Skip to content

Commit 9dd964e

Browse files
khasselkhassel
authored
change loading config.js, allow variables in config.js and try to protect sensitive data (#4029)
## Loading `config.js` ### Previously Loaded on server-side in `app.js` and in the browser by including `config.js` in `index.html`. The web server has an endpoint `/config` providing the content of server loaded `config.js`. ### Now Loaded only on server-side in `app.js`. The browser loads the content using the web server endpoint `/config`. So the server has control what to provide to the clients. Loading the `config.js` was moved to `Utils.js` so that `check_config.js` can use the same functions. ## Using environment variables in `config.js` ### Previously Environment variables were not allowed in `config.js`. The workaround was to create a `config.js.template` with curly braced bash variables allowed. While starting the app the `config.js.template` was converted via `envsub` into a `config.js`. ### Now Curly braced bash variables are allowed in `config.js`. Because only the server loads `config.js` he can substitute the variables while loading. ## Secrets in MagicMirror² To be honest, this is a mess. ### Previously All content defined in the `config` directory was reachable from the browser. Everyone with access to the site could see all stuff defined in the configuration e.g. using the url http://ip:8080/config. This included api keys and other secrets. So sharing a MagicMirror² url to others or running MagicMirror² without authentication as public website was not possible. ### Now With this PR we add (beta) functionality to protect sensitive data. This is only possible for modules running with a `node_helper`. For modules running in the browser only (e.g. default `weather` module), there is no way to hide data (per construction). This does not mean, that every module with `node_helper` is safe, e.g. the default `calendar` module is not safe because it uses the calendar url's as sort of id and sends them to the client. For adding more security you have to set `hideConfigSecrets: true` in `config.js`. With this: - `config/config.env` is not deliverd to the browser - the contents of environment variables beginning with `SECRET_` are not published to the clients This is a first step to protect sensitive data and you can at least protect some secrets.
1 parent f9f3461 commit 9dd964e

14 files changed

Lines changed: 352 additions & 1615 deletions

‎cspell.config.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,7 @@
179179
"Lightspeed",
180180
"loadingcircle",
181181
"locationforecast",
182+
"logg",
182183
"lockstring",
183184
"lstrip",
184185
"Luciella",
@@ -285,6 +286,8 @@
285286
"Teeuw",
286287
"Teil",
287288
"TESTMODE",
289+
"testpass",
290+
"testuser",
288291
"thomasrockhu",
289292
"thumbslider",
290293
"timeformat",
@@ -307,6 +310,7 @@
307310
"VEVENT",
308311
"vgtu",
309312
"Vitest",
313+
"VCALENDAR",
310314
"Voelt",
311315
"Vorberechnung",
312316
"vppencilsharpener",
@@ -326,6 +330,7 @@
326330
"winddirection",
327331
"windgusts",
328332
"windspeed",
333+
"WKST",
329334
"Woolridge",
330335
"worktree",
331336
"Wsymb",

‎eslint.config.mjs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ import stylistic from "@stylistic/eslint-plugin";
99
import vitest from "@vitest/eslint-plugin";
1010

1111
export default defineConfig([
12-
globalIgnores(["config/**", "modules/**/*", "js/positions.js"]),
12+
globalIgnores(["config/**", "modules/**/*", "js/positions.js", "tests/configs/port_variable.js"]),
1313
{
1414
files: ["**/*.js"],
1515
languageOptions: {

‎index.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,14 +44,14 @@
4444
<script type="text/javascript" src="socket.io/socket.io.js"></script>
4545
<script type="text/javascript" src="node_modules/nunjucks/browser/nunjucks.min.js"></script>
4646
<script type="text/javascript" src="js/defaults.js"></script>
47-
<script type="text/javascript" src="#CONFIG_FILE#"></script>
4847
<script type="text/javascript" src="js/vendor.js"></script>
4948
<script type="text/javascript" src="defaultmodules/defaultmodules.js"></script>
5049
<script type="text/javascript" src="defaultmodules/utils.js"></script>
5150
<script type="text/javascript" src="js/logger.js"></script>
5251
<script type="text/javascript" src="translations/translations.js"></script>
5352
<script type="text/javascript" src="js/translator.js"></script>
5453
<script type="text/javascript" src="js/class.js"></script>
54+
<script type="text/javascript" src="config/basepath.js"></script>
5555
<script type="text/javascript" src="js/module.js"></script>
5656
<script type="text/javascript" src="js/loader.js"></script>
5757
<script type="text/javascript" src="js/socketclient.js"></script>

‎js/app.js‎

Lines changed: 5 additions & 120 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ require("./alias-resolver");
44
const fs = require("node:fs");
55
const path = require("node:path");
66
const Spawn = require("node:child_process").spawn;
7-
const envsub = require("envsub");
87
const Log = require("logger");
98

109
// global absolute root path
@@ -15,7 +14,7 @@ const Utils = require(`${__dirname}/utils`);
1514

1615
// used to control fetch timeout for node_helpers
1716
const { setGlobalDispatcher, Agent } = require("undici");
18-
const { getEnvVarsAsObj, getConfigFilePath } = require("#server_functions");
17+
const { getEnvVarsAsObj } = require("#server_functions");
1918
// common timeout value, provide environment override in case
2019
const fetch_timeout = process.env.mmFetchTimeout !== undefined ? process.env.mmFetchTimeout : 30000;
2120

@@ -59,122 +58,6 @@ function App () {
5958
let defaultModules;
6059
let env;
6160

62-
/**
63-
* Loads the config file. Combines it with the defaults and returns the config
64-
* @async
65-
* @returns {Promise<object>} the loaded config or the defaults if something goes wrong
66-
*/
67-
async function loadConfig () {
68-
Log.log("Loading config ...");
69-
const defaults = require(`${__dirname}/defaults`);
70-
if (global.mmTestMode) {
71-
// if we are running in test mode
72-
defaults.address = "0.0.0.0";
73-
}
74-
75-
// For this check proposed to TestSuite
76-
// https://forum.magicmirror.builders/topic/1456/test-suite-for-magicmirror/8
77-
const configFilename = getConfigFilePath();
78-
let templateFile = `${configFilename}.template`;
79-
80-
// check if templateFile exists
81-
try {
82-
fs.accessSync(templateFile, fs.constants.F_OK);
83-
} catch (err) {
84-
templateFile = null;
85-
Log.log("config template file not exists, no envsubst");
86-
}
87-
88-
if (templateFile) {
89-
// save current config.js
90-
try {
91-
if (fs.existsSync(configFilename)) {
92-
fs.copyFileSync(configFilename, `${configFilename}-old`);
93-
}
94-
} catch (err) {
95-
Log.warn(`Could not copy ${configFilename}: ${err.message}`);
96-
}
97-
98-
// check if config.env exists
99-
const envFiles = [];
100-
const configEnvFile = `${configFilename.substr(0, configFilename.lastIndexOf("."))}.env`;
101-
try {
102-
if (fs.existsSync(configEnvFile)) {
103-
envFiles.push(configEnvFile);
104-
}
105-
} catch (err) {
106-
Log.log(`${configEnvFile} does not exist. ${err.message}`);
107-
}
108-
109-
let options = {
110-
all: true,
111-
diff: false,
112-
envFiles: envFiles,
113-
protect: false,
114-
syntax: "default",
115-
system: true
116-
};
117-
118-
// envsubst variables in templateFile and create new config.js
119-
// naming for envsub must be templateFile and outputFile
120-
const outputFile = configFilename;
121-
try {
122-
await envsub({ templateFile, outputFile, options });
123-
} catch (err) {
124-
Log.error(`Could not envsubst variables: ${err.message}`);
125-
}
126-
}
127-
128-
require(`${global.root_path}/js/check_config.js`);
129-
130-
try {
131-
fs.accessSync(configFilename, fs.constants.F_OK);
132-
const c = require(configFilename);
133-
if (Object.keys(c).length === 0) {
134-
Log.error("WARNING! Config file appears empty, maybe missing module.exports last line?");
135-
}
136-
checkDeprecatedOptions(c);
137-
return Object.assign(defaults, c);
138-
} catch (e) {
139-
if (e.code === "ENOENT") {
140-
Log.error("WARNING! Could not find config file. Please create one. Starting with default configuration.");
141-
} else if (e instanceof ReferenceError || e instanceof SyntaxError) {
142-
Log.error(`WARNING! Could not validate config file. Starting with default configuration. Please correct syntax errors at or above this line: ${e.stack}`);
143-
} else {
144-
Log.error(`WARNING! Could not load config file. Starting with default configuration. Error found: ${e}`);
145-
}
146-
}
147-
148-
return defaults;
149-
}
150-
151-
/**
152-
* Checks the config for deprecated options and throws a warning in the logs
153-
* if it encounters one option from the deprecated.js list
154-
* @param {object} userConfig The user config
155-
*/
156-
function checkDeprecatedOptions (userConfig) {
157-
const deprecated = require(`${global.root_path}/js/deprecated`);
158-
159-
// check for deprecated core options
160-
const deprecatedOptions = deprecated.configs;
161-
const usedDeprecated = deprecatedOptions.filter((option) => userConfig.hasOwnProperty(option));
162-
if (usedDeprecated.length > 0) {
163-
Log.warn(`WARNING! Your config is using deprecated option(s): ${usedDeprecated.join(", ")}. Check README and Documentation for more up-to-date ways of getting the same functionality.`);
164-
}
165-
166-
// check for deprecated module options
167-
for (const element of userConfig.modules) {
168-
if (deprecated[element.module] !== undefined && element.config !== undefined) {
169-
const deprecatedModuleOptions = deprecated[element.module];
170-
const usedDeprecatedModuleOptions = deprecatedModuleOptions.filter((option) => element.config.hasOwnProperty(option));
171-
if (usedDeprecatedModuleOptions.length > 0) {
172-
Log.warn(`WARNING! Your config for module ${element.module} is using deprecated option(s): ${usedDeprecatedModuleOptions.join(", ")}. Check README and Documentation for more up-to-date ways of getting the same functionality.`);
173-
}
174-
}
175-
}
176-
}
177-
17861
/**
17962
* Loads a specific module.
18063
* @param {string} module The name of the module (including subpath).
@@ -289,7 +172,9 @@ function App () {
289172
* @returns {Promise<object>} the config used
290173
*/
291174
this.start = async function () {
292-
config = await loadConfig();
175+
const configObj = Utils.loadConfig();
176+
config = configObj.fullConf;
177+
Utils.checkConfigFile(configObj);
293178

294179
global.defaultModulesDir = config.defaultModulesDir;
295180
defaultModules = require(`${global.root_path}/${global.defaultModulesDir}/defaultmodules`);
@@ -331,7 +216,7 @@ function App () {
331216

332217
await loadModules(modules);
333218

334-
httpServer = new Server(config);
219+
httpServer = new Server(configObj);
335220
const { app, io } = await httpServer.open();
336221
Log.log("Server started ...");
337222

‎js/check_config.js‎

Lines changed: 1 addition & 142 deletions
Original file line numberDiff line numberDiff line change
@@ -2,154 +2,13 @@
22
require("./alias-resolver");
33

44
const path = require("node:path");
5-
const fs = require("node:fs");
6-
const { styleText } = require("node:util");
7-
const Ajv = require("ajv");
8-
const globals = require("globals");
9-
const { Linter } = require("eslint");
105
const Log = require("logger");
116

127
const rootPath = path.resolve(`${__dirname}/../`);
138
const Utils = require(`${rootPath}/js/utils.js`);
149

15-
const linter = new Linter({ configType: "flat" });
16-
const ajv = new Ajv();
17-
18-
/**
19-
* Returns a string with path of configuration file.
20-
* Check if set by environment variable MM_CONFIG_FILE
21-
* @returns {string} path and filename of the config file
22-
*/
23-
function getConfigFile () {
24-
// FIXME: This function should be in core. Do you want refactor me ;) ?, be good!
25-
return path.resolve(process.env.MM_CONFIG_FILE || `${rootPath}/config/config.js`);
26-
}
27-
28-
/**
29-
* Checks the config file using eslint.
30-
*/
31-
function checkConfigFile () {
32-
const configFileName = getConfigFile();
33-
34-
// Check if file exists and is accessible
35-
try {
36-
fs.accessSync(configFileName, fs.constants.R_OK);
37-
} catch (error) {
38-
if (error.code === "ENOENT") {
39-
Log.error(`File not found: ${configFileName}`);
40-
} else if (error.code === "EACCES") {
41-
Log.error(`No permission to read config file: ${configFileName}`);
42-
} else {
43-
Log.error(`Cannot access config file: ${configFileName}\n${error.message}`);
44-
}
45-
process.exit(1);
46-
}
47-
48-
// Validate syntax of the configuration file.
49-
Log.info(`Checking config file ${configFileName} ...`);
50-
51-
// I'm not sure if all ever is utf-8
52-
const configFile = fs.readFileSync(configFileName, "utf-8");
53-
54-
const errors = linter.verify(
55-
configFile,
56-
{
57-
languageOptions: {
58-
ecmaVersion: "latest",
59-
globals: {
60-
...globals.browser,
61-
...globals.node
62-
}
63-
},
64-
rules: {
65-
"no-sparse-arrays": "error",
66-
"no-undef": "error"
67-
}
68-
},
69-
configFileName
70-
);
71-
72-
if (errors.length === 0) {
73-
Log.info(styleText("green", "Your configuration file doesn't contain syntax errors :)"));
74-
validateModulePositions(configFileName);
75-
} else {
76-
let errorMessage = "Your configuration file contains syntax errors :(";
77-
78-
for (const error of errors) {
79-
errorMessage += `\nLine ${error.line} column ${error.column}: ${error.message}`;
80-
}
81-
Log.error(errorMessage);
82-
process.exit(1);
83-
}
84-
}
85-
86-
/**
87-
*
88-
* @param {string} configFileName - The path and filename of the configuration file to validate.
89-
*/
90-
function validateModulePositions (configFileName) {
91-
Log.info("Checking modules structure configuration ...");
92-
93-
const positionList = Utils.getModulePositions();
94-
95-
// Make Ajv schema configuration of modules config
96-
// Only scan "module" and "position"
97-
const schema = {
98-
type: "object",
99-
properties: {
100-
modules: {
101-
type: "array",
102-
items: {
103-
type: "object",
104-
properties: {
105-
module: {
106-
type: "string"
107-
},
108-
position: {
109-
type: "string"
110-
}
111-
},
112-
required: ["module"]
113-
}
114-
}
115-
}
116-
};
117-
118-
// Scan all modules
119-
const validate = ajv.compile(schema);
120-
const data = require(configFileName);
121-
122-
const valid = validate(data);
123-
if (valid) {
124-
Log.info(styleText("green", "Your modules structure configuration doesn't contain errors :)"));
125-
126-
// Check for unknown positions (warning only, not an error)
127-
if (data.modules) {
128-
for (const [index, module] of data.modules.entries()) {
129-
if (module.position && !positionList.includes(module.position)) {
130-
Log.warn(`Module ${index} ("${module.module}") uses unknown position: "${module.position}"`);
131-
Log.warn(`Known positions are: ${positionList.join(", ")}`);
132-
}
133-
}
134-
}
135-
} else {
136-
const module = validate.errors[0].instancePath.split("/")[2];
137-
const position = validate.errors[0].instancePath.split("/")[3];
138-
let errorMessage = "This module configuration contains errors:";
139-
errorMessage += `\n${JSON.stringify(data.modules[module], null, 2)}`;
140-
if (position) {
141-
errorMessage += `\n${position}: ${validate.errors[0].message}`;
142-
errorMessage += `\n${JSON.stringify(validate.errors[0].params.allowedValues, null, 2).slice(1, -1)}`;
143-
} else {
144-
errorMessage += validate.errors[0].message;
145-
}
146-
Log.error(errorMessage);
147-
process.exit(1);
148-
}
149-
}
150-
15110
try {
152-
checkConfigFile();
11+
Utils.checkConfigFile();
15312
} catch (error) {
15413
const message = error && error.message ? error.message : error;
15514
Log.error(`Unexpected error: ${message}`);

‎js/defaults.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ const defaults = {
2020
customCss: "config/custom.css",
2121
foreignModulesDir: "modules",
2222
defaultModulesDir: "defaultmodules",
23+
hideConfigSecrets: false,
2324
// httpHeaders used by helmet, see https://helmetjs.github.io/. You can add other/more object values by overriding this in config.js,
2425
// e.g. you need to add `frameguard: false` for embedding MagicMirror in another website, see https://github.com/MagicMirrorOrg/MagicMirror/issues/2847
2526
httpHeaders: { contentSecurityPolicy: false, crossOriginOpenerPolicy: false, crossOriginEmbedderPolicy: false, crossOriginResourcePolicy: false, originAgentCluster: false },

0 commit comments

Comments
 (0)