mirror of
https://github.com/hansjone/oclaw.git
synced 2026-10-12 16:33:22 +08:00
oliver
df97c5e042
Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw "sign-in failed / add API key" on DSH Desktop because the remote.mux opens anonymously at boot and every early call was rejected terminally. - gateway: anonymous workspace/follow reaches dsh-acl's empty baseline; anonymous streams are parked until the carrier aborts instead of failing; anonymous workspace/initializeDefault answers "nothing created" - request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket or bridge (sync + async variants used by all callers) - dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup instead of 403, so the Desktop welcome read no longer fails - desktop-bootstrap: key/account projection is best-effort per reference - client: emit connection/reset after login so boot-time caches (settings describe mirror -> Settings > Models) re-read under the real principal - sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min); bridge expiry slides with its session; MemoryStore persisted to sessions.json (bearer hash only, userData AES-256-GCM sealed) - README: session lifetime/persistence and DSH compatibility notes Also includes previously uncommitted uds-auth 0.3.x work in this tree. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
52 lines
1.5 KiB
JavaScript
52 lines
1.5 KiB
JavaScript
/**
|
|
* SEC-14: normalize empNo / user directory segment — reject path semantics.
|
|
*/
|
|
import { resolve, join, sep } from 'node:path'
|
|
|
|
const MAX_LEN = 64
|
|
const SAFE_RE = /^[A-Za-z0-9._@+-]+$/
|
|
const WIN_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i
|
|
|
|
/**
|
|
* @param {unknown} empNo
|
|
* @returns {string|null} sanitized id or null if rejected
|
|
*/
|
|
export function sanitizeUserId(empNo) {
|
|
if (empNo == null) return null
|
|
const s = String(empNo).trim()
|
|
if (!s || s.length > MAX_LEN) return null
|
|
if (s.includes('\0') || s.includes('..') || s.includes('/') || s.includes('\\') || s.includes(':')) {
|
|
return null
|
|
}
|
|
if (!SAFE_RE.test(s)) return null
|
|
if (WIN_RESERVED.test(s)) return null
|
|
return s
|
|
}
|
|
|
|
/**
|
|
* Resolve user workspace directory under root; returns null if escape would occur.
|
|
* @param {string} workspaceRootAbs
|
|
* @param {string} empNo
|
|
* @returns {string|null}
|
|
*/
|
|
export function resolveUserDir(workspaceRootAbs, empNo) {
|
|
const safe = sanitizeUserId(empNo)
|
|
if (!safe) return null
|
|
const root = resolve(String(workspaceRootAbs))
|
|
const userPath = resolve(join(root, safe))
|
|
if (userPath !== root && !userPath.startsWith(root + sep)) return null
|
|
return userPath
|
|
}
|
|
|
|
/**
|
|
* True when candidate is equal to or under base (after resolve).
|
|
*/
|
|
export function isPathInside(baseAbs, candidateAbs) {
|
|
try {
|
|
const base = resolve(String(baseAbs))
|
|
const cand = resolve(String(candidateAbs))
|
|
return cand === base || cand.startsWith(base + sep)
|
|
} catch {
|
|
return false
|
|
}
|
|
}
|