fix(security): audit remediation 2026-09-01: api_keys identity, viewer gates, OAuth binding, XSS, MFA gate (#2155)
* fix(security): bind api_keys to the caller, lock hash-as-bearer RPCs and provider token tables Security audit 2026-09-01, critical items. - api_keys INSERT requires user_id = auth.uid() again (an admin could forge a key for any co-member and act as them in every company they belong to); SELECT is own-keys-or-admin; a BEFORE trigger freezes the identity and credential columns against user-session UPDATEs. - rotate_mcp_refresh_token and validate_and_increment_api_key become service_role only: they match rows by a presented SHA-256, so a hash readable by co-members was a bearer credential. - validate_and_increment_api_key fails closed when the key's user is no longer a member of the key's company. - provider_consent_tokens and provider_otc: the DELETE policies collapsed to "caller has any team row" (correlated subquery on a non-existent team_members.company_id). All member policies dropped; service_role only, matching every existing code path. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): role gates, ownership guards and posting integrity in the database Security audit 2026-09-01, high items at the database layer. - One table-level guard, enforce_company_writer_role(), blocks the read-only viewer role on 55 company-scoped tables including through the 15 membership-only SECURITY DEFINER writers. Keyed on the JWT role claim so it fires inside definer bodies; no-op for service_role and trigger cascades. - company_members user_id/company_id immutable from user sessions; invitations can never grant owner; team_members gains a transition guard (admins keep non-owner role moves); companies team_id and archiving are owner-only and team attachment needs team membership. - Direct statements (current_user = authenticated) can no longer insert posted headers, add lines under posted verifikat, or post a draft with a voucher number the sequence never issued. Sanctioned RPCs run as the definer and are untouched; the engine's own draft-then-post shapes still pass. - create_document_version refuses viewers and foreign storage paths; validate_version_chain needs membership and loses anon EXECUTE; match_documents / match_booking_templates lose anon; cron maintenance RPCs become service_role only; the production-only seed_asset_categories is dropped. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * build: pin tsx as an exact devDependency instead of fetching it with npx at build time prebuild ran "npx tsx" with no lockfile entry, so every Vercel, Docker and CI build downloaded tsx@latest and its transitive tree from the registry with no integrity check, inside the build environment. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): refuse the viewer role on API-key and MCP write paths The v1 wrapper and the MCP company routing checked company membership but never role, and both run as service role, so a read-only viewer holding an API key could post vouchers and change settings through the API. Mutating methods and non-read scopes now return 403 ROLE_READ_ONLY for viewers on v1; MCP write tools refuse viewers the same way. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): stop serving uploaded SVG, XML and HTML as executable content on the app origin Uploads persisted the browser-declared mime type and the inline proxy served it verbatim, sandboxing only text/html; the storage proxy forwarded the uploader's Content-Type. Any writer, or any Peppol sender, could plant a scripted SVG or XHTML that executed on app.gnubok.se. - inline route: allow-list of natively safe types (PDF, raster images) served as before; everything else gets the opaque sandbox CSP. - storage proxy: octet-stream + attachment + sandbox unless the DB mime for the key is on the allow-list. - document-service: the stored mime is the magic-byte validated type. - logo upload: magic-byte validation, SVG refused. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): byrå brand logo upload decides the type by magic bytes and drops SVG Same pattern as the company logo route: the logos bucket is public, so a scripted SVG (or anything declared as an image) must never land there. The upload pickers stop advertising SVG. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): bind Enable Banking, Stripe and WooCommerce callbacks to the initiating user The callbacks resolved the pending row by oauth_state alone, so a victim who completed an attacker-initiated consent had their bank account, merchant account or store attached to the attacker's company. requireFlowInitiator() now requires the cookie session of the user who started the flow: no session redirects to login with the callback URL preserved, a different user is refused and nothing is exchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): guard tenant-controlled outbound fetches and surface the disabled rate limiter WooCommerce and Shopify syncs fetched a member-editable store URL with plain fetch() and redirect following under the service role, and the invoice PDF renderer fetched company_settings.logo_url unguarded. All three go through a new safeFetch() (public-IP validation via url-guard, https only, redirect: 'manual', body size cap) and re-normalise the stored host at use time. checkRateLimit() keeps failing open on hosted but logs one error per process when Upstash is not configured and exports isRateLimiterConfigured(). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): decide the API MFA gate from server-authenticated factors, not the session cookie getAuthenticatorAssuranceLevel() without arguments derives nextLevel from session.user.factors, which comes from the unsigned sb-*-auth-token cookie. Deleting factors from the cookie made an enrolled account look like it had nothing to step up to, on every /api route and in requireAuth. Both gates now read factors from the getUser() result or listFactors() and the level from the verified JWT claim, and fail closed on errors. Page-branch gate hardened the same way. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): bind Fortnox/Visma, Gmail and Skatteverket callbacks to the initiating user The arcim-migration callback exchanged the provider code onto whatever consent the one-time state named, with no check of who completed the flow and no org-number comparison, so a phished Fortnox admin handed their ledger to the attacker's company. provider_otc now records the initiating user (migration 20260902100000); the callback requires that session and, after the exchange, refuses a provider company whose org number differs from the consent's company. The Gmail and Skatteverket callbacks enforce the same initiator check. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): BankID signup confirms the email before linking the identity Signup created an email-confirmed, MFA-exempt account for any address the caller typed and returned a magic link, so an attacker could pre-register a victim's email and keep a permanent BankID login into the account the victim later adopted. The user is now created unconfirmed, the identity carries email_verified_at NULL (migration 20260902101000), bankid_linked is not set until the mailed confirmation is clicked, and BankID login of a pending identity is refused with the confirmation re-sent. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): bind MCP OAuth redirect URIs to the consenting user and cap scopes A user-registered redirect URI was allowlisted globally, the consent page named no client, and all scopes were pre-checked, so one phishing link handed an attacker a full-scope key for the victim's company. Registered URIs now resolve only for the registrant or a colleague sharing a company; the consent page shows the client identity and redirect host; non-built-in clients default to read-only pre-checks; scopes are capped by the user's role (viewer: read only) at consent and at /token. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(auth): client follow-ups for BankID confirmation, callback mismatch copy and decision log - register client handles the new confirmation_sent response from BankID signup with the existing inbox screen instead of calling verifyOtp. - BankID login surfaces the email_unconfirmed explanation. - WooCommerce settings map woocommerce_error=wrong_user to its own copy. - Logo help text no longer advertises SVG. - DECISIONS.md records the audit remediation choices. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(mcp-oauth): literal SoD columns in the api_keys insert so the phantom-column scanner resolves them Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(logo): type the upload fixtures as Uint8Array<ArrayBuffer> so they are valid BlobParts Fixes the typecheck ratchet on PR #2155 and ratchets the baseline down by the one legacy error the change removed. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Jakob Wennberg
co-authored by
Claude Fable 5.1
Jakob Wennberg
Claude Fable 5.1
Jakob Wennberg
parent
6e8d76a9cb
commit
18cbc4c30a
@@ -72,6 +72,7 @@ import {
|
||||
createPendingDocumentUpload,
|
||||
completePendingDocumentUpload,
|
||||
computeSHA256,
|
||||
resolveStoredMimeType,
|
||||
PENDING_DOCUMENT_UPLOAD_RETENTION_MS,
|
||||
SIGNED_DOCUMENT_UPLOAD_TTL_MS,
|
||||
isCompanyScopedDocumentPath,
|
||||
@@ -1243,3 +1244,170 @@ describe('verifyIntegrity', () => {
|
||||
expect(result.computedHash).not.toBe('stored-hash-abc')
|
||||
})
|
||||
})
|
||||
|
||||
describe('validated mime type persistence (stored type is what the bytes are)', () => {
|
||||
const company = '11111111-1111-4111-8111-111111111111'
|
||||
const user = '22222222-2222-4222-8222-222222222222'
|
||||
const uploadId = '33333333-3333-4333-8333-333333333333'
|
||||
|
||||
// 16-byte ISO-BMFF ftyp box with the given major brand (see the HEIC tests).
|
||||
const isoBmff = (brand: string): ArrayBuffer => {
|
||||
const bytes = new Uint8Array(16)
|
||||
bytes[3] = 16
|
||||
bytes.set([0x66, 0x74, 0x79, 0x70], 4)
|
||||
bytes.set(new TextEncoder().encode(brand), 8)
|
||||
return bytes.buffer as ArrayBuffer
|
||||
}
|
||||
const pngBytes = (): ArrayBuffer =>
|
||||
new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]).buffer as ArrayBuffer
|
||||
const textBytes = (text: string): ArrayBuffer => {
|
||||
const bytes = new TextEncoder().encode(text)
|
||||
return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength) as ArrayBuffer
|
||||
}
|
||||
|
||||
function insertPayloadOf(client: ReturnType<typeof makeClient>, fromIndex: number) {
|
||||
const builder = client.from.mock.results[fromIndex]?.value as { insert: ReturnType<typeof vi.fn> }
|
||||
return builder.insert.mock.calls[0]?.[0] as Record<string, unknown> | undefined
|
||||
}
|
||||
|
||||
describe('resolveStoredMimeType', () => {
|
||||
it('returns the sniffed type for binary formats, including the HEIC/HEIF family swap', () => {
|
||||
expect(resolveStoredMimeType(pdfBuffer(), 'application/pdf')).toBe('application/pdf')
|
||||
expect(resolveStoredMimeType(pngBytes(), 'image/png')).toBe('image/png')
|
||||
expect(resolveStoredMimeType(isoBmff('heic'), 'image/heif')).toBe('image/heic')
|
||||
expect(resolveStoredMimeType(isoBmff('mif1'), 'image/heic')).toBe('image/heif')
|
||||
})
|
||||
|
||||
it('keeps the declared type for the shape-checked text formats (no magic number)', () => {
|
||||
expect(resolveStoredMimeType(textBytes('<?xml version="1.0"?><Invoice/>'), 'application/xml')).toBe('application/xml')
|
||||
expect(resolveStoredMimeType(textBytes('<?xml version="1.0"?><Invoice/>'), 'text/xml')).toBe('text/xml')
|
||||
expect(resolveStoredMimeType(textBytes('<!doctype html><html></html>'), 'text/html')).toBe('text/html')
|
||||
expect(resolveStoredMimeType(textBytes('<?xml version="1.0"?><html/>'), 'application/xhtml+xml')).toBe('application/xhtml+xml')
|
||||
expect(resolveStoredMimeType(textBytes('{"a":1}'), 'application/json')).toBe('application/json')
|
||||
})
|
||||
|
||||
it('sniffs an undeclared type and stores null rather than an unverified string', () => {
|
||||
expect(resolveStoredMimeType(pdfBuffer(), undefined)).toBe('application/pdf')
|
||||
expect(resolveStoredMimeType(pdfBuffer(), '')).toBe('application/pdf')
|
||||
expect(resolveStoredMimeType(textBytes('just text'), undefined)).toBeNull()
|
||||
})
|
||||
})
|
||||
|
||||
it('uploadDocument stores and stamps the sniffed type, not the declared one', async () => {
|
||||
results = [{ data: makeDocumentAttachment({ id: 'doc-1' }), error: null }]
|
||||
const upload = vi.fn().mockResolvedValue({ data: {}, error: null })
|
||||
const client = makeClient({ upload })
|
||||
|
||||
await uploadDocument(client as never, 'user-1', 'company-1', {
|
||||
name: 'IMG_0001.heif',
|
||||
buffer: isoBmff('heic'),
|
||||
type: 'image/heif',
|
||||
})
|
||||
|
||||
expect(insertPayloadOf(client, 0)?.mime_type).toBe('image/heic')
|
||||
expect((upload.mock.calls[0]?.[2] as { contentType: string }).contentType).toBe('image/heic')
|
||||
})
|
||||
|
||||
it('uploadDocument sniffs an undeclared type instead of storing null for a real PDF', async () => {
|
||||
results = [{ data: makeDocumentAttachment({ id: 'doc-1' }), error: null }]
|
||||
const upload = vi.fn().mockResolvedValue({ data: {}, error: null })
|
||||
const client = makeClient({ upload })
|
||||
|
||||
await uploadDocument(client as never, 'user-1', 'company-1', {
|
||||
name: 'kvitto.pdf',
|
||||
buffer: pdfBuffer('undeclared'),
|
||||
})
|
||||
|
||||
expect(insertPayloadOf(client, 0)?.mime_type).toBe('application/pdf')
|
||||
expect((upload.mock.calls[0]?.[2] as { contentType: string }).contentType).toBe('application/pdf')
|
||||
})
|
||||
|
||||
it('completePendingDocumentUpload persists the sniffed type', async () => {
|
||||
const buffer = isoBmff('heic')
|
||||
const document = makeDocumentAttachment({
|
||||
id: uploadId,
|
||||
mime_type: 'image/heic',
|
||||
sha256_hash: await computeSHA256(buffer),
|
||||
})
|
||||
results = [
|
||||
{ data: null, error: null },
|
||||
{ data: document, error: null },
|
||||
]
|
||||
serviceClientOverride = makeClient({
|
||||
download: vi.fn().mockResolvedValue({ data: new Blob([buffer]), error: null }),
|
||||
})
|
||||
const client = makeClient()
|
||||
|
||||
await completePendingDocumentUpload(client as never, company, user, uploadId, 'IMG_0001.heif', 'image/heif')
|
||||
|
||||
expect(insertPayloadOf(client, 1)?.mime_type).toBe('image/heic')
|
||||
})
|
||||
|
||||
it('completePendingDocumentUpload retry accepts the stored family member for the declared one', async () => {
|
||||
const buffer = isoBmff('heic')
|
||||
const document = makeDocumentAttachment({
|
||||
id: uploadId,
|
||||
user_id: user,
|
||||
company_id: company,
|
||||
file_name: 'IMG_0001.heif',
|
||||
mime_type: 'image/heic',
|
||||
storage_path: buildReservedDocumentStoragePath(company, user, uploadId, 'IMG_0001.heif'),
|
||||
sha256_hash: await computeSHA256(buffer),
|
||||
})
|
||||
results = [{ data: document, error: null }]
|
||||
const move = vi.fn().mockResolvedValue({ data: {}, error: null })
|
||||
serviceClientOverride = makeClient({
|
||||
download: vi.fn().mockResolvedValue({ data: new Blob([buffer]), error: null }),
|
||||
move,
|
||||
})
|
||||
|
||||
const completed = await completePendingDocumentUpload(
|
||||
makeClient() as never,
|
||||
company,
|
||||
user,
|
||||
uploadId,
|
||||
'IMG_0001.heif',
|
||||
'image/heif',
|
||||
)
|
||||
|
||||
expect(completed.document).toEqual(document)
|
||||
expect(move).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('completePendingDocumentUpload retry still rejects a genuinely different stored type', async () => {
|
||||
const buffer = isoBmff('heic')
|
||||
const document = makeDocumentAttachment({
|
||||
id: uploadId,
|
||||
file_name: 'IMG_0001.heif',
|
||||
mime_type: 'image/jpeg',
|
||||
sha256_hash: await computeSHA256(buffer),
|
||||
})
|
||||
results = [{ data: document, error: null }]
|
||||
serviceClientOverride = makeClient({
|
||||
download: vi.fn().mockResolvedValue({ data: new Blob([buffer]), error: null }),
|
||||
})
|
||||
|
||||
await expect(
|
||||
completePendingDocumentUpload(makeClient() as never, company, user, uploadId, 'IMG_0001.heif', 'image/heif'),
|
||||
).rejects.toThrow(/different file metadata/)
|
||||
})
|
||||
|
||||
it('createNewVersion passes the sniffed type to the versioning RPC and the storage object', async () => {
|
||||
results = [
|
||||
{ data: { company_id: 'company-1' }, error: null },
|
||||
{ data: 'doc-2', error: null },
|
||||
{ data: makeDocumentAttachment({ id: 'doc-2', version: 2 }), error: null },
|
||||
]
|
||||
const upload = vi.fn().mockResolvedValue({ data: {}, error: null })
|
||||
const client = makeClient({ upload })
|
||||
|
||||
await createNewVersion(client as never, 'user-1', 'doc-1', {
|
||||
name: 'IMG_0002.heif',
|
||||
buffer: isoBmff('heic'),
|
||||
type: 'image/heif',
|
||||
})
|
||||
|
||||
expect((client.rpc.mock.calls[0]?.[1] as { p_mime_type: string }).p_mime_type).toBe('image/heic')
|
||||
expect((upload.mock.calls[0]?.[2] as { contentType: string }).contentType).toBe('image/heic')
|
||||
})
|
||||
})
|
||||
|
||||
@@ -362,6 +362,49 @@ export function validateDocumentMagicBytes(buffer: ArrayBuffer, declaredMimeType
|
||||
return null
|
||||
}
|
||||
|
||||
/**
|
||||
* Declared types validateDocumentMagicBytes checks by content shape rather
|
||||
* than by signature. They have no magic number, so the declared type is the
|
||||
* only type there is once the shape check has passed.
|
||||
*/
|
||||
const SHAPE_CHECKED_TYPES = new Set([
|
||||
'application/xhtml+xml',
|
||||
'application/xml',
|
||||
'text/xml',
|
||||
'text/html',
|
||||
'application/json',
|
||||
])
|
||||
|
||||
/**
|
||||
* The mime type to persist on the document row and stamp on the storage
|
||||
* object: what the bytes are, never what the client declared. Call after
|
||||
* validateDocumentMagicBytes has accepted the buffer for `declaredMimeType`.
|
||||
*
|
||||
* Binary formats take the sniffed type (an iOS capture declared image/heif
|
||||
* but branded heic lands as image/heic). The shape-checked text formats keep
|
||||
* their declared type, which the validator has already held against the
|
||||
* content. With no declared type the sniffed type is stored when there is
|
||||
* one, else null: a serving route treats null as unknown and serves it
|
||||
* opaque, whereas an unverified client string could name an active type.
|
||||
*/
|
||||
export function resolveStoredMimeType(
|
||||
buffer: ArrayBuffer,
|
||||
declaredMimeType: string | undefined,
|
||||
): string | null {
|
||||
if (declaredMimeType && SHAPE_CHECKED_TYPES.has(declaredMimeType)) return declaredMimeType
|
||||
return detectFileMagic(new Uint8Array(buffer))
|
||||
}
|
||||
|
||||
/**
|
||||
* True when a stored type and a declared type name the same content. The
|
||||
* stored type is the validated one (resolveStoredMimeType), so the only
|
||||
* legitimate difference is the HEIC/HEIF family swap.
|
||||
*/
|
||||
function sameStoredMimeType(stored: string | null, declared: string): boolean {
|
||||
if (stored === declared) return true
|
||||
return stored !== null && HEIC_FAMILY.has(stored) && HEIC_FAMILY.has(declared)
|
||||
}
|
||||
|
||||
let bucketVerified = false
|
||||
|
||||
/** @internal Reset bucket verification flag: for testing only */
|
||||
@@ -513,7 +556,7 @@ function validateReservedDocumentMetadata(
|
||||
fileName: string,
|
||||
mimeType: string
|
||||
): void {
|
||||
if (document.file_name !== fileName || document.mime_type !== mimeType) {
|
||||
if (document.file_name !== fileName || !sameStoredMimeType(document.mime_type, mimeType)) {
|
||||
throw new Error('Upload ID was already completed with different file metadata')
|
||||
}
|
||||
}
|
||||
@@ -607,6 +650,10 @@ export async function completePendingDocumentUpload(
|
||||
await storage.remove([sourcePath])
|
||||
throw error
|
||||
}
|
||||
// Persist what the bytes are, not what the client said (see
|
||||
// resolveStoredMimeType). The storage object itself keeps the metadata
|
||||
// the PUT declared: nothing serving from this app trusts it.
|
||||
const storedMimeType = resolveStoredMimeType(buffer, mimeType)
|
||||
|
||||
if (options.dedupeByContent) {
|
||||
// Same lookup as uploadDocument: oldest current-version match wins, and
|
||||
@@ -646,7 +693,7 @@ export async function completePendingDocumentUpload(
|
||||
storage_path: permanentPath,
|
||||
file_name: fileName,
|
||||
file_size_bytes: buffer.byteLength,
|
||||
mime_type: mimeType,
|
||||
mime_type: storedMimeType,
|
||||
sha256_hash: sha256Hash,
|
||||
version: 1,
|
||||
is_current_version: true,
|
||||
@@ -754,6 +801,8 @@ export async function uploadDocument(
|
||||
const magicError = validateDocumentMagicBytes(file.buffer, file.type)
|
||||
if (magicError) throw new Error(magicError)
|
||||
}
|
||||
// Stored and stamped type is the validated one, never the raw client type.
|
||||
const storedMimeType = resolveStoredMimeType(file.buffer, file.type)
|
||||
|
||||
// Compute SHA-256 hash
|
||||
const sha256Hash = await computeSHA256(file.buffer)
|
||||
@@ -801,7 +850,7 @@ export async function uploadDocument(
|
||||
const { error: uploadError } = await supabase.storage
|
||||
.from('documents')
|
||||
.upload(storagePath, file.buffer, {
|
||||
contentType: file.type || 'application/octet-stream',
|
||||
contentType: storedMimeType ?? 'application/octet-stream',
|
||||
upsert: false,
|
||||
})
|
||||
|
||||
@@ -819,7 +868,7 @@ export async function uploadDocument(
|
||||
storage_path: storagePath,
|
||||
file_name: file.name,
|
||||
file_size_bytes: file.buffer.byteLength,
|
||||
mime_type: file.type || null,
|
||||
mime_type: storedMimeType,
|
||||
sha256_hash: sha256Hash,
|
||||
version: 1,
|
||||
is_current_version: true,
|
||||
@@ -916,6 +965,7 @@ export async function createNewVersion(
|
||||
const magicError = validateDocumentMagicBytes(file.buffer, file.type)
|
||||
if (magicError) throw new Error(magicError)
|
||||
}
|
||||
const storedMimeType = resolveStoredMimeType(file.buffer, file.type)
|
||||
|
||||
// Compute SHA-256 hash
|
||||
const sha256Hash = await computeSHA256(file.buffer)
|
||||
@@ -945,7 +995,7 @@ export async function createNewVersion(
|
||||
const { error: uploadError } = await supabase.storage
|
||||
.from('documents')
|
||||
.upload(storagePath, file.buffer, {
|
||||
contentType: file.type || 'application/octet-stream',
|
||||
contentType: storedMimeType ?? 'application/octet-stream',
|
||||
upsert: false,
|
||||
})
|
||||
|
||||
@@ -960,7 +1010,7 @@ export async function createNewVersion(
|
||||
p_storage_path: storagePath,
|
||||
p_file_name: file.name,
|
||||
p_file_size_bytes: file.buffer.byteLength,
|
||||
p_mime_type: file.type || null,
|
||||
p_mime_type: storedMimeType,
|
||||
p_sha256_hash: sha256Hash,
|
||||
})
|
||||
|
||||
|
||||
@@ -18,6 +18,67 @@
|
||||
|
||||
export const STORAGE_PROXY_ROUTE = '/api/storage'
|
||||
|
||||
/**
|
||||
* Content types a browser renders natively without a script context: PDF
|
||||
* and the raster image formats the document archive accepts. These are the
|
||||
* only types either document-serving route (the inline preview proxy and the
|
||||
* signed-URL proxy below) hands to the browser as-is. Everything else that
|
||||
* can reach the archive (text/html mail bodies, application/xhtml+xml
|
||||
* iXBRL, Peppol application/xml and text/xml, image/svg+xml, application/json,
|
||||
* unknown or legacy types) is active content when it lands on our origin:
|
||||
* an uploader-controlled <script> inside it would run with the app origin's
|
||||
* authority (stored XSS). Those types are served under OPAQUE_DOCUMENT_CSP.
|
||||
*/
|
||||
export const INLINE_SAFE_MIME_TYPES: ReadonlySet<string> = new Set([
|
||||
'application/pdf',
|
||||
'image/jpeg',
|
||||
'image/png',
|
||||
'image/webp',
|
||||
'image/gif',
|
||||
'image/heic',
|
||||
'image/heif',
|
||||
])
|
||||
|
||||
/**
|
||||
* Policy for every served document that is not natively inline-safe.
|
||||
* `sandbox` (no tokens) makes the rendered document opaque-origin and
|
||||
* script-free wherever it is opened, iframe or direct tab. The source
|
||||
* directives block outbound requests on top of that: sandbox alone still
|
||||
* loads remote images, so a tracking pixel in a mail body would notify the
|
||||
* sender when the preview is opened. Inline styles and embedded data:/blob:
|
||||
* images keep working, so HTML mail previews and XML views still render.
|
||||
*/
|
||||
export const OPAQUE_DOCUMENT_CSP =
|
||||
"sandbox; default-src 'none'; style-src 'unsafe-inline'; img-src data: blob:"
|
||||
|
||||
/**
|
||||
* Canonical (lower-case, parameter-free) form of `mimeType` when it is one
|
||||
* of INLINE_SAFE_MIME_TYPES, else null. Legacy rows hold client-declared
|
||||
* strings, so parameters and case are tolerated on the way in but never
|
||||
* echoed back out.
|
||||
*/
|
||||
export function inlineSafeMimeType(mimeType: string | null | undefined): string | null {
|
||||
if (!mimeType) return null
|
||||
const essence = mimeType.split(';')[0]?.trim().toLowerCase() ?? ''
|
||||
return INLINE_SAFE_MIME_TYPES.has(essence) ? essence : null
|
||||
}
|
||||
|
||||
/**
|
||||
* The documents-bucket object key behind a proxied download path
|
||||
* (`sign/documents/<key>`, still percent-encoded), decoded so it can be
|
||||
* matched against `document_attachments.storage_path`. Null for upload paths
|
||||
* and anything else.
|
||||
*/
|
||||
export function documentKeyFromProxyPath(objectPath: string): string | null {
|
||||
const prefix = 'sign/documents/'
|
||||
if (!objectPath.startsWith(prefix)) return null
|
||||
try {
|
||||
return decodeURIComponent(objectPath.slice(prefix.length))
|
||||
} catch {
|
||||
return null
|
||||
}
|
||||
}
|
||||
|
||||
/** Upstream prefix under the Storage API that every signed object URL shares. */
|
||||
const UPSTREAM_OBJECT_PREFIX = '/storage/v1/object/'
|
||||
|
||||
|
||||
Reference in New Issue
Block a user