fix: add content-security policy, prevent access to system files

disallow access to system files and set strict content-security to
prevent connection to external resources.

Author: commenthol

lib/appConfig.js

@@ -1,9 +1,9 @@
 const os = require('os')
 const fs = require('fs')
 const path = require('path')
-const mkdirp = require('./mkdirp')
 const crypto = require('crypto')
-const { merge } = require('./utils')
+const mkdirp = require('./mkdirp.js')
+const { merge } = require('./utils.js')
 
 const APP = 'md-fileserver'
 const CONF = 'config.json'

lib/index.js

@@ -25,7 +25,7 @@ function setupApp() {
     mw.error
   )
 
-  app.use(mw.session(token)).use(mw.error)
+  app.use(mw.session(token), mw.error)
 
   app.get('/config', mw.renderConfig({ highlightStyles }))
   app.post(
@@ -41,6 +41,7 @@ function setupApp() {
   app
     .use(mw.forbiddenRemote)
     .use(mw.unescape)
+    .use(mw.forbiddenPaths)
     .use(mw.noextfile)
     .use(mw.stat)
     .use(mw.plaintext)

lib/markd.js

@@ -6,6 +6,7 @@ const path = require('path')
 const markedpp = require('markedpp').default
 const md = require('markdown-it')
 const confluencer = require('confluencer')
+const { newError, contentSecurityPolicy } = require('./utils.js')
 
 const tmpl = fs.readFileSync(path.resolve(__dirname, 'pages', 'template.html'))
 
@@ -74,7 +75,10 @@ function renderRequest(filename, req, res, next, status = 200) {
 
   render(filename, title, req._config)
     .then((rendered) => {
-      res.writeHead(status, { 'Content-Type': 'text/html; charset=utf-8' })
+      res.writeHead(status, {
+        'Content-Type': 'text/html; charset=utf-8',
+        'Content-Security-Policy': contentSecurityPolicy
+      })
       res.write(rendered)
       res.end()
     })

lib/middlewares.js

@@ -5,28 +5,29 @@ const serveIndex = require('serve-index')
 const serveStatic = require('serve-static')
 const cookie = require('cookie')
 
-const config = require('../config')
-const { renderRequest } = require('./markd')
-const { renderConfig, updateConfig } = require('./renderConfig')
+const config = require('../config.js')
+const { renderRequest } = require('./markd.js')
+const { renderConfig, updateConfig } = require('./renderConfig.js')
 const {
   newError,
   homedir,
   drive,
   uri2filename,
   filename2uri,
   urlWithoutDrive
-} = require('./utils')
+} = require('./utils.js')
 
 const MARKDOWNEXT = /\.(md|mdown|markdown)$/
 const FILETEXT = /[/\\]([A-Za-z]+)$/
 const FILENOEXT = /[/\\]([^.]+)$/
+const FORBIDDEN_RE = /^\/(etc|bin|sbin|usr|boot|opt|var|lib|[Cc]:\/[Ww]indows\/[Ss]ystem32)(\/|$)/
 
 /**
  * middlewares
  */
 const M = {
   // only allow access from localhost
-  forbiddenRemote: function (req, res, next) {
+  forbiddenRemote: function (req, _res, next) {
     if (
       ['127.0.0.1', '::ffff:127.0.0.1', '::1'].indexOf(
         req.connection.remoteAddress
@@ -38,6 +39,17 @@ const M = {
       next()
     }
   },
+
+  // forbid access to system paths
+  forbiddenPaths: function (req, _res, next) {
+    const reqPath = uri2filename(req.url)
+    if (FORBIDDEN_RE.test(reqPath)) {
+      next(newError(403))
+      return
+    }
+    next()
+  },
+
   // check session
   session: (token) => (req, res, next) => {
     const cookies = cookie.parse(req.headers.cookie || '')
@@ -56,29 +68,35 @@ const M = {
       next(newError(403))
     }
   },
+
+  // load config
   config: (appConfig) => (req, res, next) => {
     req._config = Object.assign({}, config, appConfig.config)
     next()
   },
   renderConfig,
   updateConfig,
+
   // render cheatsheet
-  cheatsheet: (req, res, next) => {
+  cheatsheet: (req, _res, next) => {
     const file = path.resolve(__dirname, '..', 'test', 'cheatsheet.md')
     req.url = filename2uri(file)
     next()
   },
+
   // redirect to homeDir
   home: (req, res) => {
     res.redirect(homedir())
   },
+
   // unescape an escaped URL
-  unescape: function (req, res, next) {
+  unescape: function (req, _res, next) {
     req.url = decodeURIComponent(req.url)
     next()
   },
+
   // check if file exists and if is directory
-  stat: function (req, res, next) {
+  stat: function (req, _res, next) {
     const filename = uri2filename(req.url)
     fs.stat(filename, (err, stats) => {
       if (err) {
@@ -89,6 +107,7 @@ const M = {
       }
     })
   },
+
   // try to autocorrect markdown links (e.g. for gitlab)
   noextfile: function (req, res, next) {
     let path
@@ -117,6 +136,7 @@ const M = {
       next()
     }
   },
+
   // serve files without extension as plaintext files
   plaintext: function (req, res, next) {
     if (!req.isDirectory && FILETEXT.test(req.url)) {
@@ -135,6 +155,7 @@ const M = {
       next()
     }
   },
+
   // make markdown conversion
   markdown: function (req, res, next) {
     // transform markdown pages
@@ -145,6 +166,7 @@ const M = {
       next()
     }
   },
+
   // show index for directories
   serveIndex: function (req, res, next) {
     if (!req.isDirectory) {
@@ -174,6 +196,7 @@ const M = {
       next(err)
     })
   },
+
   // serve static files
   serveStatic: function (path, options) {
     return function (req, res, next) {
@@ -190,12 +213,13 @@ const M = {
       })
     }
   },
+
   // final 404 handler
   four0four: function (req, res, next) {
     next(newError(404))
   },
-  // error handler
 
+  // error handler
   error: function (err, req, res, _next) {
     if (!err.status) {
       // Error objects

lib/renderConfig.js

@@ -1,7 +1,8 @@
 const _template = require('lodash/template')
 const fs = require('fs')
 const path = require('path')
-const { markdown } = require('./markd')
+const { markdown } = require('./markd.js')
+const { contentSecurityPolicy } = require('./utils.js')
 
 function renderConfig({ highlightStyles }) {
   const styles = fs
@@ -22,7 +23,10 @@ function renderConfig({ highlightStyles }) {
 
     markdown(req.url, data, req._config)
       .then((data) => {
-        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' })
+        res.writeHead(200, {
+          'Content-Type': 'text/html; charset=utf-8',
+          'Content-Security-Policy': contentSecurityPolicy
+        })
         res.write(data)
         res.end()
       })

lib/utils.js

@@ -22,6 +22,18 @@ const urlWithoutDrive = (uri) =>
 
 const homedir = () => (isWin32 ? filename2uri(os.homedir()) : os.homedir())
 
+const contentSecurityPolicy = [
+  "default-src 'self' 'unsafe-inline'",
+  "script-src 'self' 'unsafe-inline'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src data: *",
+  "font-src data: *",
+  "connect-src 'self'",
+  "media-src data: *",
+  "object-src data: *",
+  "prefetch-src data: *",
+].join('; ')
+
 /**
  * sets error
  * @param {Error|Number} err
@@ -74,5 +86,6 @@ module.exports = {
   urlWithoutDrive,
   newError,
   merge,
-  requireResolve
+  requireResolve,
+  contentSecurityPolicy
 }

lib/watch.js

@@ -1,7 +1,7 @@
 const fs = require('fs')
-const mw = require('./middlewares')
-const { uri2filename, filename2uri } = require('./utils')
 const WebSocket = require('ws')
+const mw = require('./middlewares.js')
+const { uri2filename, filename2uri } = require('./utils.js')
 
 const MARKDOWNEXT = mw.MARKDOWNEXT
 const WATCHOPTS = { persistent: true, recursive: false }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "md-fileserver",
-  "version": "1.10.2",
+  "version": "1.10.3-0",
   "description": "Locally view markdown files in a browser",
   "keywords": [
     "fileserver",
@@ -45,7 +45,8 @@
     "readme": "markedpp --githubid -i README.md -o README.md",
     "test": "mocha",
     "test:md": "bin/mdstart.js test/cheatsheet.md",
-    "test:cnfl": "bin/mdstart.js test/cnfl.md"
+    "test:cnfl": "bin/mdstart.js test/cnfl.md",
+    "test:exf": "bin/mdstart.js test/exfiltrate.md"
   },
   "mocha": {
     "exit": true

test/exfiltrate.md

@@ -0,0 +1,18 @@
+<!-- CSP header prevents remove exfiltration -->
+
+**remote**
+
+<pre id="remote"> </pre>
+
+**local**
+
+<pre id="local"> </pre>
+
+<script>
+  fetch('https://httpbin.org/get?foo=bar').then(res => res.text()).then((text) => {
+    document.getElementById('remote').textContent = text
+  })
+  fetch('http://localhost:4000/etc/passwd').then(res => res.text()).then((text) => {
+    document.getElementById('local').textContent = text
+  })
+</script>