fix: close the gaps a security review found in the default install

Reported against 2.2.1 by someone reading the source. Every finding held. **Sign-in had no ceiling.** Failures were logged with the caller's address and nothing more. Two counters now — one per address, one per account — because the two attacks look different: one source working through many accounts is caught by the first, many sources working on one account by the second, and behind a proxy only the second still means anything. The count is kept in the process that serves the request. PLANKA needs no Redis and the stock deployment is one container; run several and each keeps its own count, which multiplies the ceiling by their number. That trade is written where the limits are configured. **The second factor could be guessed at leisure.** Six digits, and a pending token that stayed valid for its full ten minutes however many codes were wrong. Wrong codes are now counted on the session row — in the database, so the count survives a restart and holds across every process — and when the budget is spent the session is destroyed. After that even the right code is refused and the login starts over from the password. **Avatars, background images and favicons** checked the token's signature and nothing else, so a revoked session, a deactivated account or a changed password all kept working there for as long as the signature lasted, which is a year by default. The five checks the API makes now live in one helper that both use, rather than the shortened copy that had drifted from it. **A link attachment's favicon** was fetched from wherever the URL pointed. Storing a link is harmless — it is a string the user typed — but fetching its icon is a request the server makes to an address the user chose, and whether an icon came back reported on what is reachable from inside the network. Server-side fetches now refuse private, loopback and link-local addresses, `169.254.169.254` among them. The attachment is still created: linking to an internal wiki is a legitimate thing to do, and it was the server's own request that had to stop. **The signing key.** Our own compose file ships `notsecretkey`, and it is printed in the documentation — so on any instance that copied it, anyone can sign a token for any account. PLANKA now says so on every start, and keeps saying it, along with a key that is missing or shorter than 32 characters. The placeholder carries the warning inline, where it is copied from. **The backup script** wrote password hashes, live sessions, TOTP secrets and SMTP credentials to an unencrypted archive. `BACKUP_PASSPHRASE` now encrypts it, and without one the script says what it just put on disk. It also says what it is — an example for the stock compose stack, not a backup concept — and names the window between the database dump and the file copy, which no ordering closes.
2026-08-28 20:55:54 +02:00
parent 6def0330c2
commit de4d768831
15 changed files with 497 additions and 63 deletions
@@ -0,0 +1,73 @@
+/*!
+ * Copyright (c) 2026 PLANKA Software GmbH
+ * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
+ */
+
+// A fixed-window counter, held in the process that serves the request.
+//
+// PLANKA needs no Redis and the stock deployment is a single container, so the
+// count lives in memory rather than in shared storage. Run several processes
+// and each keeps its own, which multiplies the effective ceiling by their
+// number — enough to blunt a script, not a substitute for a limiter in front of
+// the app. That trade is stated where the limits are configured.
+//
+// The verdict comes back in the return value rather than as an exit: an exit
+// reaches an `await` as an Error wrapping its name, which is easy to catch
+// wrongly and easy to catch wrongly in silence.
+
+const buckets = new Map();
+
+// Beyond this many live keys, sweep what has expired before adding more. An
+// attacker can mint keys freely — one per made-up account name — so the map
+// must not be allowed to grow with them.
+const SWEEP_THRESHOLD = 10000;
+
+const sweep = (now) => {
+  buckets.forEach((bucket, key) => {
+    if (bucket.expiresAt <= now) {
+      buckets.delete(key);
+    }
+  });
+};
+
+module.exports = {
+  inputs: {
+    key: {
+      type: 'string',
+      required: true,
+    },
+    windowSeconds: {
+      type: 'number',
+      required: true,
+    },
+    max: {
+      type: 'number',
+      required: true,
+    },
+  },
+
+  sync: true,
+
+  fn(inputs) {
+    const now = Date.now();
+
+    if (buckets.size > SWEEP_THRESHOLD) {
+      sweep(now);
+    }
+
+    const bucket = buckets.get(inputs.key);
+
+    if (!bucket || bucket.expiresAt <= now) {
+      buckets.set(inputs.key, {
+        count: 1,
+        expiresAt: now + inputs.windowSeconds * 1000,
+      });
+
+      return { count: 1, isExceeded: inputs.max < 1 };
+    }
+
+    bucket.count += 1;
+
+    return { count: bucket.count, isExceeded: bucket.count > inputs.max };
+  },
+};
@@ -0,0 +1,107 @@
+/*!
+ * Copyright (c) 2026 PLANKA Software GmbH
+ * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
+ */
+
+// SSRF guard for server-side fetches of user-supplied URLs (link previews).
+// Rejects anything but http/https and any host that resolves to a private,
+// loopback, link-local or otherwise-internal address — so a pasted
+// `http://169.254.169.254/…` or `http://localhost:1337` can't reach the
+// internal network. When an outgoing proxy is configured, egress policy is the
+// proxy's responsibility and we defer to it.
+
+const net = require('net');
+const dns = require('dns').promises;
+const { URL } = require('url');
+
+const isPrivateIPv4 = (ip) => {
+  const parts = ip.split('.').map((octet) => parseInt(octet, 10));
+  if (parts.length !== 4 || parts.some((octet) => Number.isNaN(octet))) {
+    return true;
+  }
+  const [a, b] = parts;
+  return (
+    a === 0 || // "this" network
+    a === 10 ||
+    a === 127 || // loopback
+    (a === 100 && b >= 64 && b <= 127) || // CGNAT 100.64.0.0/10
+    (a === 169 && b === 254) || // link-local (cloud metadata)
+    (a === 172 && b >= 16 && b <= 31) || // 172.16.0.0/12
+    (a === 192 && b === 168)
+  );
+};
+
+const LOCAL_IPV6_PREFIXES = ['fe8', 'fe9', 'fea', 'feb', 'fc', 'fd'];
+
+const isPrivateIPv6 = (ip) => {
+  const address = ip.toLowerCase();
+  if (address === '::1' || address === '::') {
+    return true;
+  }
+  // Link-local (fe80::/10) and unique-local (fc00::/7 → fc/fd prefixes).
+  if (LOCAL_IPV6_PREFIXES.some((prefix) => address.startsWith(prefix))) {
+    return true;
+  }
+  // IPv4-mapped (::ffff:a.b.c.d) — check the embedded v4.
+  const mapped = address.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+  if (mapped) {
+    return isPrivateIPv4(mapped[1]);
+  }
+  return false;
+};
+
+const isPrivateAddress = (ip) => {
+  const family = net.isIP(ip);
+  if (family === 4) {
+    return isPrivateIPv4(ip);
+  }
+  if (family === 6) {
+    return isPrivateIPv6(ip);
+  }
+  return true; // not a recognizable IP → treat as unsafe
+};
+
+module.exports = {
+  inputs: {
+    url: {
+      type: 'string',
+      required: true,
+    },
+  },
+
+  async fn(inputs) {
+    let parsed;
+    try {
+      parsed = new URL(inputs.url);
+    } catch (error) {
+      return false;
+    }
+
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+      return false;
+    }
+
+    // Egress through a trusted proxy → let the proxy enforce destination policy.
+    if (sails.config.custom.outgoingProxy) {
+      return true;
+    }
+
+    const host = parsed.hostname.toLowerCase();
+    if (host === 'localhost' || host.endsWith('.localhost')) {
+      return false;
+    }
+
+    if (net.isIP(host)) {
+      return !isPrivateAddress(host);
+    }
+
+    let addresses;
+    try {
+      addresses = await dns.lookup(host, { all: true });
+    } catch (error) {
+      return false;
+    }
+
+    return addresses.length > 0 && addresses.every(({ address }) => !isPrivateAddress(address));
+  },
+};
@@ -0,0 +1,69 @@
+/*!
+ * Copyright (c) 2026 PLANKA Software GmbH
+ * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
+ */
+
+// Everything that has to be true before an access token means anything, in one
+// place. A valid signature is the first of five, not the whole answer: a token
+// keeps its signature after the session behind it was revoked, after the
+// account was deactivated, and after the password was changed — and the default
+// lifetime is a year.
+//
+// It lives here rather than inside the `current-user` hook because the routes
+// that serve avatars, background images and favicons need the same answer, and
+// when they had their own shortened version of it they let revoked tokens
+// through for as long as the signature lasted.
+//
+// Returns null whenever the token should not be honoured, so a caller cannot
+// mistake "no session" for a session.
+
+module.exports = {
+  inputs: {
+    accessToken: {
+      type: 'string',
+      required: true,
+    },
+    // The paired cookie value, where the session was issued with one. A session
+    // that carries an httpOnlyToken is only valid alongside its cookie.
+    httpOnlyToken: {
+      type: 'string',
+      allowNull: true,
+    },
+  },
+
+  async fn(inputs) {
+    let payload;
+    try {
+      payload = sails.helpers.utils.verifyJwtToken(inputs.accessToken);
+    } catch (error) {
+      return null;
+    }
+
+    const session = await Session.qm.getOneUndeletedByAccessToken(inputs.accessToken);
+
+    if (!session) {
+      return null;
+    }
+
+    if (session.httpOnlyToken && inputs.httpOnlyToken !== session.httpOnlyToken) {
+      return null;
+    }
+
+    const user = await User.qm.getOneById(payload.subject, {
+      withDeactivated: false,
+    });
+
+    if (!user) {
+      return null;
+    }
+
+    if (user.passwordChangedAt > payload.issuedAt) {
+      return null;
+    }
+
+    return {
+      session,
+      user,
+    };
+  },
+};