feat: security hardening

feat(jetstream-desktop): enhance external URL handling with safe scheme checks

fix(jetstream-desktop): ensure file downloads use the correct basename for paths

fix(jetstream-desktop): improve notification service to use safe URL opening

fix(jetstream-desktop): update protocol service to use basename for download filenames

feat(jetstream-desktop): add utility for safe external URL opening

fix(web-extension): restrict message event handling to same-origin and window source

refactor(web-extension): remove external message listener to enhance security

fix(auth.db.service): improve logging and ensure correct session revocation

feat(sync.types): add maximum nesting depth check for sync data payloads

Author: paustint

SECURITY_REVIEW.md

@@ -2,10 +2,21 @@ import { ENV, getLogger, httpLogger, logger, requestContextMiddleware } from '@j
 import { GeoIpLookupResult } from '@jetstream/types';
 import { json, urlencoded } from 'body-parser';
 import express from 'express';
+import { createHash, timingSafeEqual } from 'node:crypto';
 import { z, ZodError } from 'zod';
 import { downloadMaxMindDb, initMaxMind, lookupIpAddress, validateIpAddress } from './maxmind.service';
 import { createRoute } from './route.utils';
 
+/**
+ * Constant-time credential comparison. Both values are hashed to a fixed-length digest first so the
+ * comparison does not leak length and does not throw on mismatched lengths.
+ */
+function timingSafeStringCompare(providedValue: string, expectedValue: string): boolean {
+  const providedHash = createHash('sha256').update(String(providedValue)).digest();
+  const expectedHash = createHash('sha256').update(String(expectedValue)).digest();
+  return timingSafeEqual(providedHash, expectedHash);
+}
+
 const DISK_PATH = process.env.DISK_PATH ?? __dirname;
 
 if (ENV.ENVIRONMENT !== 'development' && (!ENV.GEO_IP_API_USERNAME || !ENV.GEO_IP_API_PASSWORD)) {
@@ -39,7 +50,11 @@ app.use((req, res, next) => {
       throw new Error('Unauthorized');
     }
     const [username, password] = Buffer.from(token, 'base64').toString().split(':');
-    if (username !== ENV.GEO_IP_API_USERNAME || password !== ENV.GEO_IP_API_PASSWORD) {
+    // Evaluate both comparisons (no short-circuit) with a constant-time compare so response time
+    // does not reveal whether the username alone was correct.
+    const usernameMatches = timingSafeStringCompare(username ?? '', ENV.GEO_IP_API_USERNAME ?? '');
+    const passwordMatches = timingSafeStringCompare(password ?? '', ENV.GEO_IP_API_PASSWORD ?? '');
+    if (!usernameMatches || !passwordMatches) {
       throw new Error('Unauthorized');
     }
     next();
@@ -101,7 +116,7 @@ app.get(
  */
 app.post(
   '/api/lookup',
-  createRoute({ body: z.object({ ips: z.string().array() }) }, async ({ body }, _, res, next) => {
+  createRoute({ body: z.object({ ips: z.string().array().max(1000) }) }, async ({ body }, _, res, next) => {
     try {
       const ipAddresses = body.ips;
       await initMaxMind(DISK_PATH);

apps/geo-ip-api/src/main.ts

@@ -1,9 +1,10 @@
 import { HTTP } from '@jetstream/shared/constants';
-import { app, BrowserWindow, clipboard, Menu, nativeImage, shell } from 'electron';
+import { app, BrowserWindow, clipboard, Menu, nativeImage } from 'electron';
 import log from 'electron-log/main';
 import * as path from 'path';
 import { ENV } from '../config/environment';
 import { initApiConnection } from '../utils/route.utils';
+import { openExternalSafe } from '../utils/url.utils';
 import { isMac } from '../utils/utils';
 import { getWindowConfig } from './config';
 
@@ -48,16 +49,15 @@ export class Browser {
         if (connection) {
           connection.jetstreamConn.org.identity().then(() => {
             const sfdcUrl = connection.jetstreamConn.org.getFrontdoorLoginUrl(returnUrl);
-            shell.openExternal(sfdcUrl);
+            openExternalSafe(sfdcUrl);
           });
           return { action: 'deny' };
         }
       }
 
-      // Open all external links in the browser
-      // FIXME: this should be more protective over what is externally opened
+      // Open all external links in the browser (only safe schemes are actually opened)
       if (url.host !== clientUrl.host) {
-        shell.openExternal(details.url);
+        openExternalSafe(details.url);
         return { action: 'deny' };
       }
 
@@ -68,6 +68,26 @@ export class Browser {
       };
     });
 
+    // Prevent the renderer from navigating the privileged window away from the app.
+    // Anything cross-origin is blocked and, if it uses a safe scheme, handed to the default browser
+    // instead. In-app (SPA) routing uses the history API and does not trigger these events.
+    const handleWindowNavigation = (event: Electron.Event, targetUrl: string) => {
+      let parsedUrl: URL;
+      try {
+        parsedUrl = new URL(targetUrl);
+      } catch {
+        event.preventDefault();
+        return;
+      }
+      const isSameAppOrigin = parsedUrl.protocol === clientUrl.protocol && parsedUrl.host === clientUrl.host;
+      if (!isSameAppOrigin) {
+        event.preventDefault();
+        openExternalSafe(targetUrl);
+      }
+    };
+    browserWindow.webContents.on('will-navigate', handleWindowNavigation);
+    browserWindow.webContents.on('will-redirect', handleWindowNavigation);
+
     this.createDock();
 
     browserWindow.once('ready-to-show', () => {

apps/jetstream-desktop/src/browser/browser.ts

@@ -5,7 +5,7 @@ import { Maybe } from '@jetstream/types';
 import { app, dialog, WebContents } from 'electron';
 import logger from 'electron-log';
 import { createWriteStream, existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { basename, join } from 'node:path';
 import { Readable } from 'stream';
 import { pipeline } from 'stream/promises';
 import { setRecentDocument } from '../utils/utils';
@@ -33,7 +33,7 @@ export async function downloadAndZipFilesToDisk(
     let downloadPath: string;
 
     if (downloadPreferences?.omitPrompt && downloadPreferences?.downloadPath && existsSync(downloadPreferences.downloadPath)) {
-      downloadPath = join(downloadPreferences.downloadPath, zipFileName);
+      downloadPath = join(downloadPreferences.downloadPath, basename(zipFileName));
     } else {
       const defaultPath = app.getPath('downloads');
       const result = await dialog.showSaveDialog({
@@ -125,7 +125,7 @@ export async function downloadBulkApiFileAndSaveToDisk({
     let downloadPath: string;
 
     if (downloadPreferences?.omitPrompt && downloadPreferences?.downloadPath && existsSync(downloadPreferences.downloadPath)) {
-      downloadPath = join(downloadPreferences.downloadPath, fileName);
+      downloadPath = join(downloadPreferences.downloadPath, basename(fileName));
     } else {
       const defaultPath = app.getPath('downloads');
       const result = await dialog.showSaveDialog({

apps/jetstream-desktop/src/services/file-download.service.ts

@@ -1,6 +1,7 @@
 import { Maybe } from '@jetstream/types';
-import { BrowserWindow, dialog, Notification, shell } from 'electron';
+import { BrowserWindow, dialog, Notification } from 'electron';
 import logger from 'electron-log';
+import { openExternalSafe } from '../utils/url.utils';
 import { checkNotifications } from './api.service';
 import * as dataService from './persistence.service';
 
@@ -40,7 +41,7 @@ export function showCriticalNotification(title: string, message: string, actionU
 
   notification.on('click', () => {
     if (actionUrl) {
-      shell.openExternal(actionUrl);
+      openExternalSafe(actionUrl);
     }
   });
 
@@ -61,6 +62,6 @@ export function showCriticalConfirmationDialog(title: string, message: string, a
   });
 
   if (response === 0 && actionUrl) {
-    shell.openExternal(actionUrl);
+    openExternalSafe(actionUrl);
   }
 }

apps/jetstream-desktop/src/services/notification.service.ts

@@ -141,7 +141,7 @@ export function registerDownloadHandler() {
     ) {
       return;
     }
-    const downloadFilename = join(downloadPreferences.downloadPath, item.getFilename());
+    const downloadFilename = join(downloadPreferences.downloadPath, path.basename(item.getFilename()));
     item.setSavePath(downloadFilename);
     item.once('done', (_, state) => {
       if (state === 'completed') {

apps/jetstream-desktop/src/services/protocol.service.ts

@@ -0,0 +1,27 @@
+import { shell } from 'electron';
+import log from 'electron-log/main';
+
+/**
+ * Schemes that are safe to hand to the OS via shell.openExternal.
+ * Everything else (file:, smb:/UNC, and custom-protocol handlers) can be coerced by the OS into
+ * launching a local file or another application, so those are blocked.
+ */
+const EXTERNAL_URL_ALLOWED_PROTOCOLS = new Set(['https:', 'http:', 'mailto:']);
+
+/**
+ * Open a URL in the user's default browser, but only if it uses a safe scheme.
+ * Use this everywhere instead of calling shell.openExternal directly so a renderer-supplied or
+ * server-supplied URL cannot trigger a dangerous scheme.
+ */
+export function openExternalSafe(rawUrl: string): void {
+  try {
+    const { protocol } = new URL(rawUrl);
+    if (EXTERNAL_URL_ALLOWED_PROTOCOLS.has(protocol)) {
+      shell.openExternal(rawUrl);
+    } else {
+      log.warn(`Blocked shell.openExternal for disallowed scheme: ${protocol}`);
+    }
+  } catch {
+    log.warn('Blocked shell.openExternal for an invalid URL');
+  }
+}

apps/jetstream-desktop/src/utils/url.utils.ts

@@ -13,7 +13,8 @@ const EVENT_MAP = {
 } as const;
 
 window.addEventListener('message', async (event) => {
-  if (event.origin !== targetOrigin) {
+  // Only accept messages posted by this same page (not an embedding/opener frame) and from our origin
+  if (event.source !== window || event.origin !== targetOrigin) {
     return;
   }
   if (event.data?.message === EVENT_MAP.ACKNOWLEDGE) {

apps/jetstream-web-extension/src/extension-scripts/content-auth-script.ts

@@ -16,7 +16,6 @@ import { initApiClientAndOrg } from '../utils/api-client';
 import {
   AUTH_CHECK_INTERVAL_MIN,
   AuthTokensStorage,
-  eventPayload,
   ExternalIdentifier,
   ExtIdentifierStorage,
   GetPageUrl,
@@ -154,51 +153,15 @@ browser.commands.onCommand.addListener(async (command, tab) => {
 });
 
 /**
- * Handle authentication events from Jetstream server
- * User is redirected and authenticated on the Jetstream server
- * and tokens are sent back to the extension and stored in chrome storage
+ * NOTE: There is intentionally no `onMessageExternal` listener.
+ *
+ * By default `onMessageExternal` is reachable by any other installed extension (and the extension
+ * id is public), which previously allowed a co-installed extension to read this device's identifier
+ * and inject an attacker-owned, device-bound auth token (session fixation). The legitimate login
+ * flow runs entirely through the origin-validated `contentAuthScript` content script (injected only
+ * on getjetstream.app/web-extension/*) and the internal `onMessage` handler below, so no external
+ * messaging surface is required.
  */
-browser.runtime.onMessageExternal.addListener(async (message: unknown) => {
-  try {
-    logger.log('Received message from external extension', message);
-    const event = eventPayload.parse(message);
-    switch (event.type) {
-      case 'EXT_IDENTIFIER': {
-        let result = (await browser.storage.sync.get(storageTypes.extIdentifier.key)) as Partial<ExtIdentifierStorage>;
-        if (!result.extIdentifier) {
-          result = { extIdentifier: { id: crypto.randomUUID() } };
-          await browser.storage.sync.set(result);
-          storageSyncCache.extIdentifier = result.extIdentifier;
-        }
-        if (!result.extIdentifier?.id) {
-          throw new Error('Could not get or initialize extension identifier');
-        }
-        logger.info('Extension identifier', result.extIdentifier.id);
-        return { success: true, data: result.extIdentifier.id };
-      }
-      case 'TOKENS': {
-        const { exp, userProfile } = jwtDecode<JwtPayload>(event.data.accessToken);
-        const expiresAt = exp ? fromUnixTime(exp) : new Date();
-        const authState = {
-          accessToken: event.data.accessToken,
-          userProfile,
-          expiresAt: expiresAt.getTime(),
-          lastChecked: null,
-          loggedIn: true,
-        };
-        await browser.storage.sync.set({ [storageTypes.authTokens.key]: authState });
-        storageSyncCache.authTokens = authState;
-        return { success: true };
-      }
-      default: {
-        return { success: false, error: 'Unknown message type' };
-      }
-    }
-  } catch (ex) {
-    logger.error('Error handling message', ex);
-    return { success: false, error: 'Error handling message' };
-  }
-});
 
 // connections seem to continually get reset
 // and we cannot make async calls in the fetch event listener to get from storage

apps/jetstream-web-extension/src/extension-scripts/service-worker.ts

@@ -315,7 +315,7 @@ export async function hasRememberDeviceRecord({
     if (rememberMe.userAgent && userAgent) {
       const isSimilar = checkUserAgentSimilarity(rememberMe.userAgent, userAgent);
       if (!isSimilar) {
-        logger.warn({ deviceId, userId }, `User agent mismatch for remembered device: ${rememberMe.userAgent} !== ${userAgent}`);
+        logger.warn({ userId }, `User agent mismatch for remembered device: ${rememberMe.userAgent} !== ${userAgent}`);
         return false;
       }
     }
@@ -834,8 +834,8 @@ export async function revokeExternalSession(userId: string, sessionId: string) {
   if (!userId || !sessionId) {
     throw new Error('Invalid parameters');
   }
-  await prisma.webExtensionToken.delete({
-    where: { id: sessionId },
+  await prisma.webExtensionToken.deleteMany({
+    where: { id: sessionId, userId },
   });
 }