diff --git a/integration/caching_test.js b/integration/caching_test.js
index d92df150d5ed226418bb954a3b6fdbf4f588c543..de4e7f0872abb1dd246a380227596a8250c34a69 100644
--- a/integration/caching_test.js
+++ b/integration/caching_test.js
@@ -30,7 +30,7 @@ describe('File caching service', function () {
let app, pubClient
beforeEach(async function () {
- await mockConfig({ baseUrls: ['http://ui-server/'] })
+ await mockConfig({ baseUrls: ['http://ui-server'] })
mockFetch({
'http://ui-server': {
'/manifest.json': generateSimpleViteManifest({
@@ -62,7 +62,7 @@ describe('File caching service', function () {
const version = response.headers.version
const { client } = await import('../src/redis.js')
- expect(await client.get(getRedisKey({ version, name: 'viteManifests' }))).to.equal('{"index.html":{"file":"index.html","meta":{"baseUrl":"http://ui-server/"}}}')
+ expect(await client.get(getRedisKey({ version, name: 'viteManifests' }))).to.equal('{"index.html":{"file":"index.html","meta":{"baseUrl":"http://ui-server"}}}')
const redisData = await client.getBuffer(getRedisKey({ version, name: 'oxManifests:body' }))
expect(zlib.brotliDecompressSync(redisData || '').toString()).to.equal('[]')
})
@@ -95,4 +95,9 @@ describe('File caching service', function () {
const response2 = await app.inject({ url: '/demo.js', headers: { version } })
expect(response2.statusCode).to.equal(200)
})
+
+ it('does not fetch from origins not defined in baseUrls', async function () {
+ const response = await app.inject({ url: '//t989be0.netlify.app/xss.html' })
+ expect(response.statusCode).to.equal(400)
+ })
})
diff --git a/integration/config_test.js b/integration/config_test.js
index e8f60fb83350cf85d65216d23eb9eac2a011baaf..53ec8c1a9ee5d6b1bc0421fe99ec370280e33486 100644
--- a/integration/config_test.js
+++ b/integration/config_test.js
@@ -32,7 +32,7 @@ describe('Configuration', function () {
beforeEach(async function () {
// need to set the redis-prefix. Otherwise, the bull workers will interfere
process.env.REDIS_PREFIX = Math.random().toString()
- await mockConfig(config = { baseUrls: ['http://ui-server/'] })
+ await mockConfig(config = { baseUrls: ['http://ui-server'] })
mockFetch({
'http://ui-server': {
'/manifest.json': generateSimpleViteManifest({
diff --git a/integration/update-version_test.js b/integration/update-version_test.js
index 457c3be02656d6633ab9a98867878a001a1232b0..10e1f737aa319d4f2af57c18ded12e376f4d57fd 100644
--- a/integration/update-version_test.js
+++ b/integration/update-version_test.js
@@ -33,7 +33,7 @@ describe('Updates the version', function () {
beforeEach(async function () {
// need to set the redis-prefix. Otherwise, the bull workers will interfere
process.env.REDIS_PREFIX = Math.random().toString()
- await mockConfig({ baseUrls: ['http://ui-server/'] })
+ await mockConfig({ baseUrls: ['http://ui-server'] })
mockFetch({
'http://ui-server': {
'/manifest.json': generateSimpleViteManifest({
@@ -109,7 +109,7 @@ describe('Updates the version', function () {
td.reset()
// need to set the redis-prefix. Otherwise, the bull workers will interfere
process.env.REDIS_PREFIX = Math.random().toString()
- await mockConfig({ baseUrls: ['http://ui-server/'] })
+ await mockConfig({ baseUrls: ['http://ui-server'] })
mockFetch({
'http://ui-server': {
'/manifest.json': generateSimpleViteManifest({
diff --git a/spec/app_root_test.js b/spec/app_root_test.js
index 80bd741d7b5e2f6bae9e7780624e7786fcebc57f..fa10859c35c575a7e6c0b5e3db4729a5e2b373ab 100644
--- a/spec/app_root_test.js
+++ b/spec/app_root_test.js
@@ -29,7 +29,7 @@ describe('With different app root', function () {
let app
beforeEach(async function () {
- await mockConfig({ baseUrls: ['http://ui-server/'] })
+ await mockConfig({ baseUrls: ['http://ui-server'] })
const { client } = await mockRedis()
mockFetch({
'http://ui-server': {
diff --git a/spec/file_caching_test.js b/spec/file_caching_test.js
index ec9668e8e90250aa6c955236cb7a314e0eacd41e..d2e6831ba14ce61ee453cb5b0f9eeee22210143e 100644
--- a/spec/file_caching_test.js
+++ b/spec/file_caching_test.js
@@ -37,7 +37,7 @@ describe('File caching service', function () {
let redis
beforeEach(async function () {
- await mockConfig({ baseUrls: ['http://ui-server/'] })
+ await mockConfig({ baseUrls: ['http://ui-server'] })
redis = await mockRedis()
mockFetch({
'http://ui-server': {}
@@ -273,4 +273,9 @@ describe('File caching service', function () {
// check for files in redis
expect(await redis.client.getBuffer('ui-middleware:554855300:/file.svg:body')).to.deep.equal(response.rawPayload)
})
+
+ it('does not fetch from origins not defined in baseUrls', async function () {
+ const response = await app.inject({ url: '//t989be0.netlify.app/xss.html' })
+ expect(response.statusCode).to.equal(400)
+ })
})
diff --git a/spec/redirect_test.js b/spec/redirect_test.js
index 1a8ff318aaf3c67840881ddcc0b2a2ab6620da59..c31ac11002d6967b742f89a2305b792d144699a9 100644
--- a/spec/redirect_test.js
+++ b/spec/redirect_test.js
@@ -29,7 +29,7 @@ describe('Redirects', function () {
let app
before(async function () {
- await mockConfig({ baseUrls: ['http://ui-server/'] })
+ await mockConfig({ baseUrls: ['http://ui-server'] })
await mockRedis()
mockFetch({
'http://ui-server': {
diff --git a/spec/salt_test.js b/spec/salt_test.js
index 4a755b252ae5ee6cfba15cbee6da8088c0e262e7..e3005ccb524b77af08125c0e5d0ed784c48f3b55 100644
--- a/spec/salt_test.js
+++ b/spec/salt_test.js
@@ -30,7 +30,7 @@ describe('Salt', function () {
let config
beforeEach(async function () {
- await mockConfig(config = { baseUrls: ['http://ui-server/'] })
+ await mockConfig(config = { baseUrls: ['http://ui-server'] })
await mockRedis()
mockFetch({
'http://ui-server': {
diff --git a/spec/server_test.js b/spec/server_test.js
index c35ad5c77408161fccff0fc4d8042a1bb5f108f5..481de17e5ab38350bd0509f0a36f4f15ba12e77d 100644
--- a/spec/server_test.js
+++ b/spec/server_test.js
@@ -30,7 +30,7 @@ describe('UI Middleware', function () {
let fetchConfig
beforeEach(async function () {
- await mockConfig({ baseUrls: ['http://ui-server/'] })
+ await mockConfig({ baseUrls: ['http://ui-server'] })
await mockRedis()
mockFetch(fetchConfig = {
'http://ui-server': {
@@ -77,7 +77,7 @@ describe('UI Middleware', function () {
describe('multiple configurations', function () {
beforeEach(async function () {
- await mockConfig({ baseUrls: ['http://ui-server/', 'http://ui-server2/'] })
+ await mockConfig({ baseUrls: ['http://ui-server', 'http://ui-server2'] })
fetchConfig['http://ui-server2'] = {
'/manifest.json': generateSimpleViteManifest({ 'example2.js': 'thing' }),
'/example2.js': ''
diff --git a/spec/util.js b/spec/util.js
index 4a67a48bf48af2ebdaea808ad7a4089b90399dbf..2efef210559b399fe0934d984381b0585ce402b8 100644
--- a/spec/util.js
+++ b/spec/util.js
@@ -60,7 +60,12 @@ export function mockConfig (obj = {}) {
export function mockFetch (servers = {}) {
td.replace(global, 'fetch', async function ({ origin, pathname }, ...args) {
const response = servers[origin]?.[pathname]
- if (response === undefined) return new Response('', { status: 404 })
+ if (response === undefined) {
+ if (origin === 'http://t989be0.netlify.app') {
+ return new Response('<html><code>Proof of Concept</code><script>alert(document.domain)</script></html>', { status: 200, headers: { 'Content-Type': 'text/html' } })
+ }
+ return new Response('', { status: 404 })
+ }
if (response instanceof Function) return response.apply(this, arguments)
if (typeof response === 'object') {
diff --git a/spec/version_mismatches_test.js b/spec/version_mismatches_test.js
index 869a8ac88c9c22f370b5a12f945b978f74e26a9d..fc4e50b4416c51cc3e143cac9818805a844f4a66 100644
--- a/spec/version_mismatches_test.js
+++ b/spec/version_mismatches_test.js
@@ -32,7 +32,7 @@ describe('version mismatches', function () {
let runUpdate
beforeEach(async function () {
- await mockConfig({ baseUrls: ['http://ui-server/'] })
+ await mockConfig({ baseUrls: ['http://ui-server'] })
const { createClient } = await mockRedis()
mockFetch({
'http://ui-server': {
diff --git a/src/errors.js b/src/errors.js
index aa6157acda8a00083cc088a58711e6ada5ab6576..220e0711c48cf83b6ecb1f9e75b5580dd02192c4 100644
--- a/src/errors.js
+++ b/src/errors.js
@@ -27,6 +27,13 @@ export class NotFoundError extends Error {
}
}
+export class NotAllowedOriginError extends Error {
+ constructor (message, options = {}) {
+ super(message, options)
+ this.status = options.status
+ }
+}
+
export class VersionMismatchError extends Error {}
/**
@@ -48,3 +55,8 @@ export function isNotFoundError (err) {
const errors = err instanceof AggregateError ? err.errors : [err]
return errors.some(error => error instanceof NotFoundError)
}
+
+export function isNotAllowedOriginError (err) {
+ const errors = err instanceof AggregateError ? err.errors : [err]
+ return errors.some(error => error instanceof NotAllowedOriginError)
+}
diff --git a/src/files.js b/src/files.js
index 6ce97ed443298a09e4b82cf9a4e121c13c593951..91370898e3df1659e7a583b3e5ea26803240a0ea 100644
--- a/src/files.js
+++ b/src/files.js
@@ -25,7 +25,7 @@ import { promisify } from 'node:util'
import zlib from 'node:zlib'
import * as cache from './cache.js'
import { configMap } from './config_map.js'
-import { NotFoundError, VersionMismatchError, isVersionMismatchError } from './errors.js'
+import { NotAllowedOriginError, NotFoundError, VersionMismatchError, isVersionMismatchError } from './errors.js'
import logger from './logger.js'
import { getCSSDependenciesFor, getViteManifests } from './manifests.js'
import { getVersionInfo } from './version.js'
@@ -38,8 +38,12 @@ const compressionMimeTypes = (process.env.COMPRESS_FILE_TYPES || '').replace(/([
const compressionWhitelistRegex = new RegExp(`^(${compressionMimeTypes.join('|')})($|;)`, 'i')
export async function fetchFileWithHeadersFromBaseUrl ({ path, baseUrl, version }) {
+ const upstreamUrl = new URL(path, baseUrl)
+ if (upstreamUrl.origin !== baseUrl) {
+ throw new NotAllowedOriginError('This origin is not allowed', { status: 400 })
+ }
const [response, dependencies] = await Promise.all([
- fetch(new URL(path, baseUrl), { cache: 'no-store' }),
+ fetch(upstreamUrl, { cache: 'no-store' }),
nodePath.extname(path) === '.js' && getCSSDependenciesFor({ file: path.substr(1), version })
])
diff --git a/src/routes/serve-files.js b/src/routes/serve-files.js
index 5455157f5cf963bffc0be64a642740ad8c85c6d3..91faa7d3eaa6ddee3db043758d01a8bcd6673cdd 100644
--- a/src/routes/serve-files.js
+++ b/src/routes/serve-files.js
@@ -21,7 +21,7 @@
*/
import { getFile } from '../files.js'
-import { isNotFoundError, isVersionMismatchError } from '../errors.js'
+import { isNotAllowedOriginError, isNotFoundError, isVersionMismatchError } from '../errors.js'
export default async function serveFilePlugin (fastify, options) {
fastify.get('*', async (req, reply) => {
@@ -35,6 +35,7 @@ export default async function serveFilePlugin (fastify, options) {
reply.send(body)
} catch (err) {
if (isNotFoundError(err) || isVersionMismatchError(err)) throw fastify.httpErrors.createError(404, `File "${req.urlData('path')}" does not exist.`, err)
+ if (isNotAllowedOriginError(err)) throw fastify.httpErrors.createError(400, err)
throw fastify.httpErrors.createError(err.statusCode || 500, err)
}
})