Runner: Eingabepruefung gehaertet (R8)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

runner/src/server.js

@@ -1,7 +1,7 @@
 import http from 'node:http';
 import crypto from 'node:crypto';
 import { readFileSync } from 'node:fs';
-import { validateJob, isValidSub } from './validate.js';
+import { validateJob, isValidSub, isValidRunId } from './validate.js';
 
 const MAX_BODY = 256 * 1024;
 
@@ -63,6 +63,7 @@ export function createApiServer({ config, jobs, dev, mem = readMemAvailable }) {
         return send(res, 200, jobs.submit(v.job));
       }
       if (method === 'GET' && parts[0] === 'jobs' && parts.length === 2) {
+        if (!isValidRunId(parts[1])) return send(res, 400, { error: 'Ungültige Lauf-ID' });
         const run = jobs.get(parts[1]);
         return run ? send(res, 200, run) : send(res, 404, { error: 'Lauf nicht gefunden' });
       }
@@ -81,6 +82,7 @@ export function createApiServer({ config, jobs, dev, mem = readMemAvailable }) {
       return send(res, 404, { error: 'Nicht gefunden' });
     } catch (e) {
       const status = e.status || 500;
+      if (status >= 500) console.error('Runner-Fehler:', e);
       if (!res.headersSent) send(res, status, { error: status === 500 ? 'Interner Fehler' : e.message });
     }
   });

runner/src/validate.js

@@ -6,15 +6,16 @@ const RE_BRANCH = /^[\w./-]{1,100}$/;
 const RE_ENV = /^[A-Z_][A-Z0-9_]*$/;
 const MODES = ['auto', 'build', 'dev'];
 
+export const isValidRunId = (s) => typeof s === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s);
 export const isValidSub = (s) => typeof s === 'string' && RE_SUB.test(s);
 
 export function validateJob(body) {
   if (!body || typeof body !== 'object' || Array.isArray(body)) return { ok: false, error: 'Ungültige Anfrage' };
   const { sub, repo, sha, branch } = body;
   if (!isValidSub(sub)) return { ok: false, error: 'Ungültige Subdomain' };
-  if (typeof repo !== 'string' || !RE_REPO.test(repo)) return { ok: false, error: 'Ungültiges Repository' };
+  if (typeof repo !== 'string' || !RE_REPO.test(repo) || repo.split('/').some((x) => x === '.' || x === '..' || x.startsWith('-'))) return { ok: false, error: 'Ungültiges Repository' };
   if (typeof sha !== 'string' || !RE_SHA.test(sha)) return { ok: false, error: 'Ungültiger Commit' };
-  if (typeof branch !== 'string' || !RE_BRANCH.test(branch) || branch.includes('..')) return { ok: false, error: 'Ungültiger Branch' };
+  if (typeof branch !== 'string' || !RE_BRANCH.test(branch) || branch.startsWith('-') || branch.includes('..') || branch.endsWith('/') || branch.endsWith('.lock')) return { ok: false, error: 'Ungültiger Branch' };
   const mode = body.mode === undefined || body.mode === '' ? 'auto' : body.mode;
   if (!MODES.includes(mode)) return { ok: false, error: 'Ungültiger Modus' };
   let index;
@@ -37,7 +38,8 @@ export function validateJob(body) {
       env[n] = v;
     }
   }
-  const job = { ...body, sub, repo, sha, branch, mode, env };
-  if (index !== undefined) job.index = index; else delete job.index;
+  // Whitelist: keine ungeprüften Client-Felder im Job
+  const job = { sub, repo, sha, branch, mode, env };
+  if (index !== undefined) job.index = index;
   return { ok: true, job };
 }