From 8588e63124831eb37c562ab6258f9804254e0bfa Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 30 Sep 2026 19:45:49 +0000 Subject: [PATCH] Runner: Eingabepruefung gehaertet (R8) Co-Authored-By: Claude Sonnet 5.5 --- runner/src/server.js | 4 +++- runner/src/validate.js | 10 ++++++---- runner/test/server.test.js | 23 +++++++++++++++++++---- 3 files changed, 28 insertions(+), 9 deletions(-) diff --git a/runner/src/server.js b/runner/src/server.js index 992dd75..c22bd72 100644 --- a/runner/src/server.js +++ b/runner/src/server.js @@ -1,7 +1,7 @@ import http from 'node:http'; import crypto from 'node:crypto'; import { readFileSync } from 'node:fs'; -import { validateJob, isValidSub } from './validate.js'; +import { validateJob, isValidSub, isValidRunId } from './validate.js'; const MAX_BODY = 256 * 1024; @@ -63,6 +63,7 @@ export function createApiServer({ config, jobs, dev, mem = readMemAvailable }) { return send(res, 200, jobs.submit(v.job)); } if (method === 'GET' && parts[0] === 'jobs' && parts.length === 2) { + if (!isValidRunId(parts[1])) return send(res, 400, { error: 'Ungültige Lauf-ID' }); const run = jobs.get(parts[1]); return run ? send(res, 200, run) : send(res, 404, { error: 'Lauf nicht gefunden' }); } @@ -81,6 +82,7 @@ export function createApiServer({ config, jobs, dev, mem = readMemAvailable }) { return send(res, 404, { error: 'Nicht gefunden' }); } catch (e) { const status = e.status || 500; + if (status >= 500) console.error('Runner-Fehler:', e); if (!res.headersSent) send(res, status, { error: status === 500 ? 'Interner Fehler' : e.message }); } }); diff --git a/runner/src/validate.js b/runner/src/validate.js index 7846731..d568abb 100644 --- a/runner/src/validate.js +++ b/runner/src/validate.js @@ -6,15 +6,16 @@ const RE_BRANCH = /^[\w./-]{1,100}$/; const RE_ENV = /^[A-Z_][A-Z0-9_]*$/; const MODES = ['auto', 'build', 'dev']; +export const isValidRunId = (s) => typeof s === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s); export const isValidSub = (s) => typeof s === 'string' && RE_SUB.test(s); export function validateJob(body) { if (!body || typeof body !== 'object' || Array.isArray(body)) return { ok: false, error: 'Ungültige Anfrage' }; const { sub, repo, sha, branch } = body; if (!isValidSub(sub)) return { ok: false, error: 'Ungültige Subdomain' }; - if (typeof repo !== 'string' || !RE_REPO.test(repo)) return { ok: false, error: 'Ungültiges Repository' }; + if (typeof repo !== 'string' || !RE_REPO.test(repo) || repo.split('/').some((x) => x === '.' || x === '..' || x.startsWith('-'))) return { ok: false, error: 'Ungültiges Repository' }; if (typeof sha !== 'string' || !RE_SHA.test(sha)) return { ok: false, error: 'Ungültiger Commit' }; - if (typeof branch !== 'string' || !RE_BRANCH.test(branch) || branch.includes('..')) return { ok: false, error: 'Ungültiger Branch' }; + if (typeof branch !== 'string' || !RE_BRANCH.test(branch) || branch.startsWith('-') || branch.includes('..') || branch.endsWith('/') || branch.endsWith('.lock')) return { ok: false, error: 'Ungültiger Branch' }; const mode = body.mode === undefined || body.mode === '' ? 'auto' : body.mode; if (!MODES.includes(mode)) return { ok: false, error: 'Ungültiger Modus' }; let index; @@ -37,7 +38,8 @@ export function validateJob(body) { env[n] = v; } } - const job = { ...body, sub, repo, sha, branch, mode, env }; - if (index !== undefined) job.index = index; else delete job.index; + // Whitelist: keine ungeprüften Client-Felder im Job + const job = { sub, repo, sha, branch, mode, env }; + if (index !== undefined) job.index = index; return { ok: true, job }; } diff --git a/runner/test/server.test.js b/runner/test/server.test.js index a404ddd..ac98224 100644 --- a/runner/test/server.test.js +++ b/runner/test/server.test.js @@ -9,10 +9,11 @@ import { validateJob } from '../src/validate.js'; const config = { ...loadConfig({ PREVIEW_RUNNER_TOKEN: 'geheim' }) }; +const RID = '123e4567-e89b-42d3-a456-426614174000'; const submitted = []; const jobs = { - submit: (j) => { submitted.push(j); return { runId: 'r1' }; }, - get: (id) => (id === 'r1' ? { runId: 'r1', state: 'building' } : null), + submit: (j) => { submitted.push(j); return { runId: RID }; }, + get: (id) => (id === RID ? { runId: RID, state: 'building' } : null), queueLength: () => 0, }; const stopped = []; @@ -73,7 +74,7 @@ test('POST /jobs/build: 400 bei ungültiger Eingabe, 200 bei gültiger', async ( } const ok = await fetch(`${base}/jobs/build`, { method: 'POST', headers: auth, body: JSON.stringify(good) }); assert.equal(ok.status, 200); - assert.deepEqual(await ok.json(), { runId: 'r1' }); + assert.deepEqual(await ok.json(), { runId: RID }); assert.equal(submitted[0].sub, 'demo'); const nojson = await fetch(`${base}/jobs/build`, { method: 'POST', headers: auth, body: '{kaputt' }); assert.equal(nojson.status, 400); @@ -83,7 +84,7 @@ test('POST /jobs/build: 400 bei ungültiger Eingabe, 200 bei gültiger', async ( test('GET /jobs/:runId, Dev-Start/Stop', async () => { await withServer(config, async (base) => { assert.equal((await fetch(`${base}/jobs/r1`, { headers: auth })).status, 200); - assert.equal((await fetch(`${base}/jobs/nix`, { headers: auth })).status, 404); + assert.equal((await fetch(`${base}/jobs/223e4567-e89b-42d3-a456-426614174000`, { headers: auth })).status, 404); const s = await fetch(`${base}/dev/demo/start`, { method: 'POST', headers: auth, body: JSON.stringify(good) }); assert.equal(s.status, 200); assert.equal((await fetch(`${base}/dev/..x/start`, { method: 'POST', headers: auth, body: JSON.stringify(good) })).status, 400); @@ -113,6 +114,20 @@ test('validateJob: env, index, mode', () => { assert.equal(validateJob(null).ok, false); }); +test('R8: Repo/Branch-Härtung, Whitelist, Sub, Lauf-ID', async () => { + for (const repo of ['../..', './.', '-x/y', 'a/..']) assert.equal(validateJob({ ...good, repo }).ok, false, repo); + for (const branch of ['-x', '--upload-pack=x', 'a..b', 'x.lock', 'x/']) assert.equal(validateJob({ ...good, branch }).ok, false, branch); + const v = validateJob({ ...good, devCmd: 'rm -rf /', image: 'evil' }); + assert.equal(v.ok, true); + assert.deepEqual(Object.keys(v.job).sort(), ['branch', 'env', 'mode', 'repo', 'sha', 'sub']); + assert.equal(validateJob({ ...good, sub: 'demo\n' }).ok, false); + await withServer(config, async (base) => { + const r = await fetch(`${base}/dev/demo/start`, { method: 'POST', headers: auth, body: JSON.stringify({ ...good, sub: 'other' }) }); + assert.equal(r.status, 400); + assert.equal((await fetch(`${base}/jobs/not-a-uuid`, { headers: auth })).status, 400); + }); +}); + test('readMemAvailable liest MemAvailable in Bytes', () => { const p = join(mkdtempSync(join(tmpdir(), 'mem-')), 'meminfo'); writeFileSync(p, 'MemTotal: 8000000 kB\nMemFree: 100000 kB\nMemAvailable: 2048000 kB\n');