Daniel Hiller
de4d768831
Reported against 2.2.1 by someone reading the source. Every finding held. **Sign-in had no ceiling.** Failures were logged with the caller's address and nothing more. Two counters now — one per address, one per account — because the two attacks look different: one source working through many accounts is caught by the first, many sources working on one account by the second, and behind a proxy only the second still means anything. The count is kept in the process that serves the request. PLANKA needs no Redis and the stock deployment is one container; run several and each keeps its own count, which multiplies the ceiling by their number. That trade is written where the limits are configured. **The second factor could be guessed at leisure.** Six digits, and a pending token that stayed valid for its full ten minutes however many codes were wrong. Wrong codes are now counted on the session row — in the database, so the count survives a restart and holds across every process — and when the budget is spent the session is destroyed. After that even the right code is refused and the login starts over from the password. **Avatars, background images and favicons** checked the token's signature and nothing else, so a revoked session, a deactivated account or a changed password all kept working there for as long as the signature lasted, which is a year by default. The five checks the API makes now live in one helper that both use, rather than the shortened copy that had drifted from it. **A link attachment's favicon** was fetched from wherever the URL pointed. Storing a link is harmless — it is a string the user typed — but fetching its icon is a request the server makes to an address the user chose, and whether an icon came back reported on what is reachable from inside the network. Server-side fetches now refuse private, loopback and link-local addresses, `169.254.169.254` among them. The attachment is still created: linking to an internal wiki is a legitimate thing to do, and it was the server's own request that had to stop. **The signing key.** Our own compose file ships `notsecretkey`, and it is printed in the documentation — so on any instance that copied it, anyone can sign a token for any account. PLANKA now says so on every start, and keeps saying it, along with a key that is missing or shorter than 32 characters. The placeholder carries the warning inline, where it is copied from. **The backup script** wrote password hashes, live sessions, TOTP secrets and SMTP credentials to an unencrypted archive. `BACKUP_PASSPHRASE` now encrypts it, and without one the script says what it just put on disk. It also says what it is — an example for the stock compose stack, not a backup concept — and names the window between the database dump and the file copy, which no ordering closes.
113 lines
4.1 KiB
JavaScript
113 lines
4.1 KiB
JavaScript
/**
|
|
* Custom configuration
|
|
* (sails.config.custom)
|
|
*
|
|
* One-off settings specific to your application.
|
|
*
|
|
* For more information on custom configuration, visit:
|
|
* https://sailsjs.com/config/custom
|
|
*/
|
|
|
|
const path = require('path');
|
|
const { URL } = require('url');
|
|
const bytes = require('bytes');
|
|
const sails = require('sails');
|
|
|
|
const version = require('../version');
|
|
|
|
const envToNumber = (value) => {
|
|
if (!value) {
|
|
return null;
|
|
}
|
|
|
|
const number = parseInt(value, 10);
|
|
return Number.isNaN(number) ? null : number;
|
|
};
|
|
|
|
const envToBytes = (value) => bytes(value);
|
|
|
|
const envToArray = (value) => (value ? value.split(',') : []);
|
|
|
|
const baseUrl = envToArray(process.env.BASE_URL)[0];
|
|
const parsedBasedUrl = new URL(baseUrl);
|
|
|
|
module.exports.custom = {
|
|
/**
|
|
*
|
|
* Any other custom config this Sails app should use during development.
|
|
*
|
|
*/
|
|
|
|
version,
|
|
|
|
baseUrl,
|
|
baseUrlPath: parsedBasedUrl.pathname.replace(/\/$/, ''), // Remove trailing slash
|
|
baseUrlSecure: parsedBasedUrl.protocol === 'https:',
|
|
|
|
maxUploadFileSize: envToBytes(process.env.MAX_UPLOAD_FILE_SIZE),
|
|
tokenExpiresIn: (parseInt(process.env.TOKEN_EXPIRES_IN, 10) || 365) * 24 * 60 * 60,
|
|
|
|
// A second factor needs a harder stop than a time window: six digits fall to
|
|
// patience alone. After this many wrong codes the pending session is
|
|
// destroyed and the login starts over from the password, so the ten minutes
|
|
// a pending token is valid for stop being ten minutes of free guessing.
|
|
totpMaxAttempts: parseInt(process.env.TOTP_MAX_ATTEMPTS, 10) || 5,
|
|
|
|
// Ceiling on sign-in attempts, counted per client address and per account.
|
|
// The two attacks look different: one source working through many accounts is
|
|
// caught by the first, many sources working on one account by the second.
|
|
//
|
|
// Counted in the process that serves the request, not in shared storage —
|
|
// PLANKA needs no Redis, and the stock deployment is a single container. Run
|
|
// several and each keeps its own count, so the effective ceiling multiplies
|
|
// by the number of processes. Put a limiter in your proxy if that matters.
|
|
authRateLimitWindow: parseInt(process.env.AUTH_RATE_LIMIT_WINDOW, 10) || 60,
|
|
authRateLimitMaxPerIp: parseInt(process.env.AUTH_RATE_LIMIT_MAX_PER_IP, 10) || 30,
|
|
authRateLimitMaxPerIdentifier: parseInt(process.env.AUTH_RATE_LIMIT_MAX_PER_IDENTIFIER, 10) || 10,
|
|
|
|
storageLimit: envToBytes(process.env.STORAGE_LIMIT),
|
|
activeUsersLimit: envToNumber(process.env.ACTIVE_USERS_LIMIT),
|
|
|
|
// Location to receive uploaded files in. Default (non-string value) is a Sails-specific location.
|
|
uploadsTempPath: null,
|
|
uploadsBasePath: path.join(sails.config.appPath, 'data'),
|
|
|
|
faviconsPathSegment: 'protected/favicons',
|
|
userAvatarsPathSegment: 'protected/user-avatars',
|
|
backgroundImagesPathSegment: 'protected/background-images',
|
|
attachmentsPathSegment: 'private/attachments',
|
|
|
|
defaultAdminEmail:
|
|
process.env.DEFAULT_ADMIN_EMAIL && process.env.DEFAULT_ADMIN_EMAIL.toLowerCase(),
|
|
|
|
showDetailedAuthErrors: process.env.SHOW_DETAILED_AUTH_ERRORS === 'true',
|
|
outgoingProxy: process.env.OUTGOING_PROXY,
|
|
swaggerExposed: process.env.SWAGGER_EXPOSED === 'true',
|
|
|
|
s3Endpoint: process.env.S3_ENDPOINT,
|
|
s3Region: process.env.S3_REGION,
|
|
s3AccessKeyId: process.env.S3_ACCESS_KEY_ID,
|
|
s3SecretAccessKey: process.env.S3_SECRET_ACCESS_KEY,
|
|
s3Bucket: process.env.S3_BUCKET,
|
|
s3ForcePathStyle: process.env.S3_FORCE_PATH_STYLE === 'true',
|
|
s3RequestChecksumCalculation: process.env.S3_REQUEST_CHECKSUM_CALCULATION,
|
|
|
|
smtpHost: process.env.SMTP_HOST,
|
|
smtpPort: process.env.SMTP_PORT || 587,
|
|
smtpName: process.env.SMTP_NAME,
|
|
smtpSecure: process.env.SMTP_SECURE === 'true',
|
|
smtpTlsRejectUnauthorized: process.env.SMTP_TLS_REJECT_UNAUTHORIZED !== 'false',
|
|
smtpUser: process.env.SMTP_USER,
|
|
smtpPassword: process.env.SMTP_PASSWORD,
|
|
smtpFrom: process.env.SMTP_FROM,
|
|
|
|
gravatarBaseUrl: process.env.GRAVATAR_BASE_URL,
|
|
|
|
/* Internal */
|
|
|
|
internalAccessToken: process.env.INTERNAL_ACCESS_TOKEN,
|
|
termsType: process.env.TERMS_TYPE || 'custom',
|
|
customerPanelUrl: process.env.CUSTOMER_PANEL_URL,
|
|
demoMode: process.env.DEMO_MODE === 'true',
|
|
};
|