add referer assertions (very basic)

Author: Arlen22

PLANNING.md

@@ -41,7 +41,6 @@ Internal notes by core developers
 
 - make a note about wikis not being able to talk to each other
 - verify all of the authentication and security
-- possibly make material design 3 ui with web commponents
 - make sure the getting started doc is correct
 - put site restrictions in a file
 - sell people on contributing to the project
@@ -52,6 +51,5 @@ Internal notes by core developers
   - multiple folder views (flat, folder, tag)
 - active node server for a specific folder (also a massive security bypass)
 - instructions for process users on different platforms (e.g. linux permission users)
-- Recipe templates, which have a simple list of plugins and readonly bags, and are assigned to the writable bag.
 
 

packages/mws/src/RequestState.ts

@@ -88,18 +88,32 @@ export class StateObject<
   }
 
 
-  getRefererRecipe() {
+  assertWikiReferer(recipe_slug: string) {
     const state = this;
-    if (!state.headers.get("referer")) return;
-    const referer = new URL(state.headers.get("referer")!);
+    if (!state.headers.referer) return;
+    const referer = new URL(state.headers.referer);
     // console.log("Referer", state.headers.referer, referer);
     if (!referer.pathname.startsWith(state.pathPrefix))
       throw state.sendEmpty(404, { "x-reason": "invalid path prefix" });
     if (!referer.pathname.startsWith(state.pathPrefix + "/wiki/"))
       return; // keep going
     // we now get the recipe name from the referer
     const recipe_name = referer.pathname.substring(state.pathPrefix.length + "/wiki/".length);
-    return decodeURIComponent(recipe_name) as PrismaField<"Recipe", "id">;
+    const referer_slug = decodeURIComponent(recipe_name) as PrismaField<"Recipe", "id">;
+    if (referer_slug !== recipe_slug)
+      throw new SendError("CROSS_WIKI_ACCESS_DENIED", 403, null);
+  }
+
+  assertAdminReferer() {
+    const state = this;
+    // referer is a voluntary header
+    if (!state.headers.referer) return;
+    const referer = new URL(state.headers.referer);
+    // deny referers from outside our pathprefix
+    if (!referer.pathname.startsWith(state.pathPrefix))
+      throw new SendError("ADMIN_ACCESS_DENIED", 403, null);
+    if (referer.pathname.startsWith(state.pathPrefix + "/wiki/"))
+      throw new SendError("ADMIN_ACCESS_DENIED", 403, null);
   }
 
 

packages/mws/src/SendError.ts

@@ -74,6 +74,11 @@ declare module "@tiddlywiki/server" {
 
     "OPERATION_NOT_PERMITTED":
     SendErrorItem<403, { reason: string }>
+
+    "CROSS_WIKI_ACCESS_DENIED":
+    SendErrorItem<403, null>
+    "ADMIN_ACCESS_DENIED":
+    SendErrorItem<403, null>
   }
 }
 SendError.oninstance.push(e => {

packages/mws/src/new-managers/RecipeRoutes.ts

@@ -16,6 +16,7 @@ export const RecipeStatus = zodRoute({
   }),
   inner: async (state) => {
     const { recipe_slug } = state.pathParams;
+    state.assertWikiReferer(recipe_slug);
     const recipe = await RecipeResolver.assertRecipe({
       state,
       recipe_slug,
@@ -55,6 +56,7 @@ export const TiddlerList = zodRoute({
   }),
   inner: async (state) => {
     const { recipe_slug } = state.pathParams;
+    state.assertWikiReferer(recipe_slug);
     const recipe = await RecipeResolver.assertRecipe({
       state,
       recipe_slug,
@@ -81,6 +83,7 @@ export const RecipeStore = zodRoute({
   zodQueryKeys: ["cache"],
   inner: async (state) => {
     const { recipe_slug } = state.pathParams;
+    state.assertWikiReferer(recipe_slug);
     throw await serveIndex(state, recipe_slug, "store");
   },
 });
@@ -97,6 +100,8 @@ export const RecipeUpdates = zodRoute({
   zodQueryKeys: ["since"],
   inner: async (state) => {
     const { recipe_slug } = state.pathParams;
+    state.assertWikiReferer(recipe_slug);
+
     const recipe = await RecipeResolver.assertRecipe({
       state,
       recipe_slug,
@@ -160,6 +165,9 @@ export const TiddlerBatch = zodRoute({
   }),
   inner: async (state) => {
     const { recipe_slug, op } = state.pathParams;
+    state.assertWikiReferer(recipe_slug)
+
+
 
     const recipe = await RecipeResolver.assertRecipe({
       state,

packages/mws/src/new-managers/TabDataAdapter.ts

@@ -23,7 +23,7 @@ import {
   RoleImportWriter,
   TemplateImportWriter,
   UserImportWriter
-} from "./TabImportWriter";
+} from "./TabUpserts";
 import {
   BagPermissionLevel,
   RecipePermissionLevel
@@ -83,7 +83,7 @@ export {
   type ImportedRoleRows,
   type ImportedTemplateRow,
   type ImportedUserRows,
-} from "./TabImportWriter";
+} from "./TabUpserts";
 
 
 // #region abstracts
@@ -532,7 +532,7 @@ export const AdminSave = zodRoute({
   }),
   zodRequestBody: z => z.any(),
   inner: async (state) => {
-
+    state.assertAdminReferer();
     state.asserted = state.user.isAdmin;
     state.data = JSON.parse(JSON.stringify(state.data), (key: any, val: any) => {
       if (typeof val === "string" && val.startsWith(IdString.prefix))
@@ -585,6 +585,7 @@ export const AdminLoad = zodRoute({
   zodPathParams: z => ({}),
   inner: async (state) => {
     // access is checked in each list
+    state.assertAdminReferer();
     state.asserted = state.user.isLoggedIn;
     const res = await state.$transaction(async prisma => {
       const roles = await new RoleImportWriter(prisma, false).getIdMapper();

…/mws/src/new-managers/TabImportWriter.ts …kages/mws/src/new-managers/TabUpserts.tspackages/mws/src/new-managers/TabImportWriter.ts renamed to packages/mws/src/new-managers/TabUpserts.ts packages/mws/src/new-managers/TabImportWriter.ts renamed to packages/mws/src/new-managers/TabUpserts.ts

@@ -17,7 +17,7 @@ import { RecipeStatus, RecipeStore, RecipeUpdates, TiddlerBatch, TiddlerList } f
 
 export * from "./RecipeResolver";
 export * from "./TabDataAdapter";
-export * from "./TabImportWriter";
+export * from "./TabUpserts";
 export * from "./wiki-utils";
 export * from "./wiki-contract";
 
@@ -84,6 +84,7 @@ serverEvents.on("mws.routes", (root) => {
     }), new Error());
 
     const { recipe_slug } = state.pathParams;
+    state.assertWikiReferer(recipe_slug);
     return await serveIndex(state, recipe_slug, "index");
 
   }, async (state, e) => {