From 0808d594a371e7caea54f45a71db586160ae75ad Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Tue, 1 Sep 2026 19:09:20 +0200 Subject: fix(node): bound and tighten the chat link-preview SSRF surface MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The link-preview fetch is an outbound request to an address a member chose. safe_url() already blocked non-public addresses and re-checked each redirect hop; this adds the parts that were missing: - Rate limit. `_do_link_preview_request` was reachable by any member with no ceiling, so a member — or a hub minting tokens for many accounts — could drive unbounded outbound HTTP from the operator's machine (amplification / DoS / on-demand IP disclosure to arbitrary hosts). Now bounded per connection (15) and node-wide (60) over a 60 s window; only a real fetch counts, a cache hit is free, and over the ceiling the reply is a plain `ok: false` (bare link), not cached. - Port allowlist. safe_url() passed `parts.port` straight through, so a member could aim the node at `http://:`. Restricted to {80, 443, 8080, 8443} — every real OpenGraph page, none of SSH / mail / DB / cache / search / admin ports. - DNS rebinding. The connection's actual peer address is now re-checked against the public-address rule (`_reject_if_rebound`), so a name that resolves clean and then to something internal does not get its body read. Best-effort (no `network_stream` extension, no check); a full literal-pin is noted as remaining hardening. - Decompression bomb. `_downscale` now refuses an image whose header dimensions exceed ~40 MP before convert()/thumbnail() decode it. Third security review, finding M3. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG --- packages/meshbay-node/tests/test_linkpreview.py | 40 +++++++++++++++++++++++++ 1 file changed, 40 insertions(+) (limited to 'packages/meshbay-node/tests/test_linkpreview.py') diff --git a/packages/meshbay-node/tests/test_linkpreview.py b/packages/meshbay-node/tests/test_linkpreview.py index 0dd951a..a14b173 100644 --- a/packages/meshbay-node/tests/test_linkpreview.py +++ b/packages/meshbay-node/tests/test_linkpreview.py @@ -48,6 +48,30 @@ def test_safe_url_refuses(url): safe_url(url) +@pytest.mark.parametrize("url", [ + "http://example.com:22/x", # SSH + "http://example.com:3306/x", # MySQL + "http://example.com:6379/x", # Redis + "http://example.com:9200/x", # Elasticsearch + "http://example.com:5000/x", # a common internal admin port +]) +def test_safe_url_refuses_non_web_ports(url, resolves_public): + with pytest.raises(UnsafeURL): + safe_url(url) + + +@pytest.mark.parametrize("url", [ + "http://example.com/x", # implicit 80 + "https://example.com/x", # implicit 443 + "http://example.com:80/x", + "https://example.com:443/x", + "http://example.com:8080/x", + "https://example.com:8443/x", +]) +def test_safe_url_allows_the_web_ports(url, resolves_public): + assert safe_url(url) == url + + def test_safe_url_accepts_a_public_host(resolves_public): assert safe_url("https://example.com/some/page") == "https://example.com/some/page" @@ -153,3 +177,19 @@ async def test_fetch_image_downscales(resolves_public): assert jpeg and jpeg[:2] == b"\xff\xd8" # JPEG SOI with Image.open(BytesIO(jpeg)) as im: assert max(im.size) <= linkpreview._IMAGE_MAX_DIM + + +async def test_fetch_image_refuses_a_decompression_bomb(resolves_public, monkeypatch): + from io import BytesIO + + from PIL import Image + # A tiny file that reports enormous dimensions from its header alone. + monkeypatch.setattr(linkpreview, "_MAX_IMAGE_PIXELS", 1_000_000) + buf = BytesIO() + Image.new("RGB", (2000, 2000), (0, 0, 0)).save(buf, format="PNG") # 4 MP > cap + bomb = buf.getvalue() + + def handler(request): + return httpx.Response(200, headers={"content-type": "image/png"}, content=bomb) + async with _client(handler) as c: + assert await linkpreview.fetch_image("https://example.com/x.png", client=c) is None -- cgit v1.2.3