${esc(clip.title)}
${esc(clip.blurb)}
diff --git a/packages/server/src/index.ts b/packages/server/src/index.ts index 8e0c0dd..6b29495 100644 --- a/packages/server/src/index.ts +++ b/packages/server/src/index.ts @@ -31,7 +31,7 @@ // {type:"error", message} import * as Sentry from "@sentry/node"; -import { createServer } from "node:http"; +import { createServer, type IncomingMessage, type ServerResponse } from "node:http"; import { randomBytes } from "node:crypto"; import { readFileSync, existsSync, realpathSync, statSync, createReadStream } from "node:fs"; import { extname, join, normalize, sep } from "node:path"; @@ -65,7 +65,7 @@ import { abandonRoom, } from "./rooms"; import { engagementStats, recordHotseat } from "./stats"; -import { appendFeedback, readFeedback, readClips, clipAssetPath } from "./store"; +import { appendFeedback, readFeedback, readClips, clipAssetPath, CLIP_SLUG } from "./store"; import { clipsIndexHtml, clipPageHtml } from "./clips"; import { SlidingLimit, clientAddress } from "./ratelimit"; import { getShare, loadShares, mintShare } from "./shares"; @@ -184,6 +184,15 @@ function ogPage(metas: string[]): string { /** Host and proto arrive from request headers — attacker-writable text * that must never reach an HTML attribute raw. */ +const noSuchClip = (res: ServerResponse) => + res.writeHead(404, { "content-type": "text/plain" }).end("no such clip — see /clips"); + +/** The absolute origin a request came in on, as the proxy saw it. */ +function requestBase(req: IncomingMessage): string { + const proto = String(req.headers["x-forwarded-proto"] ?? "http").split(",")[0]!.trim(); + return safeBase(String(req.headers.host ?? `localhost:${port}`), proto); +} + function safeBase(rawHost: string, rawProto: string): string { const proto = /^https?$/.test(rawProto) ? rawProto : "https"; return `${proto}://${escapeHtml(rawHost)}`; @@ -312,16 +321,15 @@ const httpServer = createServer((req, res) => { // with Range support — Safari refuses an mp4 whose server can't // serve bytes 0-1 on demand. if (url === "/clips" || url === "/clips/") { - const proto = String(req.headers["x-forwarded-proto"] ?? "http").split(",")[0]!.trim(); - const base = safeBase(String(req.headers.host ?? `localhost:${port}`), proto); + const base = requestBase(req); res.writeHead(200, { "content-type": "text/html", "cache-control": "no-cache" }); res.end(clipsIndexHtml(readClips(), base)); return; } - const clipAsset = url.match(/^\/clips\/([a-z0-9-]{1,70}\.(?:mp4|jpg))$/); + const clipAsset = url.match(/^\/clips\/([^/]+\.(?:mp4|jpg))$/); if (clipAsset) { const path = clipAssetPath(clipAsset[1]!); - if (!path) { res.writeHead(404).end("no such clip"); return; } + if (!path) { noSuchClip(res); return; } const size = statSync(path).size; const type = path.endsWith(".mp4") ? "video/mp4" : "image/jpeg"; const range = /^bytes=(\d*)-(\d*)$/.exec(String(req.headers.range ?? "")); @@ -349,17 +357,16 @@ const httpServer = createServer((req, res) => { createReadStream(path).pipe(res); return; } - const clipPage = url.match(/^\/clips\/([a-z0-9-]{1,60})$/); - if (clipPage) { + const clipPage = url.match(/^\/clips\/([^/]+)$/); + if (clipPage && CLIP_SLUG.test(clipPage[1]!)) { const clip = readClips().find((c) => c.name === clipPage[1]); if (clip) { - const proto = String(req.headers["x-forwarded-proto"] ?? "http").split(",")[0]!.trim(); - const base = safeBase(String(req.headers.host ?? `localhost:${port}`), proto); + const base = requestBase(req); res.writeHead(200, { "content-type": "text/html", "cache-control": "no-cache" }); res.end(clipPageHtml(clip, base)); return; } - res.writeHead(404, { "content-type": "text/html" }).end("no such clip — see /clips"); + noSuchClip(res); return; } // Room invitations: a living room gets its recruiting card; a dead diff --git a/packages/server/src/ratelimit.ts b/packages/server/src/ratelimit.ts index 3e38e87..e04d773 100644 --- a/packages/server/src/ratelimit.ts +++ b/packages/server/src/ratelimit.ts @@ -31,6 +31,8 @@ export class SlidingLimit { } } +const LOOPBACK = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]); + /** The client's address as Caddy reports it. The proxy APPENDS the true * peer to X-Forwarded-For, so the last entry is the trustworthy one; a * client can write anything into the first. And the header is believed @@ -43,5 +45,3 @@ export function clientAddress(headers: Record