openvibers/openvibe.network Commits

Link Send asks the session first: no 401 for signed-out visitors (#736)

OP OpenVibers committed 4 days ago · ec99318366 · 2 files, +5 −1

* Link Send: ask the session before reading the machines' keys, so signed-out visitors get the sign-in line, not a 401

* SSRF inventory: Link Send's fourth same-origin call (the session read)

Changes

ddiff --git a/server/link/send.js b/server/link/send.js
iindex ee418f52..59c2a4df 100644
---- a/server/link/send.js
++++ b/server/link/send.js
@@@ -6,6 +6,10 @@ if (form) {
      const status = form.querySelector('[data-send-status]');
      const say = (text) => { status.textContent = text; };
      const machines = async () => {
++        // Signed out, there is nothing to list: ask the session first instead of letting the keys read fail (a 401 in
++        // every signed-out visitor's console, 11-09 sweep).
++        const me = await fetch('/auth/me', { credentials: 'same-origin', cache: 'no-store' }).then((x) => (x.ok ? x.json() : null)).catch(() => null);
++        if (!me || !me.user) throw new Error('Sign in on openvibe.link to choose one of your machines.');
          const r = await fetch('/api/v1/me/nodes/send-keys', { credentials: 'same-origin', cache: 'no-store' });
          if (r.status === 401 || r.status === 403) throw new Error('Sign in on openvibe.link to choose one of your machines.');
          if (!r.ok) throw new Error('Your machines could not be loaded.');
ddiff --git a/test/security-ssrf.test.js b/test/security-ssrf.test.js
iindex bb800f37..71da23e4 100644
---- a/test/security-ssrf.test.js
++++ b/test/security-ssrf.test.js
@@@ -133,7 +133,7 @@ const REVIEWED = {
      'server/admin/review-queue.js fetch': [2, 'the reviewer queue: Wiki/Blog/News/Trade internal URLs from operator config (loopback defaults), fixed /api/v1/review-queue and review paths, ids percent-encoded, the signed-in staff member\'s own token, staff only'],
      'server/admin/ai-config-proxy.js fetch': [1, 'the owner settings proxy and the Setup tab (server/admin/setup.js calls through it): the reachable services\' internal URLs from config.services (operator-set, loopback defaults), fixed /internal/config and AI /api/v1/providers paths, service, namespace and key checked against the known names, owner only'],
      'server/integrations/github.js fetch': [1, 'fixed host api.github.com (asserted below)'],
--    'server/link/send.js fetch': [3, 'browser-only Link Send requests to fixed same-origin machine-key and transfer routes; page input supplies file bytes, never a URL or destination host'],
++    'server/link/send.js fetch': [4, 'browser-only Link Send requests to fixed same-origin routes (the session read, machine keys and transfers); page input supplies file bytes, never a URL or destination host'],
      'server/notifications/email-service.js http.request': [1, 'fixed host api.resend.com'],
      'server/actions/index.js fetch': [7, 'The Action Center: OpenVibe.Actor, OpenVibe.Codes and OpenVibe.AI only (OV_ACTOR_INTERNAL_URL, OV_CODES_INTERNAL_URL, OV_AI_INTERNAL_URL, loopback); the paths are fixed (the decide route, the cancel route, the retry route of Actor or AI, Actor\'s public GET /api/v1/skills catalogue, and Actor\'s POST /api/v1/runs for a catalogue skill whose id must match the skill id pattern), the subject is the signed-in person\'s own usr_ id, and an item id must match [A-Za-z0-9_-]{1,80}'],
      'server/profile/public.js fetch': [6, 'OpenVibe.Inventory, Quest and Play use operator-configured internal URLs and fixed paths with a checked usr_ id. Public place reads use only the configured Live, Community and Space service URLs, fixed public paths, encoded canonical usernames, 2 s timeouts and no user-supplied host or token; Space results are restricted to the exact owner and Published cards'],