gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-06 08:58:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(host-console): audit session lifecycle and harden path, resize, and route gating (#1263)

Browse Source 
* fix(host-console): audit session lifecycle and harden path, resize, and route gating

Record an audit-log entry when a host console session opens and when it
closes (capturing user, node, client IP, and timestamp), so interactive
host-shell access leaves a durable, accountable trail instead of only an
ephemeral log line.

Fix a stack-path boundary check that allowed a sibling directory sharing
the base path's prefix to pass; directory resolution now uses the
canonical within-base check via a small testable helper.

Validate terminal resize frames (positive integers within a sane bound)
before forwarding them to the PTY, dropping malformed frames instead of
passing them through.

Mirror the backend admin-only console permission on the frontend route so
a non-admin who reaches the view cannot mount a console the server would
reject, and log (rather than silently swallow) a working-directory
resolution failure.

Add unit coverage for the path helper, audit open/close rows, resize
validation, and the spawn-error path, plus a WebSocket-upgrade integration
test exercising the full gate chain and a live session-open audit row.

* fix(host-console): record the node the shell actually runs in

When the requested node's directory cannot be resolved, the session falls
back to the default node's base directory. Record that fallback node in the
session audit row (and log it) so the audit trail names the node the shell
actually runs in rather than the originally requested one. Strengthen the
upgrade integration test to assert the open row captures the user, node, and
client IP.
This commit is contained in:
Anso
2026-05-31 20:29:30 -04:00
committed by GitHub
parent 7e65a2ae19
commit d4fa4a4965
6 changed files with 452 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/websocket/hostConsole.ts
+31 -15
View File
@@ -1,7 +1,6 @@
import type { IncomingMessage } from 'http';
import type { Duplex } from 'stream';
import WebSocket, { WebSocketServer } from 'ws';
import path from 'path';
import { FileSystemService } from '../services/FileSystemService';
import { NodeRegistry } from '../services/NodeRegistry';
import { HostTerminalService } from '../services/HostTerminalService';
@@ -82,28 +81,45 @@ export function handleHostConsoleWs(
stack: stackParam || '(root)',
});
// Client IP for the audit trail. Express's req.ip is unavailable on a raw
// upgrade socket, so take the first x-forwarded-for hop and fall back to the
// socket address.
const forwarded = req.headers['x-forwarded-for'];
const xff = typeof forwarded === 'string' ? forwarded.split(',')[0].trim() : '';
const ipAddress = xff || req.socket.remoteAddress || '';
const hostConsoleWss = new WebSocketServer({ noServer: true });
hostConsoleWss.handleUpgrade(req, socket, head, (ws) => {
hostConsoleWss.close();
let targetDirectory = '';
let targetDirectory: string;
// The shell may end up rooted at a different node than requested if the
// requested node's directory cannot be resolved; the audit row must name
// the node the shell actually runs in, so track it alongside the directory.
let auditNodeId: number = nodeId;
try {
const baseDir = FileSystemService.getInstance(nodeId).getBaseDir();
if (stackParam) {
const resolved = path.resolve(baseDir, stackParam);
if (!resolved.startsWith(path.resolve(baseDir))) {
ws.send('Error: Invalid stack path\r\n');
ws.close();
return;
}
targetDirectory = resolved;
} else {
targetDirectory = baseDir;
const resolved = HostTerminalService.resolveConsoleDirectory(baseDir, stackParam);
if (resolved === null) {
ws.send('Error: Invalid stack path\r\n');
ws.close();
return;
}
} catch {
targetDirectory = FileSystemService.getInstance(NodeRegistry.getInstance().getDefaultNodeId()).getBaseDir();
targetDirectory = resolved;
} catch (error) {
const fallbackNodeId = NodeRegistry.getInstance().getDefaultNodeId();
console.error('[HostConsole] Failed to resolve console directory; falling back to the default node base dir', {
user: consoleUsername,
nodeId,
fallbackNodeId,
stack: stackParam || '(root)',
error: getErrorMessage(error, 'unknown'),
});
targetDirectory = FileSystemService.getInstance(fallbackNodeId).getBaseDir();
auditNodeId = fallbackNodeId;
}
const auditCtx = { username: consoleUsername, nodeId: auditNodeId, ipAddress };
try {
HostTerminalService.spawnTerminal(ws, targetDirectory, consoleUsername);
HostTerminalService.spawnTerminal(ws, targetDirectory, auditCtx);
} catch (error) {
console.error('[HostConsole] Unhandled spawn error:', { user: consoleUsername, error: getErrorMessage(error, 'unknown') });
if (ws.readyState === WebSocket.OPEN) {