unbound-cli 1.20.0 → 1.20.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.20.0",
+  "version": "1.20.1",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/auth.js

@@ -2,6 +2,7 @@
  * Shared browser-based authentication flow.
  * Used by both `login` and `setup` commands.
  */
+const crypto = require('crypto');
 const http = require('http');
 const os = require('os');
 const { URL } = require('url');
@@ -35,6 +36,8 @@ function warnIfNotStored(stored) {
  */
 async function loginWithBrowser(frontendUrl, { open: openFn, scope = {} } = {}) {
   const server = http.createServer();
+  // One-time nonce: only the redirect the dashboard was handed can complete this login.
+  const state = crypto.randomBytes(16).toString('hex');
   let callbackResolve;
   let callbackReject;
 
@@ -73,7 +76,7 @@ async function loginWithBrowser(frontendUrl, { open: openFn, scope = {} } = {})
   function respondAndShutdown(res, statusCode, html) {
     res.on('finish', shutdownServer);
     res.on('close', shutdownServer);
-    res.writeHead(statusCode, { 'Content-Type': 'text/html; charset=utf-8', 'Connection': 'close' });
+    res.writeHead(statusCode, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store', 'Connection': 'close' });
     res.end(html);
   }
 
@@ -84,6 +87,14 @@ async function loginWithBrowser(frontendUrl, { open: openFn, scope = {} } = {})
   let callbackHandled = false;
   let stored;
 
+  // Compare byte lengths, not string lengths: a multi-byte candidate would make timingSafeEqual throw.
+  function stateMatches(candidate) {
+    if (typeof candidate !== 'string') return false;
+    const given = Buffer.from(candidate);
+    const expected = Buffer.from(state);
+    return given.length === expected.length && crypto.timingSafeEqual(given, expected);
+  }
+
   server.on('request', (req, res) => {
     const url = new URL(req.url, `http://localhost`);
 
@@ -93,6 +104,13 @@ async function loginWithBrowser(frontendUrl, { open: openFn, scope = {} } = {})
       return;
     }
 
+    // A request without this login's nonce is not the dashboard's redirect: answer it and keep waiting.
+    if (!stateMatches(url.searchParams.get('state'))) {
+      res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store', 'Connection': 'close' });
+      res.end(authPages.failurePage('Invalid login callback'));
+      return;
+    }
+
     if (callbackHandled) {
       res.writeHead(409, { 'Connection': 'close' });
       res.end('Callback already processed');
@@ -103,7 +121,7 @@ async function loginWithBrowser(frontendUrl, { open: openFn, scope = {} } = {})
     const apiKey = url.searchParams.get('api_key');
     const email = url.searchParams.get('email');
     const orgName = url.searchParams.get('org');
-    // The callback is reachable by any local page, so its text is stripped of control characters before display.
+    // Nonce-gated, but the reason is still stripped of control characters before display as defence in depth.
     const reason = (url.searchParams.get('error') || '').replace(/[\u0000-\u001f\u007f-\u009f]/g, '').slice(0, 200);
     // `scope` echoes what the dashboard minted; an older dashboard sends none.
     const grantedScope = url.searchParams.get('scope');
@@ -130,7 +148,8 @@ async function loginWithBrowser(frontendUrl, { open: openFn, scope = {} } = {})
   });
 
   const port = server.address().port;
-  const callbackUrl = `http://localhost:${port}/callback`;
+  // 127.0.0.1 literal: the server binds only IPv4, so a `localhost` redirect could land on a squatter at [::1].
+  const callbackUrl = `http://127.0.0.1:${port}/callback?state=${state}`;
   // `machine` names the login token after this host, so a re-login replaces that token instead of adding one.
   const params = new URLSearchParams({ callback_url: callbackUrl, app_type: 'cli', machine: os.hostname(), ...scope });
   const authUrl = `${frontendUrl}/automations/api-key-callback?${params.toString()}`;

package/test/auth-server-leak.test.js

@@ -64,11 +64,17 @@ function expectConnectionRefused(port) {
   });
 }
 
-// Pulls the callback_url the server told the browser to redirect to, then
-// appends the success params the /callback handler reads (api_key/email/org).
+// Mirrors the dashboard: keep callback_url's own query (the state nonce) and
+// set the success params the /callback handler reads (api_key/email/org).
+function withCallbackParams(callbackUrl, params) {
+  const u = new URL(callbackUrl);
+  for (const [k, v] of Object.entries(params)) u.searchParams.set(k, v);
+  return u.toString();
+}
+
 function buildSuccessCallback(authUrl) {
   const callbackUrl = new URL(authUrl).searchParams.get('callback_url');
-  return `${callbackUrl}?api_key=sk-test&email=a@b.co&org=Acme`;
+  return withCallbackParams(callbackUrl, { api_key: 'sk-test', email: 'a@b.co', org: 'Acme' });
 }
 
 // Monkeypatch config so no real ~/.unbound write happens. Restored in finally.
@@ -149,13 +155,13 @@ test('loginWithBrowser: duplicate /callback cannot overwrite the stored credenti
 
     const fakeOpen = async (authUrl) => {
       const callbackUrl = new URL(authUrl).searchParams.get('callback_url');
-      await getKeepAlive(agent, `${callbackUrl}?api_key=sk-first&email=a@b.co&org=Acme`);
+      await getKeepAlive(agent, withCallbackParams(callbackUrl, { api_key: 'sk-first', email: 'a@b.co', org: 'Acme' }));
       // Second callback with a different key: teardown is deferred to the
       // response flush, so the server may still be up — it must answer 409
       // without persisting; once down, ECONNREFUSED is equally acceptable.
       // Either way the first credentials must be the only ones stored.
       try {
-        const dup = await getKeepAlive(agent, `${callbackUrl}?api_key=sk-attacker&email=x@y.z&org=Evil`);
+        const dup = await getKeepAlive(agent, withCallbackParams(callbackUrl, { api_key: 'sk-attacker', email: 'x@y.z', org: 'Evil' }));
         assert.equal(dup.statusCode, 409, 'late duplicate must be rejected, not processed');
       } catch (err) {
         if (err.code !== 'ECONNREFUSED') throw err;

package/test/login-scope-callback.test.js

@@ -19,6 +19,13 @@ function get(url) {
   });
 }
 
+// Mirrors the dashboard: `new URL(callback_url)` keeps the state nonce, then the result params are set on it.
+function withCallbackParams(callbackUrl, params) {
+  const u = new URL(callbackUrl);
+  for (const [k, v] of Object.entries(params)) u.searchParams.set(k, v);
+  return u.toString();
+}
+
 function withStubbedConfig(fn) {
   const saved = { setApiKey: config.setApiKey, writeConfig: config.writeConfig, readConfig: config.readConfig };
   config.setApiKey = () => {};
@@ -33,7 +40,7 @@ test('loginWithBrowser: scope flags ride on the auth URL and the echoed scope co
     const fakeOpen = async (authUrl) => {
       authParams = new URL(authUrl).searchParams;
       const callbackUrl = authParams.get('callback_url');
-      setImmediate(() => get(`${callbackUrl}?api_key=sk-test&email=a@b.co&org=Acme&scope=role%3AAnalytics+Viewer`));
+      setImmediate(() => get(withCallbackParams(callbackUrl, { api_key: 'sk-test', email: 'a@b.co', org: 'Acme', scope: 'role:Analytics Viewer' })));
     };
 
     const result = await auth.loginWithBrowser('http://frontend.invalid', {
@@ -51,7 +58,7 @@ test('loginWithBrowser: control characters in the callback error never reach the
   await withStubbedConfig(async () => {
     const fakeOpen = async (authUrl) => {
       const callbackUrl = new URL(authUrl).searchParams.get('callback_url');
-      setImmediate(() => get(`${callbackUrl}?error=${encodeURIComponent('bad\u001b[31m role\u0007')}`));
+      setImmediate(() => get(withCallbackParams(callbackUrl, { error: 'bad\u001b[31m role\u0007' })));
     };
     await assert.rejects(
       () => auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen, scope: { role: 'x' } }),
@@ -65,7 +72,7 @@ test('loginWithBrowser: the dashboard\'s error reason is the rejection and shows
     let page;
     const fakeOpen = async (authUrl) => {
       const callbackUrl = new URL(authUrl).searchParams.get('callback_url');
-      setImmediate(async () => { page = await get(`${callbackUrl}?error=Unknown+role+%22Policy-Auditor%22`); });
+      setImmediate(async () => { page = await get(withCallbackParams(callbackUrl, { error: 'Unknown role "Policy-Auditor"' })); });
     };
 
     await assert.rejects(
@@ -77,3 +84,128 @@ test('loginWithBrowser: the dashboard\'s error reason is the rejection and shows
     assert.match(page.body, /Unknown role "Policy-Auditor"/);
   });
 });
+
+// WEB-6462: the callback is gated by a per-login `state` nonce and pinned to 127.0.0.1, so a local
+// page or an IPv6 bind-squatter can neither complete the login nor read the dashboard's redirect.
+
+function sleep(ms) { return new Promise((resolve) => setTimeout(resolve, ms)); }
+
+test('loginWithBrowser: callback_url is pinned to 127.0.0.1 and carries a 32-hex state nonce', async () => {
+  await withStubbedConfig(async () => {
+    let callbackUrl;
+    const fakeOpen = async (authUrl) => {
+      callbackUrl = new URL(new URL(authUrl).searchParams.get('callback_url'));
+      setImmediate(() => get(withCallbackParams(callbackUrl, { api_key: 'sk-test' })));
+    };
+    await auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen });
+    assert.equal(callbackUrl.hostname, '127.0.0.1');
+    assert.equal(callbackUrl.pathname, '/callback');
+    assert.match(callbackUrl.searchParams.get('state'), /^[0-9a-f]{32}$/);
+  });
+});
+
+test('loginWithBrowser: a wrong state gets 400 and the real callback still completes with 200', async () => {
+  await withStubbedConfig(async () => {
+    const storedKeys = [];
+    config.setApiKey = (key) => { storedKeys.push(key); };
+    let forged;
+    let real;
+    const fakeOpen = async (authUrl) => {
+      const callbackUrl = new URL(authUrl).searchParams.get('callback_url');
+      setImmediate(async () => {
+        forged = await get(withCallbackParams(callbackUrl, { state: 'f'.repeat(32), api_key: 'sk-attacker' }));
+        // The login settles before this response body flushes, so hold the promise and await it below.
+        real = get(withCallbackParams(callbackUrl, { api_key: 'sk-real', email: 'a@b.co', org: 'Acme' }));
+      });
+    };
+    const result = await auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen });
+    assert.equal(forged.statusCode, 400);
+    assert.equal((await real).statusCode, 200, 'the forged request must not consume the one-shot callback');
+    assert.deepEqual(result, { email: 'a@b.co', orgName: 'Acme' });
+    assert.deepEqual(storedKeys, ['sk-real']);
+  });
+});
+
+test('loginWithBrowser: a callback without state gets 400 and the login still completes', async () => {
+  await withStubbedConfig(async () => {
+    let bare;
+    const fakeOpen = async (authUrl) => {
+      const callbackUrl = new URL(new URL(authUrl).searchParams.get('callback_url'));
+      const noState = new URL(callbackUrl); noState.searchParams.delete('state'); noState.searchParams.set('api_key', 'sk-attacker');
+      setImmediate(async () => {
+        bare = await get(noState.toString());
+        await get(withCallbackParams(callbackUrl, { api_key: 'sk-real', email: 'a@b.co', org: 'Acme' }));
+      });
+    };
+    const result = await auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen });
+    assert.equal(bare.statusCode, 400);
+    assert.deepEqual(result, { email: 'a@b.co', orgName: 'Acme' });
+  });
+});
+
+test('loginWithBrowser: a wrong-state error= neither shows its text nor settles the login', async () => {
+  await withStubbedConfig(async () => {
+    let forged;
+    let callbackUrl;
+    const fakeOpen = async (authUrl) => {
+      callbackUrl = new URL(authUrl).searchParams.get('callback_url');
+      setImmediate(async () => {
+        forged = await get(withCallbackParams(callbackUrl, { state: '0'.repeat(32), error: 'ATTACKER-TEXT' }));
+      });
+    };
+    let settled = false;
+    const login = auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen }).finally(() => { settled = true; });
+    await sleep(100);
+    assert.equal(forged.statusCode, 400);
+    assert.doesNotMatch(forged.body, /ATTACKER-TEXT/);
+    assert.equal(settled, false, 'a forged error must not reject the login');
+    // Finish the login so the server does not outlive the test.
+    await get(withCallbackParams(callbackUrl, { api_key: 'sk-real' }));
+    await login;
+  });
+});
+
+test('loginWithBrowser: a 32-char multi-byte state gets 400 instead of crashing the server', async () => {
+  await withStubbedConfig(async () => {
+    let forged;
+    const fakeOpen = async (authUrl) => {
+      const callbackUrl = new URL(authUrl).searchParams.get('callback_url');
+      setImmediate(async () => {
+        // Same JS length as the real nonce, different UTF-8 byte length.
+        forged = await get(withCallbackParams(callbackUrl, { state: '\u00e9'.repeat(32), api_key: 'sk-attacker' }));
+        await get(withCallbackParams(callbackUrl, { api_key: 'sk-real', email: 'a@b.co', org: 'Acme' }));
+      });
+    };
+    const result = await auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen });
+    assert.equal(forged.statusCode, 400);
+    assert.deepEqual(result, { email: 'a@b.co', orgName: 'Acme' });
+  });
+});
+
+test('loginWithBrowser: each login mints a different state', async () => {
+  await withStubbedConfig(async () => {
+    const states = [];
+    const fakeOpen = async (authUrl) => {
+      const callbackUrl = new URL(authUrl).searchParams.get('callback_url');
+      states.push(new URL(callbackUrl).searchParams.get('state'));
+      setImmediate(() => get(withCallbackParams(callbackUrl, { api_key: 'sk-test' })));
+    };
+    await auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen });
+    await auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen });
+    assert.equal(states.length, 2);
+    assert.notEqual(states[0], states[1]);
+  });
+});
+
+test('loginWithBrowser: error= with the correct state still rejects with the dashboard reason', async () => {
+  await withStubbedConfig(async () => {
+    const fakeOpen = async (authUrl) => {
+      const callbackUrl = new URL(authUrl).searchParams.get('callback_url');
+      setImmediate(() => get(withCallbackParams(callbackUrl, { error: 'Role not permitted' })));
+    };
+    await assert.rejects(
+      () => auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen }),
+      /Role not permitted/,
+    );
+  });
+});