zelune 1.4.0 → 1.5.1

package/src/server/apiMiddleware.ts

@@ -4,47 +4,197 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { Plugin } from 'vite';
 import {
   discoverScreens,
+  getActiveProjectRoot,
   inspectElement,
   patchElement,
+  reorderElement,
   undoLastPatch,
   redoLastPatch,
   getHistoryStatus,
   type PatchPayload,
+  type ReorderPayload,
 } from './astEngine';
 
-async function readJsonBody<T>(req: IncomingMessage): Promise<T> {
+const MAX_BODY_BYTES = 1_000_000;
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '[::1]', '::1']);
+const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+
+export function isLoopbackHostHeader(hostHeader: string | undefined): boolean {
+  if (!hostHeader) return false;
+  const trimmed = hostHeader.trim().toLowerCase();
+  if (trimmed.startsWith('[')) {
+    const closeIdx = trimmed.indexOf(']');
+    if (closeIdx === -1) return false;
+    const ipv6Host = trimmed.slice(0, closeIdx + 1);
+    return LOOPBACK_HOSTS.has(ipv6Host);
+  }
+  const hostname = trimmed.split(':')[0];
+  return LOOPBACK_HOSTS.has(hostname);
+}
+
+export function verifyApiRequestSecurity(req: {
+  method?: string;
+  headers: Record<string, string | string[] | undefined>;
+}): { allowed: boolean; reason?: string } {
+  const host = typeof req.headers.host === 'string' ? req.headers.host : undefined;
+  if (!isLoopbackHostHeader(host)) {
+    return {
+      allowed: false,
+      reason: 'Forbidden Host header: Local API only accepts loopback connections (127.0.0.1, localhost, [::1])',
+    };
+  }
+
+  const secFetchSite =
+    typeof req.headers['sec-fetch-site'] === 'string'
+      ? req.headers['sec-fetch-site'].toLowerCase()
+      : undefined;
+  if (secFetchSite && secFetchSite !== 'same-origin' && secFetchSite !== 'none') {
+    return {
+      allowed: false,
+      reason: `Forbidden cross-site request (Sec-Fetch-Site: ${secFetchSite})`,
+    };
+  }
+
+  const origin = typeof req.headers.origin === 'string' ? req.headers.origin : undefined;
+  if (origin) {
+    try {
+      const parsedOrigin = new URL(origin);
+      if (!LOOPBACK_HOSTS.has(parsedOrigin.hostname.toLowerCase())) {
+        return {
+          allowed: false,
+          reason: `Forbidden cross-origin request from ${origin}`,
+        };
+      }
+    } catch {
+      return {
+        allowed: false,
+        reason: 'Malformed Origin header',
+      };
+    }
+  }
+
+  if (req.method === 'POST') {
+    const contentType =
+      typeof req.headers['content-type'] === 'string'
+        ? req.headers['content-type'].toLowerCase()
+        : '';
+    if (!contentType.startsWith('application/json')) {
+      return {
+        allowed: false,
+        reason: 'POST requests to /api/* must specify Content-Type: application/json',
+      };
+    }
+  }
+
+  return { allowed: true };
+}
+
+export function sanitizeLayoutPayload(
+  input: unknown
+): Record<string, { x: number; y: number; width: number; height: number }> {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) {
+    throw new Error('Invalid layout payload: expected an object map of screen coordinates');
+  }
+
+  const sanitized: Record<string, { x: number; y: number; width: number; height: number }> =
+    Object.create(null);
+  const entries = Object.entries(input as Record<string, unknown>);
+  if (entries.length > 200) {
+    throw new Error('Invalid layout payload: too many screen entries');
+  }
+
+  for (const [screenId, rawBox] of entries) {
+    if (!screenId || FORBIDDEN_KEYS.has(screenId) || screenId.length > 120) {
+      throw new Error(`Invalid screen key in layout payload: "${screenId}"`);
+    }
+    if (!rawBox || typeof rawBox !== 'object' || Array.isArray(rawBox)) {
+      throw new Error(`Invalid layout coordinates for screen "${screenId}"`);
+    }
+    const box = rawBox as Record<string, unknown>;
+    const x = Number(box.x);
+    const y = Number(box.y);
+    const width = Number(box.width);
+    const height = Number(box.height);
+
+    if (
+      !Number.isFinite(x) ||
+      !Number.isFinite(y) ||
+      !Number.isFinite(width) ||
+      !Number.isFinite(height) ||
+      Math.abs(x) > 100_000 ||
+      Math.abs(y) > 100_000 ||
+      width < 100 ||
+      width > 5_000 ||
+      height < 100 ||
+      height > 5_000
+    ) {
+      throw new Error(`Out-of-bounds layout coordinates for screen "${screenId}"`);
+    }
+
+    sanitized[screenId] = {
+      x: Math.round(x),
+      y: Math.round(y),
+      width: Math.round(width),
+      height: Math.round(height),
+    };
+  }
+
+  return sanitized;
+}
+
+export async function readJsonBody<T>(req: IncomingMessage): Promise<T> {
   return new Promise((resolve, reject) => {
     let raw = '';
-    req.on('data', (chunk) => {
-      raw += chunk.toString();
-      if (raw.length > 1_000_000) {
+    let byteCount = 0;
+    let aborted = false;
+
+    req.on('data', (chunk: Buffer | string) => {
+      if (aborted) return;
+      const chunkBytes =
+        typeof chunk === 'string' ? Buffer.byteLength(chunk, 'utf-8') : chunk.length;
+      byteCount += chunkBytes;
+
+      if (byteCount > MAX_BODY_BYTES) {
+        aborted = true;
+        req.destroy();
         reject(new Error('Request payload too large'));
+        return;
       }
+
+      raw += typeof chunk === 'string' ? chunk : chunk.toString('utf-8');
     });
+
     req.on('end', () => {
+      if (aborted) return;
       try {
         resolve(raw ? (JSON.parse(raw) as T) : ({} as T));
       } catch (err) {
         reject(err);
       }
     });
-    req.on('error', reject);
+
+    req.on('error', (err) => {
+      if (!aborted) {
+        aborted = true;
+        reject(err);
+      }
+    });
   });
 }
 
 function sendJson(res: ServerResponse, status: number, payload: unknown) {
   res.statusCode = status;
   res.setHeader('Content-Type', 'application/json; charset=utf-8');
+  res.setHeader('X-Content-Type-Options', 'nosniff');
   res.end(JSON.stringify(payload));
 }
 
 export function viteCanvasApiMiddleware(workspaceRoot: string): Plugin {
-  const layoutFilePath = path.resolve(workspaceRoot, '.canvas-layout.json');
-
   async function resolveConnectedProjectName(): Promise<string> {
-    const dirName = path.basename(workspaceRoot);
+    const activeRoot = getActiveProjectRoot(workspaceRoot);
+    const dirName = path.basename(activeRoot);
     try {
-      const appJsonRaw = await fs.readFile(path.join(workspaceRoot, 'app.json'), 'utf-8');
+      const appJsonRaw = await fs.readFile(path.join(activeRoot, 'app.json'), 'utf-8');
       const appJson = JSON.parse(appJsonRaw) as {
         expo?: { name?: string };
         name?: string;
@@ -55,7 +205,7 @@ export function viteCanvasApiMiddleware(workspaceRoot: string): Plugin {
       // No app.json present
     }
     try {
-      const pkgRaw = await fs.readFile(path.join(workspaceRoot, 'package.json'), 'utf-8');
+      const pkgRaw = await fs.readFile(path.join(activeRoot, 'package.json'), 'utf-8');
       const pkg = JSON.parse(pkgRaw) as { name?: string };
       if (pkg?.name && pkg.name.toLowerCase() !== 'zelune') {
         return pkg.name;
@@ -74,6 +224,13 @@ export function viteCanvasApiMiddleware(workspaceRoot: string): Plugin {
           return next();
         }
 
+        const securityCheck = verifyApiRequestSecurity(req);
+        if (!securityCheck.allowed) {
+          return sendJson(res, 403, { ok: false, error: securityCheck.reason });
+        }
+
+        const activeRoot = getActiveProjectRoot(workspaceRoot);
+        const layoutFilePath = path.resolve(activeRoot, '.canvas-layout.json');
         const urlObj = new URL(req.url, 'http://127.0.0.1');
         const pathname = urlObj.pathname;
 
@@ -114,6 +271,20 @@ export function viteCanvasApiMiddleware(workspaceRoot: string): Plugin {
             });
           }
 
+          // POST /api/reorder
+          if (req.method === 'POST' && pathname === '/api/reorder') {
+            const body = await readJsonBody<ReorderPayload>(req);
+            const result = await reorderElement(workspaceRoot, body);
+            return sendJson(res, 200, {
+              ok: true,
+              element: result.element,
+              history: {
+                undoAvailable: result.undoAvailable,
+                redoAvailable: result.redoAvailable,
+              },
+            });
+          }
+
           // POST /api/undo
           if (req.method === 'POST' && pathname === '/api/undo') {
             const result = await undoLastPatch(workspaceRoot);
@@ -130,7 +301,8 @@ export function viteCanvasApiMiddleware(workspaceRoot: string): Plugin {
           if (req.method === 'GET' && pathname === '/api/layout') {
             try {
               const raw = await fs.readFile(layoutFilePath, 'utf-8');
-              return sendJson(res, 200, { ok: true, layout: JSON.parse(raw) });
+              const validated = sanitizeLayoutPayload(JSON.parse(raw));
+              return sendJson(res, 200, { ok: true, layout: validated });
             } catch {
               return sendJson(res, 200, { ok: true, layout: null });
             }
@@ -139,7 +311,8 @@ export function viteCanvasApiMiddleware(workspaceRoot: string): Plugin {
           // POST /api/layout
           if (req.method === 'POST' && pathname === '/api/layout') {
             const body = await readJsonBody<Record<string, unknown>>(req);
-            await fs.writeFile(layoutFilePath, JSON.stringify(body, null, 2), 'utf-8');
+            const validated = sanitizeLayoutPayload(body);
+            await fs.writeFile(layoutFilePath, JSON.stringify(validated, null, 2), 'utf-8');
             return sendJson(res, 200, { ok: true });
           }