, maxResults = 50, apiVersion = 2, timeoutMs = 10_000, expandChangelog = false } = opts;
+  const { env = process.env, fetcher = globalThis.fetch, lookup = defaultLookupFor(fetcher), maxResults = 50, apiVersion = 2, timeoutMs = 10_000, expandChangelog = false } = opts;
   validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
@@ -197,7 +307,7 @@ export async function searchTickets(jql, opts = {}) {
   const url = `${baseUrl}${endpoint}?${params}`;
   const fetchOpts = { headers };
   if (timeoutMs) fetchOpts.signal = AbortSignal.timeout(timeoutMs);
-  const response = await fetcher(url, fetchOpts);
+  const response = await guardedFetch(url, fetchOpts, { fetcher, lookup });
 
   if (!response.ok) {
     let detail = '';
@@ -213,7 +323,7 @@ export async function searchTickets(jql, opts = {}) {
 }
 
 export async function fetchRemoteLinks(ticketKey, opts = {}) {
-  const { env = process.env, fetcher = globalThis.fetch, apiVersion = 2, timeoutMs = 10_000 } = opts;
+  const { env = process.env, fetcher = globalThis.fetch, lookup = defaultLookupFor(fetcher), apiVersion = 2, timeoutMs = 10_000 } = opts;
   validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const url = `${baseUrl}/rest/api/${apiVersion}/issue/${encodeURIComponent(ticketKey)}/remotelink`;
@@ -221,7 +331,7 @@ export async function fetchRemoteLinks(ticketKey, opts = {}) {
   const fetchOpts = { headers: { ...buildAuthHeader(env), 'Content-Type': 'application/json' } };
   if (timeoutMs) fetchOpts.signal = AbortSignal.timeout(timeoutMs);
 
-  const response = await fetcher(url, fetchOpts);
+  const response = await guardedFetch(url, fetchOpts, { fetcher, lookup });
   if (!response.ok) return [];
 
   const raw = await response.json();
@@ -231,7 +341,7 @@ export async function fetchRemoteLinks(ticketKey, opts = {}) {
 }
 
 export async function fetchTicket(ticketKey, opts = {}) {
-  const { env = process.env, fetcher = globalThis.fetch, depth = 1, apiVersion = 2, timeoutMs = 10_000, expandChangelog = false, _visited = new Set(), _currentDepth = 0 } = opts;
+  const { env = process.env, fetcher = globalThis.fetch, lookup = defaultLookupFor(fetcher), depth = 1, apiVersion = 2, timeoutMs = 10_000, expandChangelog = false, _visited = new Set(), _currentDepth = 0 } = opts;
   validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
@@ -240,7 +350,7 @@ export async function fetchTicket(ticketKey, opts = {}) {
   const url = `${baseUrl}/rest/api/${apiVersion}/issue/${encodeURIComponent(ticketKey)}${expand}`;
   const fetchOpts = { headers };
   if (timeoutMs) fetchOpts.signal = AbortSignal.timeout(timeoutMs);
-  const response = await fetcher(url, fetchOpts);
+  const response = await guardedFetch(url, fetchOpts, { fetcher, lookup });
 
   if (!response.ok) {
     const err = new Error(`Jira API error ${response.status} fetching ${ticketKey}`);