From 0ff3bcc89645d1f93e54a535a13b9a02fff89ac4 Mon Sep 17 00:00:00 2001 From: Jen Hamon Date: Sat, 11 Jul 2026 16:16:38 -0400 Subject: [PATCH] security: fix path-injection, SSRF, and missing rate-limiting in namespace-notes Addresses 13 CodeQL code-scanning alerts (PIN-26): - js/path-injection (10): add pathSafety helper (sanitizeSegment + safeJoin) that validates each user-supplied path segment and confirms the resolved path stays within the uploads base dir. Applied across serverStorage.ts (saveFile, getFilePath, deleteWorkspaceFiles, deleteFileFromWorkspace, listFilesInNamespace) and documentController.serveDocument. - js/request-forgery (2): validate + URL-encode namespaceId/documentId before interpolating them into outbound fetch URLs in client files/route.ts. - js/missing-rate-limiting (1): add express-rate-limit to the filesystem routes in documentRoutes.ts. Server and client both typecheck clean; path-traversal vectors verified blocked. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../client/src/app/api/files/route.ts | 27 +- namespace-notes/server/package-lock.json | 502 +++++++++++++++++- namespace-notes/server/package.json | 1 + .../src/controllers/documentController.ts | 9 +- .../server/src/routes/documentRoutes.ts | 32 +- .../server/src/utils/storage/pathSafety.ts | 52 ++ .../server/src/utils/storage/serverStorage.ts | 25 +- 7 files changed, 624 insertions(+), 24 deletions(-) create mode 100644 namespace-notes/server/src/utils/storage/pathSafety.ts diff --git a/namespace-notes/client/src/app/api/files/route.ts b/namespace-notes/client/src/app/api/files/route.ts index 74645fb..2d0d77b 100644 --- a/namespace-notes/client/src/app/api/files/route.ts +++ b/namespace-notes/client/src/app/api/files/route.ts @@ -9,6 +9,20 @@ export interface FetchedFile { export const maxDuration = 600 +/** + * Validates a user-supplied identifier before it is used to build an outbound + * request URL. Only allows a conservative id charset and rejects anything that + * could alter the request path/host (slashes, dots, encoded traversal), then + * URL-encodes the value. This prevents server-side request forgery via the + * `namespaceId` / `documentId` query parameters. + */ +function safeId(value: string, label: string): string { + if (!/^[A-Za-z0-9_-]+$/.test(value)) { + throw new Error(`Invalid ${label}`); + } + return encodeURIComponent(value); +} + /** * Fetches all file URLs for a given namespace from the backend server. * @@ -26,7 +40,10 @@ export async function GET(request: Request) { try { // Ensure the SERVER_URL is correctly configured in your environment - const url = `${process.env.SERVER_URL}/api/documents/files/${namespaceId}`; + const url = `${process.env.SERVER_URL}/api/documents/files/${safeId( + namespaceId, + "namespaceId" + )}`; const response = await fetch(url, { method: "GET" }); const data = await response.json(); @@ -107,13 +124,17 @@ export async function DELETE(request: Request) { let url; let message; + const safeNamespaceId = safeId(namespaceId, "namespaceId"); if (typeof documentId === "string") { // Delete a specific document - url = `${process.env.SERVER_URL}/api/documents/files/delete/${namespaceId}/${documentId}`; + url = `${process.env.SERVER_URL}/api/documents/files/delete/${safeNamespaceId}/${safeId( + documentId, + "documentId" + )}`; message = "File deleted successfully"; } else { // Delete the entire workspace/namespace - url = `${process.env.SERVER_URL}/api/documents/workspace/${namespaceId}`; + url = `${process.env.SERVER_URL}/api/documents/workspace/${safeNamespaceId}`; message = "Workspace deleted successfully"; } diff --git a/namespace-notes/server/package-lock.json b/namespace-notes/server/package-lock.json index dd06af3..b8412e7 100644 --- a/namespace-notes/server/package-lock.json +++ b/namespace-notes/server/package-lock.json @@ -22,6 +22,7 @@ "cors": "^2.8.5", "dotenv": "^16.4.5", "express": "^4.22.0", + "express-rate-limit": "^7.4.1", "mime": "^4.0.1", "multer": "^2.0.2", "openai": "^4.29.0", @@ -730,6 +731,56 @@ "node": ">=18.0.0" } }, + "node_modules/@babel/helper-string-parser": { + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz", + "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==", + "license": "MIT", + "peer": true, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/helper-validator-identifier": { + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz", + "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==", + "license": "MIT", + "peer": true, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/parser": { + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.7.tgz", + "integrity": "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==", + "license": "MIT", + "peer": true, + "dependencies": { + "@babel/types": "^7.29.7" + }, + "bin": { + "parser": "bin/babel-parser.js" + }, + "engines": { + "node": ">=6.0.0" + } + }, + "node_modules/@babel/types": { + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.7.tgz", + "integrity": "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==", + "license": "MIT", + "peer": true, + "dependencies": { + "@babel/helper-string-parser": "^7.29.7", + "@babel/helper-validator-identifier": "^7.29.7" + }, + "engines": { + "node": ">=6.9.0" + } + }, "node_modules/@cspotcode/source-map-support": { "version": "0.8.1", "resolved": "https://registry.npmjs.org/@cspotcode/source-map-support/-/source-map-support-0.8.1.tgz", @@ -907,11 +958,54 @@ "url": "https://github.com/chalk/strip-ansi?sponsor=1" } }, + "node_modules/@jridgewell/gen-mapping": { + "version": "0.3.13", + "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz", + "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==", + "license": "MIT", + "peer": true, + "dependencies": { + "@jridgewell/sourcemap-codec": "^1.5.0", + "@jridgewell/trace-mapping": "^0.3.24" + } + }, + "node_modules/@jridgewell/gen-mapping/node_modules/@jridgewell/trace-mapping": { + "version": "0.3.31", + "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz", + "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==", + "license": "MIT", + "peer": true, + "dependencies": { + "@jridgewell/resolve-uri": "^3.1.0", + "@jridgewell/sourcemap-codec": "^1.4.14" + } + }, + "node_modules/@jridgewell/remapping": { + "version": "2.3.5", + "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz", + "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==", + "license": "MIT", + "peer": true, + "dependencies": { + "@jridgewell/gen-mapping": "^0.3.5", + "@jridgewell/trace-mapping": "^0.3.24" + } + }, + "node_modules/@jridgewell/remapping/node_modules/@jridgewell/trace-mapping": { + "version": "0.3.31", + "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz", + "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==", + "license": "MIT", + "peer": true, + "dependencies": { + "@jridgewell/resolve-uri": "^3.1.0", + "@jridgewell/sourcemap-codec": "^1.4.14" + } + }, "node_modules/@jridgewell/resolve-uri": { "version": "3.1.2", "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz", "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==", - "dev": true, "license": "MIT", "engines": { "node": ">=6.0.0" @@ -921,7 +1015,6 @@ "version": "1.5.5", "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz", "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==", - "dev": true, "license": "MIT" }, "node_modules/@jridgewell/trace-mapping": { @@ -1175,6 +1268,16 @@ "node": ">=14.0.0" } }, + "node_modules/@sveltejs/acorn-typescript": { + "version": "1.0.11", + "resolved": "https://registry.npmjs.org/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.11.tgz", + "integrity": "sha512-LFuZUkjJ9iF7JZye/aG5XM0SFcQ5VyL0oVX4WJ9dc0Va3R3s0OauX1BESVCb+YN/ol8TAfqGDDAQsTG627Y5kw==", + "license": "MIT", + "peer": true, + "peerDependencies": { + "acorn": "^8.9.0" + } + }, "node_modules/@tsconfig/node10": { "version": "1.0.12", "resolved": "https://registry.npmjs.org/@tsconfig/node10/-/node10-1.0.12.tgz", @@ -1238,6 +1341,13 @@ "integrity": "sha512-xFdR6tkm0MWvBfO8xXCSsinYxHcqkQUlcHeSpMC2ukzOb6lwQAfDmW+Qt0AvlGd8HpsS28qKsB+oPeJn9I39jg==", "license": "MIT" }, + "node_modules/@types/estree": { + "version": "1.0.9", + "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz", + "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==", + "license": "MIT", + "peer": true + }, "node_modules/@types/express": { "version": "4.17.25", "resolved": "https://registry.npmjs.org/@types/express/-/express-4.17.25.tgz", @@ -1375,6 +1485,13 @@ "@types/node": "*" } }, + "node_modules/@types/trusted-types": { + "version": "2.0.7", + "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz", + "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==", + "license": "MIT", + "peer": true + }, "node_modules/@types/uuid": { "version": "9.0.8", "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-9.0.8.tgz", @@ -1603,6 +1720,115 @@ "node": ">=20.0.0" } }, + "node_modules/@vue/compiler-core": { + "version": "3.5.39", + "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.5.39.tgz", + "integrity": "sha512-16KBTEXAJCpDr0mwlw+AZyhu8iyC7R3S2vBwsI7QnWJU6X3WKc9VKeNEZpiMdZ569qWhz9574L3vV55qRL0Vtw==", + "license": "MIT", + "peer": true, + "dependencies": { + "@babel/parser": "^7.29.7", + "@vue/shared": "3.5.39", + "entities": "^7.0.1", + "estree-walker": "^2.0.2", + "source-map-js": "^1.2.1" + } + }, + "node_modules/@vue/compiler-dom": { + "version": "3.5.39", + "resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.5.39.tgz", + "integrity": "sha512-oQPigALqYbNxTNPvNgSOe+czwVExfbVF02lz8jP0S3AXJiu3jxYDygNUiqSep4ezzW8XgnubqH63My2A7JR/vg==", + "license": "MIT", + "peer": true, + "dependencies": { + "@vue/compiler-core": "3.5.39", + "@vue/shared": "3.5.39" + } + }, + "node_modules/@vue/compiler-sfc": { + "version": "3.5.39", + "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.5.39.tgz", + "integrity": "sha512-d0ki86iOyN8LoZPBmk5SJWNwHP19CnDDCfuo//+2WJa2g5Ke0Jay983PIBIcSSzldC68I8DrD5GrHV3OSDfodg==", + "license": "MIT", + "peer": true, + "dependencies": { + "@babel/parser": "^7.29.7", + "@vue/compiler-core": "3.5.39", + "@vue/compiler-dom": "3.5.39", + "@vue/compiler-ssr": "3.5.39", + "@vue/shared": "3.5.39", + "estree-walker": "^2.0.2", + "magic-string": "^0.30.21", + "postcss": "^8.5.15", + "source-map-js": "^1.2.1" + } + }, + "node_modules/@vue/compiler-ssr": { + "version": "3.5.39", + "resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.5.39.tgz", + "integrity": "sha512-Ce7/wvwMHai74bdszfXExdazFigYnlF9zgCmEQUcM1j0fOymlouZ7XilTYNo8oUjhlnjYOZbGrcYKuqjz89Ucw==", + "license": "MIT", + "peer": true, + "dependencies": { + "@vue/compiler-dom": "3.5.39", + "@vue/shared": "3.5.39" + } + }, + "node_modules/@vue/reactivity": { + "version": "3.5.39", + "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.5.39.tgz", + "integrity": "sha512-TpsuBJ9gGlZa5d23XcM2y8EXanz9dZeVDQBXRwzy46ItgvM+rWpzs+UVM0wcRLxGvcav0HE5jz2gNL53xlRAog==", + "license": "MIT", + "peer": true, + "dependencies": { + "@vue/shared": "3.5.39" + } + }, + "node_modules/@vue/runtime-core": { + "version": "3.5.39", + "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.5.39.tgz", + "integrity": "sha512-9GLtNyRvPAUMbX+7ono0RC2j0guo2LXVi8LvcmAooImACUKm0oFf0jjwbX8/H0AE/t1nxhAkn8RSl9PMCzzxZw==", + "license": "MIT", + "peer": true, + "dependencies": { + "@vue/reactivity": "3.5.39", + "@vue/shared": "3.5.39" + } + }, + "node_modules/@vue/runtime-dom": { + "version": "3.5.39", + "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.5.39.tgz", + "integrity": "sha512-7Y6aAGboKcXAZ3ECuUy7RrS5yy2r47dhTp2SKaJmYxjopImaVFaNa5Ne66NwGovsrxVAl5S5rwc7m22UG7Lmww==", + "license": "MIT", + "peer": true, + "dependencies": { + "@vue/reactivity": "3.5.39", + "@vue/runtime-core": "3.5.39", + "@vue/shared": "3.5.39", + "csstype": "^3.2.3" + } + }, + "node_modules/@vue/server-renderer": { + "version": "3.5.39", + "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.5.39.tgz", + "integrity": "sha512-yZSakiAGw85rZfG7UM8akMnIF+FmeiNk47uvHf2nVBBSe+dIKUhZuZq9+XgJhbV3nS5Z4ALH23/MpXofW+mbcw==", + "license": "MIT", + "peer": true, + "dependencies": { + "@vue/compiler-ssr": "3.5.39", + "@vue/shared": "3.5.39" + }, + "peerDependencies": { + "vue": "3.5.39" + } + }, + "node_modules/@vue/shared": { + "version": "3.5.39", + "resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.5.39.tgz", + "integrity": "sha512-l1rrBtBfTnmxvtsvdQDXltUUy8S1Y+ZaqdfUzmAnJkTd8Z8rv5v/ytW+TKiqEOWyHPoqtPlNFSs0lhRmYVSHVA==", + "license": "MIT", + "peer": true + }, "node_modules/abort-controller": { "version": "3.0.0", "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz", @@ -1632,7 +1858,6 @@ "version": "8.16.0", "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz", "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==", - "dev": true, "license": "MIT", "bin": { "acorn": "bin/acorn" @@ -1813,6 +2038,16 @@ "dev": true, "license": "Python-2.0" }, + "node_modules/aria-query": { + "version": "5.3.1", + "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.1.tgz", + "integrity": "sha512-Z/ZeOgVl7bcSYZ/u/rh0fOpvEpq//LZmdbkXyc7syVzjPAhfOa9ebsdTSjEBDU4vs5nC98Kfduj1uFo0qyET3g==", + "license": "Apache-2.0", + "peer": true, + "engines": { + "node": ">= 0.4" + } + }, "node_modules/array-buffer-byte-length": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/array-buffer-byte-length/-/array-buffer-byte-length-1.0.2.tgz", @@ -2004,6 +2239,16 @@ "proxy-from-env": "^2.1.0" } }, + "node_modules/axobject-query": { + "version": "4.1.0", + "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz", + "integrity": "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==", + "license": "Apache-2.0", + "peer": true, + "engines": { + "node": ">= 0.4" + } + }, "node_modules/balanced-match": { "version": "4.0.4", "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", @@ -2299,6 +2544,16 @@ "node": ">= 6" } }, + "node_modules/clsx": { + "version": "2.1.1", + "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz", + "integrity": "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==", + "license": "MIT", + "peer": true, + "engines": { + "node": ">=6" + } + }, "node_modules/color-convert": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz", @@ -2430,6 +2685,13 @@ "node": ">= 8" } }, + "node_modules/csstype": { + "version": "3.2.3", + "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz", + "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==", + "license": "MIT", + "peer": true + }, "node_modules/data-view-buffer": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/data-view-buffer/-/data-view-buffer-1.0.2.tgz", @@ -2581,6 +2843,13 @@ "npm": "1.2.8000 || >= 1.4.16" } }, + "node_modules/devalue": { + "version": "5.8.1", + "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.8.1.tgz", + "integrity": "sha512-4CXDYRBGqN+57wVJkuXBYmpAVUSg3L6JAQa/DFqm238G73E1wuyc/JhGQJzN7vUf/CMphYau2zXbfWzDR5aTEw==", + "license": "MIT", + "peer": true + }, "node_modules/diff": { "version": "4.0.4", "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.4.tgz", @@ -2699,6 +2968,19 @@ "node": ">=0.10.0" } }, + "node_modules/entities": { + "version": "7.0.1", + "resolved": "https://registry.npmjs.org/entities/-/entities-7.0.1.tgz", + "integrity": "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA==", + "license": "BSD-2-Clause", + "peer": true, + "engines": { + "node": ">=0.12" + }, + "funding": { + "url": "https://github.com/fb55/entities?sponsor=1" + } + }, "node_modules/es-abstract": { "version": "1.24.2", "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.24.2.tgz", @@ -3306,6 +3588,13 @@ "url": "https://github.com/sponsors/sindresorhus" } }, + "node_modules/esm-env": { + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/esm-env/-/esm-env-1.2.2.tgz", + "integrity": "sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA==", + "license": "MIT", + "peer": true + }, "node_modules/espree": { "version": "10.4.0", "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz", @@ -3373,6 +3662,13 @@ "node": ">=4.0" } }, + "node_modules/estree-walker": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-2.0.2.tgz", + "integrity": "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==", + "license": "MIT", + "peer": true + }, "node_modules/esutils": { "version": "2.0.3", "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz", @@ -3465,6 +3761,21 @@ "url": "https://opencollective.com/express" } }, + "node_modules/express-rate-limit": { + "version": "7.5.1", + "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-7.5.1.tgz", + "integrity": "sha512-7iN8iPMDzOMHPUYllBEsQdWVB6fPDMPqwjBaFrgr4Jgr/+okjvzAy+UHlYYL/Vs0OsOrMkwS6PJDkFlJwoxUnw==", + "license": "MIT", + "engines": { + "node": ">= 16" + }, + "funding": { + "url": "https://github.com/sponsors/express-rate-limit" + }, + "peerDependencies": { + "express": ">= 4.11" + } + }, "node_modules/express/node_modules/debug": { "version": "2.6.9", "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz", @@ -4606,6 +4917,16 @@ "node": ">=8" } }, + "node_modules/is-reference": { + "version": "3.0.3", + "resolved": "https://registry.npmjs.org/is-reference/-/is-reference-3.0.3.tgz", + "integrity": "sha512-ixkJoqQvAP88E6wLydLGGqCJsrFUnqoH6HnaczB8XmDH1oaWU+xxdptvikTgaEhtZ53Ky6YXiBuUI2WXLMCwjw==", + "license": "MIT", + "peer": true, + "dependencies": { + "@types/estree": "^1.0.6" + } + }, "node_modules/is-regex": { "version": "1.2.1", "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.2.1.tgz", @@ -4887,6 +5208,13 @@ "node": ">= 0.8.0" } }, + "node_modules/locate-character": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/locate-character/-/locate-character-3.0.0.tgz", + "integrity": "sha512-SW13ws7BjaeJ6p7Q6CO2nchbYEc3X3J6WrmTTDto7yMPqVSZTUyY5Tjbid+Ab8gLnATtygYtiDIJGQRRn2ZOiA==", + "license": "MIT", + "peer": true + }, "node_modules/locate-path": { "version": "6.0.0", "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz", @@ -4917,6 +5245,16 @@ "dev": true, "license": "ISC" }, + "node_modules/magic-string": { + "version": "0.30.21", + "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz", + "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==", + "license": "MIT", + "peer": true, + "dependencies": { + "@jridgewell/sourcemap-codec": "^1.5.5" + } + }, "node_modules/make-error": { "version": "1.3.6", "resolved": "https://registry.npmjs.org/make-error/-/make-error-1.3.6.tgz", @@ -5624,6 +5962,13 @@ "url": "https://github.com/sponsors/mehmet-kozan" } }, + "node_modules/picocolors": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz", + "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==", + "license": "ISC", + "peer": true + }, "node_modules/picomatch": { "version": "4.0.4", "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz", @@ -5647,6 +5992,35 @@ "node": ">= 0.4" } }, + "node_modules/postcss": { + "version": "8.5.17", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.17.tgz", + "integrity": "sha512-J7EF+8X+CzRPaJPOv9Ck2wNWJvGnnl3PcNPAdGg6GTLjyVpyQ0yATMSXRFRV01BviT/9Gwuc3rjEyJbDJG9a4w==", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/postcss/" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/postcss" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "peer": true, + "dependencies": { + "nanoid": "^3.3.12", + "picocolors": "^1.1.1", + "source-map-js": "^1.2.1" + }, + "engines": { + "node": "^10 || ^12 || >=14" + } + }, "node_modules/prelude-ls": { "version": "1.2.1", "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz", @@ -5756,6 +6130,16 @@ "node": ">= 0.8" } }, + "node_modules/react": { + "version": "19.2.7", + "resolved": "https://registry.npmjs.org/react/-/react-19.2.7.tgz", + "integrity": "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==", + "license": "MIT", + "peer": true, + "engines": { + "node": ">=0.10.0" + } + }, "node_modules/readable-stream": { "version": "3.6.2", "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz", @@ -6293,6 +6677,16 @@ "node": ">=8" } }, + "node_modules/source-map-js": { + "version": "1.2.1", + "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz", + "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==", + "license": "BSD-3-Clause", + "peer": true, + "engines": { + "node": ">=0.10.0" + } + }, "node_modules/sswr": { "version": "2.2.0", "resolved": "https://registry.npmjs.org/sswr/-/sswr-2.2.0.tgz", @@ -6572,6 +6966,67 @@ "url": "https://github.com/sponsors/ljharb" } }, + "node_modules/svelte": { + "version": "5.56.4", + "resolved": "https://registry.npmjs.org/svelte/-/svelte-5.56.4.tgz", + "integrity": "sha512-/d0QHehmRuJW8gVz395MTkPcPozxzdjBMBE8oEYGz8O3b9KTMzzQ9ZHJQLuFKOHOPQbU6kx/X4iid/EBBzH7iw==", + "license": "MIT", + "peer": true, + "dependencies": { + "@jridgewell/remapping": "^2.3.4", + "@jridgewell/sourcemap-codec": "^1.5.0", + "@sveltejs/acorn-typescript": "^1.0.10", + "@types/estree": "^1.0.5", + "@types/trusted-types": "^2.0.7", + "acorn": "^8.12.1", + "aria-query": "5.3.1", + "axobject-query": "^4.1.0", + "clsx": "^2.1.1", + "devalue": "^5.8.1", + "esm-env": "^1.2.1", + "esrap": "^2.2.12", + "is-reference": "^3.0.3", + "locate-character": "^3.0.0", + "magic-string": "^0.30.11", + "zimmerframe": "^1.1.2" + }, + "engines": { + "node": ">=18" + } + }, + "node_modules/svelte/node_modules/@typescript-eslint/types": { + "version": "8.63.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.63.0.tgz", + "integrity": "sha512-xyLtl9DUBBFrcJS4x2pIqGLH68/tC2uOa4Z7pUteW09D3bXnnXUom4dyPikzWgB7llmIc1zoeI3aoUdC4rPK/Q==", + "license": "MIT", + "optional": true, + "peer": true, + "engines": { + "node": "^18.18.0 || ^20.9.0 || >=21.1.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/typescript-eslint" + } + }, + "node_modules/svelte/node_modules/esrap": { + "version": "2.2.13", + "resolved": "https://registry.npmjs.org/esrap/-/esrap-2.2.13.tgz", + "integrity": "sha512-m8jH5hZgJE2RRUK/jjkGPcJEDAV+dYnZYFkosQaPTcE+Yw4xynXHOo6FUdwaWBtdR3b1MMa7wEDTSHeR2VWsGA==", + "license": "MIT", + "peer": true, + "dependencies": { + "@jridgewell/sourcemap-codec": "^1.4.15" + }, + "peerDependencies": { + "@typescript-eslint/types": "^8.2.0" + }, + "peerDependenciesMeta": { + "@typescript-eslint/types": { + "optional": true + } + } + }, "node_modules/swr": { "version": "2.4.1", "resolved": "https://registry.npmjs.org/swr/-/swr-2.4.1.tgz", @@ -6860,7 +7315,7 @@ "version": "5.9.3", "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz", "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==", - "dev": true, + "devOptional": true, "license": "Apache-2.0", "bin": { "tsc": "bin/tsc", @@ -7011,6 +7466,28 @@ "node": ">= 0.8" } }, + "node_modules/vue": { + "version": "3.5.39", + "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.39.tgz", + "integrity": "sha512-xmZCYabFGcirU8r0fTuvl/LICc1OU620rnqepaJDL/a141ZigkG7AyaxQLdqJ02ZRYzWe6YPaDHeQx7MfknQfA==", + "license": "MIT", + "peer": true, + "dependencies": { + "@vue/compiler-dom": "3.5.39", + "@vue/compiler-sfc": "3.5.39", + "@vue/runtime-dom": "3.5.39", + "@vue/server-renderer": "3.5.39", + "@vue/shared": "3.5.39" + }, + "peerDependencies": { + "typescript": "*" + }, + "peerDependenciesMeta": { + "typescript": { + "optional": true + } + } + }, "node_modules/web-streams-polyfill": { "version": "4.0.0-beta.3", "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-4.0.0-beta.3.tgz", @@ -7290,6 +7767,23 @@ "url": "https://github.com/sponsors/sindresorhus" } }, + "node_modules/zimmerframe": { + "version": "1.1.4", + "resolved": "https://registry.npmjs.org/zimmerframe/-/zimmerframe-1.1.4.tgz", + "integrity": "sha512-B58NGBEoc8Y9MWWCQGl/gq9xBCe4IiKM0a2x7GZdQKOW5Exr8S1W24J6OgM1njK8xCRGvAJIL/MxXHf6SkmQKQ==", + "license": "MIT", + "peer": true + }, + "node_modules/zod": { + "version": "3.25.76", + "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz", + "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==", + "license": "MIT", + "peer": true, + "funding": { + "url": "https://github.com/sponsors/colinhacks" + } + }, "node_modules/zod-to-json-schema": { "version": "3.25.2", "resolved": "https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.2.tgz", diff --git a/namespace-notes/server/package.json b/namespace-notes/server/package.json index e7f4790..9944c83 100644 --- a/namespace-notes/server/package.json +++ b/namespace-notes/server/package.json @@ -26,6 +26,7 @@ "cors": "^2.8.5", "dotenv": "^16.4.5", "express": "^4.22.0", + "express-rate-limit": "^7.4.1", "mime": "^4.0.1", "multer": "^2.0.2", "openai": "^4.29.0", diff --git a/namespace-notes/server/src/controllers/documentController.ts b/namespace-notes/server/src/controllers/documentController.ts index a7f0214..df7c903 100644 --- a/namespace-notes/server/src/controllers/documentController.ts +++ b/namespace-notes/server/src/controllers/documentController.ts @@ -14,6 +14,7 @@ import { storageService } from "../utils/storage/storage"; import { ServerStorage } from "../utils/storage/serverStorage"; import { SpacesStorage } from "../utils/storage/spacesStorage"; import { upload } from "../utils/multer"; +import { safeJoin, sanitizeSegment } from "../utils/storage/pathSafety"; class DocumentsController { private documentModel: DocumentModel; @@ -306,10 +307,12 @@ class DocumentsController { const fileUrl = storageService.constructFileUrl(fileKey); if (storageService instanceof ServerStorage) { - // Serve the file from the local filesystem - const filePath = path.join("uploads", fileKey); + // Serve the file from the local filesystem. safeJoin rejects any + // traversal in the user-supplied namespaceId/documentId and confines + // the path to the uploads directory. + const filePath = safeJoin("uploads", namespaceId, documentId); const files = fs.readdirSync(filePath); - const firstFile = files[0]; + const firstFile = sanitizeSegment(files[0], "file name"); const fileFullPath = path.join(filePath, firstFile); res.sendFile(fileFullPath, { root: "." }); } else if (storageService instanceof SpacesStorage) { diff --git a/namespace-notes/server/src/routes/documentRoutes.ts b/namespace-notes/server/src/routes/documentRoutes.ts index 0d94aca..48701d1 100644 --- a/namespace-notes/server/src/routes/documentRoutes.ts +++ b/namespace-notes/server/src/routes/documentRoutes.ts @@ -1,9 +1,20 @@ import { Router } from "express"; +import rateLimit from "express-rate-limit"; import documentController from "../controllers/documentController"; const router = Router(); -router.post("/add", (req, res) => { +// Rate-limit routes that touch the filesystem to protect against abuse +// (e.g. rapid enumeration or upload floods against local storage). +const fileAccessLimiter = rateLimit({ + windowMs: 60 * 1000, // 1 minute + max: 60, // limit each IP to 60 requests per window + standardHeaders: true, + legacyHeaders: false, + message: { error: "Too many requests, please try again later." }, +}); + +router.post("/add", fileAccessLimiter, (req, res) => { const { namespaceId } = req.query; if (typeof namespaceId === "string" && namespaceId.startsWith("default")) { @@ -15,12 +26,25 @@ router.post("/add", (req, res) => { router.delete( "/files/delete/:namespaceId/:documentId", + fileAccessLimiter, documentController.deleteDocument ); -router.delete("/workspace/:namespaceId", documentController.deleteWorkspace); +router.delete( + "/workspace/:namespaceId", + fileAccessLimiter, + documentController.deleteWorkspace +); -router.get("/files/:namespaceId", documentController.listFilesInNamespace); -router.get("/files/:namespaceId/:documentId/(*)", documentController.serveDocument); +router.get( + "/files/:namespaceId", + fileAccessLimiter, + documentController.listFilesInNamespace +); +router.get( + "/files/:namespaceId/:documentId/(*)", + fileAccessLimiter, + documentController.serveDocument +); export default router; diff --git a/namespace-notes/server/src/utils/storage/pathSafety.ts b/namespace-notes/server/src/utils/storage/pathSafety.ts new file mode 100644 index 0000000..416a030 --- /dev/null +++ b/namespace-notes/server/src/utils/storage/pathSafety.ts @@ -0,0 +1,52 @@ +// pathSafety.ts +// +// Helpers for safely building filesystem paths from user-supplied values. +// User input (namespace ids, document ids, file names) must never be able to +// escape the intended base directory via path separators or `..` traversal. +import path from "path"; + +/** + * Validate a single user-supplied path segment (namespace id, document id, + * file name). Rejects empty values, path separators, parent-directory + * references and null bytes so that a segment can only ever name a direct + * child of its parent directory. + * + * @throws Error if the segment is not a safe, single path component. + */ +export function sanitizeSegment( + segment: string, + label = "path segment" +): string { + if (typeof segment !== "string" || segment.length === 0) { + throw new Error(`Invalid ${label}: must be a non-empty string`); + } + if ( + segment.includes("/") || + segment.includes("\\") || + segment.includes("\0") || + segment === "." || + segment === ".." + ) { + throw new Error(`Invalid ${label}: illegal path characters`); + } + return segment; +} + +/** + * Safely join user-supplied segments beneath a trusted base directory. + * + * Each segment is validated with {@link sanitizeSegment}, and the fully + * resolved path is confirmed to remain inside the base directory before being + * returned. This is the authoritative guard against path traversal. + * + * @throws Error if any segment is invalid or the result escapes `baseDir`. + */ +export function safeJoin(baseDir: string, ...segments: string[]): string { + const cleaned = segments.map((s) => sanitizeSegment(s)); + const base = path.resolve(baseDir); + const target = path.resolve(base, ...cleaned); + if (target !== base && !target.startsWith(base + path.sep)) { + throw new Error("Resolved path escapes the base directory"); + } + return target; +} diff --git a/namespace-notes/server/src/utils/storage/serverStorage.ts b/namespace-notes/server/src/utils/storage/serverStorage.ts index a63204a..b0b183e 100644 --- a/namespace-notes/server/src/utils/storage/serverStorage.ts +++ b/namespace-notes/server/src/utils/storage/serverStorage.ts @@ -2,24 +2,28 @@ import fs from "fs"; import path from "path"; import { FileDetail, StorageService } from "./storage"; +import { safeJoin, sanitizeSegment } from "./pathSafety"; export class ServerStorage implements StorageService { private readonly uploadDir = "uploads"; async saveFile(file: Express.Multer.File, fileKey: string): Promise { const [namespaceId, documentId, ...rest] = fileKey.split("/"); - const fileName = rest.join("/"); - const documentDirectory = path.join( + // Confine the file to ///. + // Any traversal in the user-supplied segments is rejected by safeJoin. + const fileName = path.basename(rest.join("/")); + const destinationPath = safeJoin( this.uploadDir, namespaceId, - documentId + documentId, + fileName ); + const documentDirectory = path.dirname(destinationPath); if (!fs.existsSync(documentDirectory)) { fs.mkdirSync(documentDirectory, { recursive: true }); } - const destinationPath = path.join(documentDirectory, fileName); await fs.promises.rename(file.path, destinationPath); } @@ -30,14 +34,15 @@ export class ServerStorage implements StorageService { } async getFilePath(fileKey: string): Promise { - const filePath = path.join(this.uploadDir, fileKey); + const segments = fileKey.split("/").filter((s) => s.length > 0); + const filePath = safeJoin(this.uploadDir, ...segments); const files = await fs.promises.readdir(filePath); - const firstFile = files[0]; + const firstFile = sanitizeSegment(files[0], "file name"); return path.join(filePath, firstFile); } async deleteWorkspaceFiles(namespaceId: string): Promise { - const namespaceDirectory = path.join(this.uploadDir, namespaceId); + const namespaceDirectory = safeJoin(this.uploadDir, namespaceId); if (fs.existsSync(namespaceDirectory)) { fs.rmdirSync(namespaceDirectory, { recursive: true }); } @@ -48,7 +53,7 @@ export class ServerStorage implements StorageService { documentId: string ): Promise { try { - const documentDirectory = path.join( + const documentDirectory = safeJoin( this.uploadDir, namespaceId, documentId @@ -63,7 +68,7 @@ export class ServerStorage implements StorageService { } async listFilesInNamespace(namespaceId: string): Promise { - const namespacePath = path.join(this.uploadDir, namespaceId); + const namespacePath = safeJoin(this.uploadDir, namespaceId); try { const documentDirs = fs .readdirSync(namespacePath, { withFileTypes: true }) @@ -72,7 +77,7 @@ export class ServerStorage implements StorageService { const allFiles: FileDetail[] = []; for (const documentId of documentDirs) { - const documentPath = path.join(namespacePath, documentId); + const documentPath = safeJoin(this.uploadDir, namespaceId, documentId); const files = fs.readdirSync(documentPath); allFiles.push( ...files.map((filename) => ({