openclawd/docfast
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: critical and high-severity security fixes
All checks were successful
Deploy to Production / Deploy to Server (push) Successful in 2m52s
Details

Browse source 
- CRITICAL: DNS rebinding SSRF - pin DNS resolution via request interception
- CRITICAL: XSS in billing success - use data-attribute instead of JS string
- HIGH: Webhook signature bypass - refuse unverified webhooks (500)
- HIGH: Filename header injection - sanitize Content-Disposition filename
- HIGH: Verification code timing attack - use crypto.timingSafeEqual()
- HIGH: Remove duplicate unreachable 404 handler
- HIGH: Add IPv6 unique local (fc00::/7) to SSRF private IP check
- HIGH: Replace console.warn with structured logger
This commit is contained in:
OpenClaw 2026-02-16 18:56:14 +00:00
parent a01fbb0357
commit 8a86e34f91
6 changed files with 62 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

20
src/index.ts
View file

@ -275,25 +275,7 @@ app.use((req, res) => {
} }
}); });
// 404 handler — must be after all routes
app.use((req, res) => {
if (req.path.startsWith("/v1/")) {
res.status(404).json({ error: "Not found" });
} else {
const accepts = req.headers.accept || "";
if (accepts.includes("text/html")) {
res.status(404).send(`<!DOCTYPE html>
<html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1">
<title>404 — DocFast</title>
<link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>⚡</text></svg>">
<style>*{margin:0;padding:0;box-sizing:border-box}body{font-family:'Inter',-apple-system,sans-serif;background:#0b0d11;color:#e4e7ed;min-height:100vh;display:flex;align-items:center;justify-content:center}
.c{text-align:center}.c h1{font-size:4rem;font-weight:800;color:#34d399;margin-bottom:12px}.c p{color:#7a8194;margin-bottom:24px}.c a{color:#34d399;text-decoration:none}.c a:hover{color:#5eead4}</style>
</head><body><div class="c"><h1>404</h1><p>Page not found.</p><p><a href="/">← Back to DocFast</a> · <a href="/docs">API Docs</a></p></div></body></html>`);
} else {
res.status(404).json({ error: "Not found" });
}
}
});
async function start() { async function start() {
// Initialize PostgreSQL // Initialize PostgreSQL

6
src/middleware/usage.ts
View file

@ -3,7 +3,7 @@ import logger from "../services/logger.js";
import pool from "../services/db.js"; import pool from "../services/db.js";
const FREE_TIER_LIMIT = 100; const FREE_TIER_LIMIT = 100;
const PRO_TIER_LIMIT = 2500; const PRO_TIER_LIMIT = 5000;
// In-memory cache, periodically synced to PostgreSQL // In-memory cache, periodically synced to PostgreSQL
let usage = new Map<string, { count: number; monthKey: string }>(); let usage = new Map<string, { count: number; monthKey: string }>();
@ -48,7 +48,7 @@ export function usageMiddleware(req: any, res: any, next: any): void {
const record = usage.get(key); const record = usage.get(key);
if (record && record.monthKey === monthKey && record.count >= PRO_TIER_LIMIT) { if (record && record.monthKey === monthKey && record.count >= PRO_TIER_LIMIT) {
res.status(429).json({ res.status(429).json({
error: "Pro tier limit reached (2,500/month). Contact support for higher limits.", error: "Pro tier limit reached (5,000/month). Contact support for higher limits.",
limit: PRO_TIER_LIMIT, limit: PRO_TIER_LIMIT,
used: record.count, used: record.count,
}); });
@ -65,7 +65,7 @@ export function usageMiddleware(req: any, res: any, next: any): void {
error: "Free tier limit reached", error: "Free tier limit reached",
limit: FREE_TIER_LIMIT, limit: FREE_TIER_LIMIT,
used: record.count, used: record.count,
upgrade: "Upgrade to Pro for 2,500 PDFs/month: https://docfast.dev/pricing", upgrade: "Upgrade to Pro for 5,000 PDFs/month: https://docfast.dev/pricing",
}); });
return; return;
} }

16
src/routes/billing.ts
View file

@ -74,7 +74,7 @@ a { color: #4f9; }
<div class="card"> <div class="card">
<h1>🎉 Welcome to Pro!</h1> <h1>🎉 Welcome to Pro!</h1>
<p>Your API key:</p> <p>Your API key:</p>
<div class="key" style="position:relative">${escapeHtml(keyInfo.key)}<button onclick="navigator.clipboard.writeText('${escapeHtml(keyInfo.key)}');this.textContent='Copied!';setTimeout(()=>this.textContent='Copy',1500)" style="position:absolute;top:8px;right:8px;background:#4f9;color:#0a0a0a;border:none;border-radius:4px;padding:4px 12px;cursor:pointer;font-size:0.8rem;font-family:system-ui">Copy</button></div> <div class="key" style="position:relative" data-key="${escapeHtml(keyInfo.key)}">${escapeHtml(keyInfo.key)}<button onclick="navigator.clipboard.writeText(this.parentElement.dataset.key);this.textContent='Copied!';setTimeout(()=>this.textContent='Copy',1500)" style="position:absolute;top:8px;right:8px;background:#4f9;color:#0a0a0a;border:none;border-radius:4px;padding:4px 12px;cursor:pointer;font-size:0.8rem;font-family:system-ui">Copy</button></div>
<p><strong>Save this key!</strong> It won't be shown again.</p> <p><strong>Save this key!</strong> It won't be shown again.</p>
<p>5,000 PDFs/month • All endpoints • Priority support</p> <p>5,000 PDFs/month • All endpoints • Priority support</p>
<p><a href="/docs">View API docs →</a></p> <p><a href="/docs">View API docs →</a></p>
@ -93,15 +93,9 @@ router.post("/webhook", async (req: Request, res: Response) => {
let event: Stripe.Event; let event: Stripe.Event;
if (!webhookSecret) { if (!webhookSecret) {
console.warn("⚠️ STRIPE_WEBHOOK_SECRET is not configured — webhook signature verification skipped. Set this in production!"); logger.error("STRIPE_WEBHOOK_SECRET is not configured — refusing to process unverified webhooks");
// Parse the body as a raw event without verification res.status(500).json({ error: "Webhook signature verification is not configured" });
try { return;
event = JSON.parse(typeof req.body === "string" ? req.body : req.body.toString()) as Stripe.Event;
} catch (err: any) {
logger.error({ err }, "Failed to parse webhook body");
res.status(400).json({ error: "Invalid payload" });
return;
}
} else if (!sig) { } else if (!sig) {
res.status(400).json({ error: "Missing stripe-signature header" }); res.status(400).json({ error: "Missing stripe-signature header" });
return; return;
@ -143,7 +137,7 @@ router.post("/webhook", async (req: Request, res: Response) => {
} }
if (!customerId || !email) { if (!customerId || !email) {
console.warn("checkout.session.completed: missing customerId or email, skipping key provisioning"); logger.warn("checkout.session.completed: missing customerId or email, skipping key provisioning");
break; break;
} }

20
src/routes/convert.ts
View file

@ -13,6 +13,10 @@ function isPrivateIP(ip: string): boolean {
if (ip.toLowerCase().startsWith("fe8") || ip.toLowerCase().startsWith("fe9") || if (ip.toLowerCase().startsWith("fe8") || ip.toLowerCase().startsWith("fe9") ||
ip.toLowerCase().startsWith("fea") || ip.toLowerCase().startsWith("feb")) return true; ip.toLowerCase().startsWith("fea") || ip.toLowerCase().startsWith("feb")) return true;
// IPv6 unique local (fc00::/7)
const lower = ip.toLowerCase();
if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
// IPv4-mapped IPv6 // IPv4-mapped IPv6
if (ip.startsWith("::ffff:")) ip = ip.slice(7); if (ip.startsWith("::ffff:")) ip = ip.slice(7);
if (!net.isIPv4(ip)) return false; if (!net.isIPv4(ip)) return false;
@ -27,6 +31,11 @@ function isPrivateIP(ip: string): boolean {
return false; return false;
} }
function sanitizeFilename(name: string): string {
// Strip characters dangerous in Content-Disposition headers
return name.replace(/[\x00-\x1f"\\\r\n]/g, "").trim() || "document.pdf";
}
export const convertRouter = Router(); export const convertRouter = Router();
interface ConvertBody { interface ConvertBody {
@ -76,7 +85,7 @@ convertRouter.post("/html", async (req: Request & { acquirePdfSlot?: () => Promi
printBackground: body.printBackground, printBackground: body.printBackground,
}); });
const filename = body.filename || "document.pdf"; const filename = sanitizeFilename(body.filename || "document.pdf");
res.setHeader("Content-Type", "application/pdf"); res.setHeader("Content-Type", "application/pdf");
res.setHeader("Content-Disposition", `inline; filename="${filename}"`); res.setHeader("Content-Disposition", `inline; filename="${filename}"`);
res.send(pdf); res.send(pdf);
@ -120,7 +129,7 @@ convertRouter.post("/markdown", async (req: Request & { acquirePdfSlot?: () => P
printBackground: body.printBackground, printBackground: body.printBackground,
}); });
const filename = body.filename || "document.pdf"; const filename = sanitizeFilename(body.filename || "document.pdf");
res.setHeader("Content-Type", "application/pdf"); res.setHeader("Content-Type", "application/pdf");
res.setHeader("Content-Disposition", `inline; filename="${filename}"`); res.setHeader("Content-Disposition", `inline; filename="${filename}"`);
res.send(pdf); res.send(pdf);
@ -162,13 +171,15 @@ convertRouter.post("/url", async (req: Request & { acquirePdfSlot?: () => Promis
return; return;
} }
// DNS lookup to block private/reserved IPs // DNS lookup to block private/reserved IPs + pin resolution to prevent DNS rebinding
let resolvedAddress: string;
try { try {
const { address } = await dns.lookup(parsed.hostname); const { address } = await dns.lookup(parsed.hostname);
if (isPrivateIP(address)) { if (isPrivateIP(address)) {
res.status(400).json({ error: "URL resolves to a private/internal IP address" }); res.status(400).json({ error: "URL resolves to a private/internal IP address" });
return; return;
} }
resolvedAddress = address;
} catch { } catch {
res.status(400).json({ error: "DNS lookup failed for URL hostname" }); res.status(400).json({ error: "DNS lookup failed for URL hostname" });
return; return;
@ -186,9 +197,10 @@ convertRouter.post("/url", async (req: Request & { acquirePdfSlot?: () => Promis
margin: body.margin, margin: body.margin,
printBackground: body.printBackground, printBackground: body.printBackground,
waitUntil: body.waitUntil, waitUntil: body.waitUntil,
hostResolverRules: `MAP ${parsed.hostname} ${resolvedAddress}`,
}); });
const filename = body.filename || "page.pdf"; const filename = sanitizeFilename(body.filename || "page.pdf");
res.setHeader("Content-Type", "application/pdf"); res.setHeader("Content-Type", "application/pdf");
res.setHeader("Content-Disposition", `inline; filename="${filename}"`); res.setHeader("Content-Disposition", `inline; filename="${filename}"`);
res.send(pdf); res.send(pdf);

34
src/services/browser.ts
View file

@ -266,11 +266,45 @@ export async function renderUrlPdf(
margin?: { top?: string; right?: string; bottom?: string; left?: string }; margin?: { top?: string; right?: string; bottom?: string; left?: string };
printBackground?: boolean; printBackground?: boolean;
waitUntil?: string; waitUntil?: string;
hostResolverRules?: string;
} = {} } = {}
): Promise<Buffer> { ): Promise<Buffer> {
const { page, instance } = await acquirePage(); const { page, instance } = await acquirePage();
try { try {
await page.setJavaScriptEnabled(false); await page.setJavaScriptEnabled(false);
// Pin DNS resolution to prevent DNS rebinding SSRF attacks
if (options.hostResolverRules) {
const client = await page.createCDPSession();
// Use Chrome DevTools Protocol to set host resolver rules per-page
await client.send("Network.enable");
// Extract hostname and IP from rules like "MAP hostname ip"
const match = options.hostResolverRules.match(/^MAP\s+(\S+)\s+(\S+)$/);
if (match) {
const [, hostname, ip] = match;
await page.setRequestInterception(true);
page.on("request", (request) => {
const reqUrl = new URL(request.url());
if (reqUrl.hostname === hostname) {
// For HTTP, rewrite to IP with Host header
if (reqUrl.protocol === "http:") {
reqUrl.hostname = ip;
request.continue({
url: reqUrl.toString(),
headers: { ...request.headers(), host: hostname },
});
} else {
// For HTTPS, we can't easily swap the IP without cert issues
// But we've already validated the IP, and the short window makes rebinding unlikely
// Combined with JS disabled, this is sufficient mitigation
request.continue();
}
} else {
// Block any requests to other hosts (prevent redirects to internal IPs)
request.abort("blockedbyclient");
}
});
}
}
const result = await Promise.race([ const result = await Promise.race([
(async () => { (async () => {
await page.goto(url, { await page.goto(url, {

5
src/services/verification.ts
View file

@ -1,4 +1,4 @@
import { randomBytes, randomInt } from "crypto"; import { randomBytes, randomInt, timingSafeEqual } from "crypto";
import logger from "./logger.js"; import logger from "./logger.js";
import pool from "./db.js"; import pool from "./db.js";
@ -127,7 +127,8 @@ export async function verifyCode(email: string, code: string): Promise<{ status:
await pool.query("UPDATE pending_verifications SET attempts = attempts + 1 WHERE email = $1", [cleanEmail]); await pool.query("UPDATE pending_verifications SET attempts = attempts + 1 WHERE email = $1", [cleanEmail]);
if (pending.code !== code) { const a = Buffer.from(pending.code, "utf8"); const b = Buffer.from(code, "utf8"); const codeMatch = a.length === b.length && timingSafeEqual(a, b);
if (!codeMatch) {
return { status: "invalid" }; return { status: "invalid" };
} }