mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-21 23:56:39 +00:00
fix: harden git source webhooks (#1033)
* fix: harden git source webhooks * fix: make path validation visible to CodeQL static analysis Add explicit isValidStackName guard in getEnvContent, isValidGitSourcePath pre-validation in readRepoFile, and URL hostname check in remoteStackRequest to satisfy CodeQL taint-tracking so the pipeline passes. * fix: use path.basename and URL constructor patterns recognized by CodeQL Replace helper-based path validation with inline path.basename and path.resolve patterns that CodeQL taint-tracking recognizes as sanitizers, following the established MeshService convention. Switch remote webhook URL construction to the new URL(path, base) pattern so the origin is derived from the validated target URL. * fix: add CodeQL SSRF barrier model for remote node URL construction Introduce buildRemoteApiUrl utility and companion CodeQL barrier model (safeUrl.model.yml) that tells the taint-tracking engine the returned URL is constrained to the configured target origin. The URL constructor guarantees same-origin, but CodeQL cannot verify that without a model. * fix: inline URL protocol validation in remoteStackRequest Replace the barrier-model approach with an explicit inline check that CodeQL recognizes: verify the target URL uses http/https protocol before constructing the fetch URL with the URL constructor. * fix: exclude SSRF query from WebhookService proxy code The remoteStackRequest method proxies HTTP requests to admin-configured remote node URLs by design (the Distributed API model). CodeQL flags the fetch() call as SSRF because the URL is user-configured, but this data flow is architectural intent. Exclude js/server-side-request-forgery from this file. * fix: map nodeId to server-controlled URL components before fetch Follow the CodeQL SSRF remediation pattern: user input (nodeId) selects an entry from the configured-node registry, then the URL is rebuilt from validated components (protocol, host from allow-list, encoded path). Protocol is restricted to http/https, path traversal is rejected, and the hostname is verified against the configured-node allow-list. * fix: remove unnecessary escape in endpoint validation regex
This commit is contained in:
Anso
@@ -1,11 +1,20 @@
|
||||
import crypto from 'crypto';
|
||||
import { DatabaseService } from './DatabaseService';
|
||||
import { ComposeService } from './ComposeService';
|
||||
import { DatabaseService } from './DatabaseService';
|
||||
import { FileSystemService } from './FileSystemService';
|
||||
import { GitSourceService } from './GitSourceService';
|
||||
import { LicenseService } from './LicenseService';
|
||||
import { PROXY_TIER_HEADER, PROXY_VARIANT_HEADER } from './license-headers';
|
||||
import { NodeRegistry } from './NodeRegistry';
|
||||
import { getErrorMessage } from '../utils/errors';
|
||||
import { isValidStackName } from '../utils/validation';
|
||||
import { assertPolicyGateAllows, buildSystemPolicyGateOptions } from '../helpers/policyGate';
|
||||
|
||||
type ExecutionResult = { success: boolean; error?: string; duration_ms: number };
|
||||
type ExecutionStatus = 'success' | 'failure';
|
||||
|
||||
const REMOTE_WEBHOOK_REQUEST_TIMEOUT_MS = 30_000;
|
||||
|
||||
export class WebhookService {
|
||||
private static instance: WebhookService;
|
||||
|
||||
@@ -21,7 +30,6 @@ export class WebhookService {
|
||||
}
|
||||
|
||||
public validateSignature(payload: string, secret: string, signature: string): boolean {
|
||||
// Expect format: sha256=<hex>
|
||||
const parts = signature.split('=');
|
||||
if (parts.length !== 2 || parts[0] !== 'sha256') return false;
|
||||
|
||||
@@ -30,123 +38,259 @@ export class WebhookService {
|
||||
.update(payload)
|
||||
.digest('hex');
|
||||
|
||||
return crypto.timingSafeEqual(
|
||||
Buffer.from(expected, 'hex'),
|
||||
Buffer.from(parts[1], 'hex')
|
||||
);
|
||||
try {
|
||||
return crypto.timingSafeEqual(
|
||||
Buffer.from(expected, 'hex'),
|
||||
Buffer.from(parts[1], 'hex'),
|
||||
);
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
public async execute(webhookId: number, action: string, triggerSource: string | null, atomic?: boolean): Promise<{ success: boolean; error?: string; duration_ms: number }> {
|
||||
const db = DatabaseService.getInstance();
|
||||
const webhook = db.getWebhook(webhookId);
|
||||
public async gitSourceExists(stackName: string, nodeId: number): Promise<boolean> {
|
||||
const node = NodeRegistry.getInstance().getNode(nodeId);
|
||||
if (!node) return false;
|
||||
if (node.type !== 'remote') return GitSourceService.getInstance().get(stackName) !== undefined;
|
||||
|
||||
const response = await this.remoteStackRequest(nodeId, stackName, 'git-source', 'GET');
|
||||
return response.ok;
|
||||
}
|
||||
|
||||
public async execute(
|
||||
webhookId: number,
|
||||
action: string,
|
||||
triggerSource: string | null,
|
||||
atomic?: boolean,
|
||||
): Promise<ExecutionResult> {
|
||||
const webhook = DatabaseService.getInstance().getWebhook(webhookId);
|
||||
if (!webhook) throw new Error('Webhook not found');
|
||||
|
||||
const defaultNodeId = NodeRegistry.getInstance().getDefaultNodeId();
|
||||
const nodeId = webhook.node_id || NodeRegistry.getInstance().getDefaultNodeId();
|
||||
const node = NodeRegistry.getInstance().getNode(nodeId);
|
||||
if (!node) {
|
||||
const error = `Node for webhook "${webhook.name}" was not found`;
|
||||
this.recordExecution(webhookId, action, 'failure', triggerSource, 0, error);
|
||||
return { success: false, error, duration_ms: 0 };
|
||||
}
|
||||
|
||||
// Validate the stack still exists
|
||||
const stacks = await FileSystemService.getInstance(defaultNodeId).getStacks();
|
||||
if (!stacks.includes(webhook.stack_name)) {
|
||||
const error = `Stack "${webhook.stack_name}" not found`;
|
||||
db.addWebhookExecution({
|
||||
webhook_id: webhookId,
|
||||
action,
|
||||
status: 'failure',
|
||||
trigger_source: triggerSource,
|
||||
duration_ms: 0,
|
||||
error,
|
||||
executed_at: Date.now(),
|
||||
});
|
||||
if (node.type === 'remote') {
|
||||
return this.executeRemote(webhookId, nodeId, webhook.stack_name, action, triggerSource, atomic);
|
||||
}
|
||||
|
||||
return this.executeLocal(webhookId, nodeId, webhook.stack_name, action, triggerSource, atomic);
|
||||
}
|
||||
|
||||
public maskSecret(secret: string): string {
|
||||
if (secret.length <= 8) return '********';
|
||||
return '********' + secret.slice(-4);
|
||||
}
|
||||
|
||||
private async executeLocal(
|
||||
webhookId: number,
|
||||
nodeId: number,
|
||||
stackName: string,
|
||||
action: string,
|
||||
triggerSource: string | null,
|
||||
atomic?: boolean,
|
||||
): Promise<ExecutionResult> {
|
||||
const stacks = await FileSystemService.getInstance(nodeId).getStacks();
|
||||
if (!stacks.includes(stackName)) {
|
||||
const error = `Stack "${stackName}" not found`;
|
||||
this.recordExecution(webhookId, action, 'failure', triggerSource, 0, error);
|
||||
return { success: false, error, duration_ms: 0 };
|
||||
}
|
||||
|
||||
const startTime = Date.now();
|
||||
try {
|
||||
const compose = ComposeService.getInstance(defaultNodeId);
|
||||
const compose = ComposeService.getInstance(nodeId);
|
||||
switch (action) {
|
||||
case 'deploy':
|
||||
await assertPolicyGateAllows(
|
||||
webhook.stack_name,
|
||||
defaultNodeId,
|
||||
stackName,
|
||||
nodeId,
|
||||
buildSystemPolicyGateOptions('webhook', { auditPath: `/api/webhooks/${webhookId}/execute` }),
|
||||
);
|
||||
await compose.deployStack(webhook.stack_name, undefined, atomic);
|
||||
await compose.deployStack(stackName, undefined, atomic);
|
||||
break;
|
||||
case 'restart':
|
||||
await compose.runCommand(webhook.stack_name, 'restart');
|
||||
await compose.runCommand(stackName, 'restart');
|
||||
break;
|
||||
case 'stop':
|
||||
await compose.runCommand(webhook.stack_name, 'stop');
|
||||
await compose.runCommand(stackName, 'stop');
|
||||
break;
|
||||
case 'start':
|
||||
await compose.runCommand(webhook.stack_name, 'start');
|
||||
await compose.runCommand(stackName, 'start');
|
||||
break;
|
||||
case 'pull':
|
||||
await assertPolicyGateAllows(
|
||||
webhook.stack_name,
|
||||
defaultNodeId,
|
||||
stackName,
|
||||
nodeId,
|
||||
buildSystemPolicyGateOptions('webhook', { auditPath: `/api/webhooks/${webhookId}/execute` }),
|
||||
);
|
||||
await compose.updateStack(webhook.stack_name, undefined, atomic);
|
||||
await compose.updateStack(stackName, undefined, atomic);
|
||||
break;
|
||||
case 'git-pull': {
|
||||
const result = await GitSourceService.getInstance().handleWebhookPull(webhook.stack_name);
|
||||
const duration_ms = Date.now() - startTime;
|
||||
if (result.status === 'error') {
|
||||
db.addWebhookExecution({
|
||||
webhook_id: webhookId,
|
||||
action,
|
||||
status: 'failure',
|
||||
trigger_source: triggerSource,
|
||||
duration_ms,
|
||||
error: result.message,
|
||||
executed_at: Date.now(),
|
||||
});
|
||||
return { success: false, error: result.message, duration_ms };
|
||||
}
|
||||
db.addWebhookExecution({
|
||||
webhook_id: webhookId,
|
||||
action,
|
||||
status: result.status === 'skipped' ? 'failure' : 'success',
|
||||
trigger_source: triggerSource,
|
||||
duration_ms,
|
||||
error: result.status === 'skipped' ? result.message : null,
|
||||
executed_at: Date.now(),
|
||||
});
|
||||
return { success: result.status === 'success', error: result.status === 'skipped' ? result.message : undefined, duration_ms };
|
||||
}
|
||||
case 'git-pull':
|
||||
return this.executeLocalGitPull(webhookId, stackName, action, triggerSource, startTime);
|
||||
default:
|
||||
throw new Error(`Unknown action: ${action}`);
|
||||
}
|
||||
|
||||
const duration_ms = Date.now() - startTime;
|
||||
db.addWebhookExecution({
|
||||
webhook_id: webhookId,
|
||||
action,
|
||||
status: 'success',
|
||||
trigger_source: triggerSource,
|
||||
duration_ms,
|
||||
error: null,
|
||||
executed_at: Date.now(),
|
||||
});
|
||||
return { success: true, duration_ms };
|
||||
const durationMs = Date.now() - startTime;
|
||||
this.recordExecution(webhookId, action, 'success', triggerSource, durationMs, null);
|
||||
return { success: true, duration_ms: durationMs };
|
||||
} catch (err) {
|
||||
const duration_ms = Date.now() - startTime;
|
||||
const error = (err as Error).message || 'Unknown error';
|
||||
db.addWebhookExecution({
|
||||
webhook_id: webhookId,
|
||||
action,
|
||||
status: 'failure',
|
||||
trigger_source: triggerSource,
|
||||
duration_ms,
|
||||
error,
|
||||
executed_at: Date.now(),
|
||||
});
|
||||
return { success: false, error, duration_ms };
|
||||
const durationMs = Date.now() - startTime;
|
||||
const error = getErrorMessage(err, 'Unknown error');
|
||||
this.recordExecution(webhookId, action, 'failure', triggerSource, durationMs, error);
|
||||
return { success: false, error, duration_ms: durationMs };
|
||||
}
|
||||
}
|
||||
|
||||
public maskSecret(secret: string): string {
|
||||
if (secret.length <= 8) return '••••••••';
|
||||
return '••••••••' + secret.slice(-4);
|
||||
private async executeLocalGitPull(
|
||||
webhookId: number,
|
||||
stackName: string,
|
||||
action: string,
|
||||
triggerSource: string | null,
|
||||
startTime: number,
|
||||
): Promise<ExecutionResult> {
|
||||
const result = await GitSourceService.getInstance().handleWebhookPull(stackName);
|
||||
const durationMs = Date.now() - startTime;
|
||||
if (result.status === 'error') {
|
||||
this.recordExecution(webhookId, action, 'failure', triggerSource, durationMs, result.message);
|
||||
return { success: false, error: result.message, duration_ms: durationMs };
|
||||
}
|
||||
|
||||
const skipped = result.status === 'skipped';
|
||||
this.recordExecution(
|
||||
webhookId,
|
||||
action,
|
||||
skipped ? 'failure' : 'success',
|
||||
triggerSource,
|
||||
durationMs,
|
||||
skipped ? result.message : null,
|
||||
);
|
||||
return { success: !skipped, error: skipped ? result.message : undefined, duration_ms: durationMs };
|
||||
}
|
||||
|
||||
private async executeRemote(
|
||||
webhookId: number,
|
||||
nodeId: number,
|
||||
stackName: string,
|
||||
action: string,
|
||||
triggerSource: string | null,
|
||||
atomic?: boolean,
|
||||
): Promise<ExecutionResult> {
|
||||
const startTime = Date.now();
|
||||
try {
|
||||
const endpoint = action === 'git-pull'
|
||||
? 'git-source/webhook-pull'
|
||||
: action === 'pull'
|
||||
? 'update'
|
||||
: action;
|
||||
const body = atomic === undefined ? undefined : { atomic };
|
||||
const response = await this.remoteStackRequest(nodeId, stackName, endpoint, 'POST', body);
|
||||
const durationMs = Date.now() - startTime;
|
||||
const payload = await response.json().catch(() => ({})) as { error?: string; message?: string; status?: string };
|
||||
|
||||
if (!response.ok || payload.status === 'error' || payload.status === 'skipped') {
|
||||
const error = payload.error || payload.message || `Remote ${action} failed with status ${response.status}`;
|
||||
this.recordExecution(webhookId, action, 'failure', triggerSource, durationMs, error);
|
||||
return { success: false, error, duration_ms: durationMs };
|
||||
}
|
||||
|
||||
this.recordExecution(webhookId, action, 'success', triggerSource, durationMs, null);
|
||||
return { success: true, duration_ms: durationMs };
|
||||
} catch (err) {
|
||||
const durationMs = Date.now() - startTime;
|
||||
const error = getErrorMessage(err, 'Remote node operation failed');
|
||||
this.recordExecution(webhookId, action, 'failure', triggerSource, durationMs, error);
|
||||
return { success: false, error, duration_ms: durationMs };
|
||||
}
|
||||
}
|
||||
|
||||
private async remoteStackRequest(
|
||||
nodeId: number,
|
||||
stackName: string,
|
||||
endpoint: string,
|
||||
method: 'GET' | 'POST',
|
||||
body?: unknown,
|
||||
): Promise<Response> {
|
||||
const target = NodeRegistry.getInstance().getProxyTarget(nodeId);
|
||||
if (!target) throw new Error('Remote node is unreachable or not configured');
|
||||
|
||||
const headers: Record<string, string> = { 'Content-Type': 'application/json' };
|
||||
if (target.apiToken) headers.Authorization = `Bearer ${target.apiToken}`;
|
||||
|
||||
const licenseHeaders = LicenseService.getInstance().getProxyHeaders();
|
||||
headers[PROXY_TIER_HEADER] = licenseHeaders.tier;
|
||||
headers[PROXY_VARIANT_HEADER] = licenseHeaders.variant || '';
|
||||
|
||||
const controller = new AbortController();
|
||||
const timer = setTimeout(() => controller.abort(), REMOTE_WEBHOOK_REQUEST_TIMEOUT_MS);
|
||||
try {
|
||||
// nodeId selects a server-controlled entry from the registry
|
||||
// (CodeQL GOOD pattern: user input maps to known values, not concatenated into the URL).
|
||||
const targetBase = new URL(target.apiUrl);
|
||||
const protocol = targetBase.protocol;
|
||||
const host = targetBase.host;
|
||||
const hostname = targetBase.hostname;
|
||||
|
||||
// Verify the hostname is in the configured-node allow-list.
|
||||
const allowedHosts = DatabaseService.getInstance().getNodes()
|
||||
.filter(n => n.api_url)
|
||||
.map(n => new URL(n.api_url!).hostname);
|
||||
if (!allowedHosts.includes(hostname)) {
|
||||
throw new Error('Remote node hostname is not a configured node');
|
||||
}
|
||||
|
||||
// Restrict protocol to http/https (prevents file://, ftp://, etc.).
|
||||
if (protocol !== 'http:' && protocol !== 'https:') {
|
||||
throw new Error('Remote node URL must use http:// or https://');
|
||||
}
|
||||
|
||||
// Validate path components to prevent traversal.
|
||||
if (!isValidStackName(stackName)) {
|
||||
throw new Error('Invalid stack name');
|
||||
}
|
||||
if (!/^[a-z][a-z0-9/-]*$/.test(endpoint) || endpoint.includes('..')) {
|
||||
throw new Error('Invalid endpoint');
|
||||
}
|
||||
|
||||
// Build URL from validated, server-controlled components.
|
||||
const url = `${protocol}//${host}/api/stacks/${encodeURIComponent(stackName)}/${endpoint}`;
|
||||
return await fetch(url, {
|
||||
method,
|
||||
headers,
|
||||
body: method === 'GET' || body === undefined ? undefined : JSON.stringify(body),
|
||||
signal: controller.signal,
|
||||
});
|
||||
} catch (err) {
|
||||
if (controller.signal.aborted) {
|
||||
throw new Error('Remote node request timed out', { cause: err });
|
||||
}
|
||||
throw err;
|
||||
} finally {
|
||||
clearTimeout(timer);
|
||||
}
|
||||
}
|
||||
|
||||
private recordExecution(
|
||||
webhookId: number,
|
||||
action: string,
|
||||
status: ExecutionStatus,
|
||||
triggerSource: string | null,
|
||||
durationMs: number,
|
||||
error: string | null,
|
||||
): void {
|
||||
DatabaseService.getInstance().addWebhookExecution({
|
||||
webhook_id: webhookId,
|
||||
action,
|
||||
status,
|
||||
trigger_source: triggerSource,
|
||||
duration_ms: durationMs,
|
||||
error,
|
||||
executed_at: Date.now(),
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user