|
| 1 | +import { z } from 'zod' |
| 2 | + |
| 3 | +import Permissions from '../../../security/permissions' |
| 4 | +import IntegrationService from '../../../services/integrationService' |
| 5 | +import PermissionChecker from '../../../services/user/permissionChecker' |
| 6 | +import { validateOrThrow } from '../../../utils/validation' |
| 7 | + |
| 8 | +const MAX_LIST_NAME_LENGTH = 255 |
| 9 | + |
| 10 | +// `name` is a display label only — the worker keys the mirror path by the |
| 11 | +// DB-generated list id, not `name` (see mirror_service.py's |
| 12 | +// list_mirror_dir/_validate_list_id), so it's free to contain path-like |
| 13 | +// characters (lore lists are nested, e.g. "some-project/git"). Only reject |
| 14 | +// the null byte, which breaks C-string-based tooling downstream regardless |
| 15 | +// of context. |
| 16 | +const isSafeListName = (name: string): boolean => |
| 17 | + name.length > 0 && name.length <= MAX_LIST_NAME_LENGTH && !name.includes('\0') |
| 18 | + |
| 19 | +// public-inbox-clone in the worker fetches this URL as-is; restrict to |
| 20 | +// https so a caller can't point the worker at file://, javascript:, or a |
| 21 | +// bare non-URL string. Requiring https already blocks the classic SSRF |
| 22 | +// target (cloud-metadata IMDS is http-only, per securityTxt.ts precedent); |
| 23 | +// also reject obvious loopback/localhost literals. |
| 24 | +const isBlockedHost = (h: string): boolean => |
| 25 | + h === 'localhost' || h === '::1' || h === '0.0.0.0' || h.startsWith('127.') |
| 26 | + |
| 27 | +const isSafeSourceUrl = (sourceUrl: string): boolean => { |
| 28 | + try { |
| 29 | + const url = new URL(sourceUrl) |
| 30 | + return ( |
| 31 | + url.protocol === 'https:' && |
| 32 | + !isBlockedHost(url.hostname.toLowerCase()) && |
| 33 | + // Credentials/query/fragment have no meaning for a public-inbox archive |
| 34 | + // URL; rejecting them keeps canonicalizeSourceUrl a lossless |
| 35 | + // normalization instead of one that silently drops caller-supplied data. |
| 36 | + url.username === '' && |
| 37 | + url.password === '' && |
| 38 | + url.search === '' && |
| 39 | + url.hash === '' |
| 40 | + ) |
| 41 | + } catch { |
| 42 | + return false |
| 43 | + } |
| 44 | +} |
| 45 | + |
| 46 | +// "https://host/list" and "https://HOST/list/" and "https://host:443/list" |
| 47 | +// must all resolve to the same DB row — scheme case, host case, the default |
| 48 | +// https port, and a trailing slash are not meaningful differences for the |
| 49 | +// same archive, but a plain trailing-slash strip left them as distinct |
| 50 | +// strings, bypassing the cross-project ownership check and causing |
| 51 | +// duplicate ingestion. The worker's ensure_mirror() already normalizes to |
| 52 | +// this same form before cloning (mirror_service.py), so storage must match. |
| 53 | +// Kept as a plain function (not a zod .transform()/.preprocess()) since |
| 54 | +// either makes the field optional in z.infer with the installed zod v4 — |
| 55 | +// reproduced in isolation, unrelated to this schema's nesting. |
| 56 | +export const canonicalizeSourceUrl = (sourceUrl: string): string => { |
| 57 | + const url = new URL(sourceUrl) |
| 58 | + const port = url.port && url.port !== '443' ? `:${url.port}` : '' |
| 59 | + const path = url.pathname.replace(/\/+$/, '') || '/' |
| 60 | + return `https://${url.hostname.toLowerCase()}${port}${path}` |
| 61 | +} |
| 62 | + |
| 63 | +export const bodySchema = z.object({ |
| 64 | + lists: z |
| 65 | + .array( |
| 66 | + z.object({ |
| 67 | + name: z.string().trim().min(1).refine(isSafeListName, { |
| 68 | + message: 'Invalid mailing list name', |
| 69 | + }), |
| 70 | + sourceUrl: z.string().trim().min(1).refine(isSafeSourceUrl, { |
| 71 | + message: 'sourceUrl must be a valid https:// URL', |
| 72 | + }), |
| 73 | + }), |
| 74 | + ) |
| 75 | + .min(1, 'lists must contain at least one mailing list') |
| 76 | + .refine( |
| 77 | + (lists) => |
| 78 | + new Set(lists.map((l) => canonicalizeSourceUrl(l.sourceUrl))).size === lists.length, |
| 79 | + { message: 'lists contains duplicate sourceUrl entries' }, |
| 80 | + ), |
| 81 | +}) |
| 82 | + |
| 83 | +export default async (req, res) => { |
| 84 | + new PermissionChecker(req).validateHas(Permissions.values.tenantEdit) |
| 85 | + const integrationData = validateOrThrow(bodySchema, req.body) |
| 86 | + integrationData.lists = integrationData.lists.map((l) => ({ |
| 87 | + ...l, |
| 88 | + sourceUrl: canonicalizeSourceUrl(l.sourceUrl), |
| 89 | + })) |
| 90 | + |
| 91 | + const payload = await new IntegrationService(req).mailingListConnectOrUpdate(integrationData) |
| 92 | + await req.responseHandler.success(req, res, payload) |
| 93 | +} |
0 commit comments