mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
Claude
46aeccc49b
Phase B + C review pass: critical security and correctness fixes. Security - S1: plugin admin endpoints now require admin.RequireAdminAuth in addition to AdminIPRestrict. Previously a LAN attacker on the allowed CIDR could list/enable/disable/uninstall plugins without a session. - S2: rewrite plugin HTTPDo allowlist with proper net/url parsing. Empty entries are ignored, suffix matches require a dot boundary, and a custom Dialer rejects loopback / RFC1918 / link-local addresses to close the DNS-rebinding TOCTOU window. Redirects re-validated. - S3 + #9: manifest Name pinned to ^[a-z0-9][a-z0-9_-]{0,63}$, Entrypoint and UI tab assets validated against absolute / "..", NUL byte, backslash and non-canonical paths. Asset handler hardened with filepath.Rel check for symlink and prefix-without-separator escapes. - S5: pluginBridge postMessage handler ignores the pluginId in the message body and uses an e.source -> contentWindow lookup instead, defeating spoofed messages from same-origin scripts. - S8: HTTPDo body capped at 5 MiB via io.LimitReader, redirects bounded to 5 hops. Correctness - Critical seq alignment: PersistEvent now takes the hub-assigned seq as a required parameter so the events table row seq always matches the wrapped payload seq. Hub seeds its in-memory atomic counter from MAX(events.seq) on startup. Drops in the persister queue no longer mis-align row vs payload seq. - #1: live plugin.Registry constructed in main.go BEFORE NewRouter and threaded through; admin handler is no longer wired with nil. - #3: EventPersister.Stop is now safe to call without a prior Start by tracking a started flag — previously deadlocked waiting on done. Wiring - NewRouter signature gains *plugin.Registry; two test callers updated. - admin.RequireAdminAuth exported as a thin wrapper over the existing package-private adminAuthMiddleware. - sqlc query templates updated for the new PersistEvent + GetMaxEventSeq contracts (sqlite + postgres). https://claude.ai/code/session_01UsBsQW2YiA2usk9pnJjAWk
76 lines
2.5 KiB
Go
76 lines
2.5 KiB
Go
// Phase C Step 9 — `ui` host capability.
|
|
//
|
|
// A plugin that declares the `ui` capability ships HTML/CSS/JS assets and a
|
|
// list of tabs. The host serves those assets at /api/v1/plugins/<name>/ui/...
|
|
// and the Solid.js client bridge renders each tab inside a sandboxed iframe.
|
|
package plugin
|
|
|
|
import (
|
|
"net/http"
|
|
"path/filepath"
|
|
"strings"
|
|
)
|
|
|
|
// RegisterUI binds inst's declared tabs into the registry. Called from the
|
|
// activation path; safe to call multiple times (idempotent on inst).
|
|
func (r *Registry) RegisterUI(inst *Instance) error {
|
|
if !inst.Manifest.HasCapability(CapUI) {
|
|
return ErrCapabilityNotGranted
|
|
}
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
// Drop any existing bindings for this instance, then re-add.
|
|
kept := r.uiTabs[:0]
|
|
for _, b := range r.uiTabs {
|
|
if b.PluginID != inst.ID {
|
|
kept = append(kept, b)
|
|
}
|
|
}
|
|
r.uiTabs = kept
|
|
for _, t := range inst.Manifest.UI.Tabs {
|
|
r.uiTabs = append(r.uiTabs, UITabBinding{
|
|
PluginID: inst.ID,
|
|
PluginName: inst.Manifest.Name,
|
|
Tab: t,
|
|
})
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// AssetHandler returns an http.Handler that serves the on-disk assets for
|
|
// inst, rooted at the plugin's directory. Defense in depth:
|
|
// 1. Manifest validation rejects absolute paths and "..".
|
|
// 2. The handler only serves files explicitly declared by a manifest tab.
|
|
// 3. After resolving the on-disk path we use filepath.Rel and reject any
|
|
// result containing ".." or that is absolute, which catches symlink
|
|
// escapes and the prefix-without-separator class of bug.
|
|
func (r *Registry) AssetHandler(inst *Instance) http.Handler {
|
|
allowed := make(map[string]bool, len(inst.Manifest.UI.Tabs))
|
|
for _, t := range inst.Manifest.UI.Tabs {
|
|
allowed[t.Asset] = true
|
|
}
|
|
pluginDir, dirErr := filepath.Abs(filepath.Dir(inst.WASMPath))
|
|
return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
|
|
if dirErr != nil {
|
|
http.Error(w, "plugin asset root unavailable", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
rel := strings.TrimPrefix(req.URL.Path, "/")
|
|
if !allowed[rel] {
|
|
http.NotFound(w, req)
|
|
return
|
|
}
|
|
full, absErr := filepath.Abs(filepath.Join(pluginDir, rel))
|
|
if absErr != nil {
|
|
http.Error(w, "forbidden", http.StatusForbidden)
|
|
return
|
|
}
|
|
relCheck, relErr := filepath.Rel(pluginDir, full)
|
|
if relErr != nil || relCheck == "" || relCheck == "." || strings.HasPrefix(relCheck, "..") || filepath.IsAbs(relCheck) {
|
|
http.Error(w, "forbidden", http.StatusForbidden)
|
|
return
|
|
}
|
|
http.ServeFile(w, req, full)
|
|
})
|
|
}
|