Skip to content
Sign up

flagon-io/g1t

public
0
195 linesCodeBlameRaw
1/**
2 * Files people supply, served from an origin of their own: a repository's
3 * files and uploaded avatars at `USERCONTENT_URL` (g1tusercontent.com on
4 * g1t.sh). The site's session cookie is never sent there, and nothing
5 * served there can run script.
6 *
7 * <usercontent>/<owner>/<repo>/raw/<ref>/<path> a file at a branch, tag or commit
8 * <usercontent>/avatars/<sha256> an uploaded avatar
9 * <usercontent>/emoji/<sha256> a workspace's custom emoji
10 * <usercontent>/production-images/<sha256> a project's uploaded production image
11 *
12 * A public repository's files are there for anyone. A private one's carry
13 * `?token=`, a signature the site makes for someone who can read the
14 * repository (routes/repo/raw.ts), good for one file for an hour or two.
15 * No Workers imports, so it can be tested under Node.
16 */
17
18/** What every file served there runs under: nothing runs, images and inline styles of its own only. */
19export const USERCONTENT_POLICY = "default-src 'none'; img-src 'self'; style-src 'unsafe-inline'; sandbox";
20/** A PDF: the same, but not sandboxed, which browsers' PDF viewers refuse to open under. */
21export const PDF_POLICY = "default-src 'none'; img-src 'self'; style-src 'unsafe-inline'; object-src 'none'; base-uri 'none'; form-action 'none'";
22
23/** The largest file served, in bytes. */
24export const MAX_RAW_BYTES = 10 * 1024 * 1024;
25
26/** A signed address lasts until the end of the next whole hour, so a page's addresses stay the same for an hour. */
27const TOKEN_HOURS = 2;
28
29export type RawFile = { owner: string; repo: string; ref: string; path: string };
30
31const segment = (value: string) => encodeURIComponent(value);
32
33/** `/<owner>/<repo>/raw/<ref>/<path>`, each part encoded; a ref's slashes too, so it stays one segment. */
34export function rawPath(file: RawFile): string {
35 const path = file.path.split("/").filter(Boolean).map(segment).join("/");
36 return `/${segment(file.owner)}/${segment(file.repo)}/raw/${segment(file.ref)}/${path}`;
37}
38
39/** The parts of a raw file's path, decoded; null for any other path. */
40export function parseRawPath(pathname: string): RawFile | null {
41 const parts = pathname.split("/").slice(1);
42 if (parts.length < 5 || parts[2] !== "raw") return null;
43 try {
44 const [owner, repo, , ref, ...rest] = parts.map(decodeURIComponent);
45 const path = rest.join("/");
46 if (!owner || !repo || !ref || !path || rest.some((part) => !part || part === "." || part === "..")) return null;
47 return { owner, repo, ref, path };
48 } catch {
49 return null;
50 }
51}
52
53/**
54 * The part of `url` under the usercontent address `base`, or null when it
55 * is not there: on its own host, any path; as a path on the site
56 * (`<site>/-/usercontent`), what follows that path, whatever the host the
57 * request came in on (a proxy may change it).
58 */
59export function usercontentPath(url: URL, base: string): string | null {
60 const at = new URL(base);
61 const prefix = at.pathname.replace(/\/+$/, "");
62 if (!prefix) return url.host === at.host ? url.pathname : null;
63 if (url.pathname === prefix || url.pathname.startsWith(`${prefix}/`)) return url.pathname.slice(prefix.length) || "/";
64 return null;
65}
66
67/** Whether a ref names a commit, whose files never change. */
68export function isCommit(ref: string): boolean {
69 return /^[0-9a-f]{40}$/.test(ref);
70}
71
72const encoder = new TextEncoder();
73
74function base64url(bytes: ArrayBuffer): string {
75 return btoa(String.fromCharCode(...new Uint8Array(bytes))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
76}
77
78function fromBase64url(text: string): Uint8Array<ArrayBuffer> | null {
79 try {
80 const plain = atob(text.replace(/-/g, "+").replace(/_/g, "/"));
81 return Uint8Array.from(plain, (c) => c.charCodeAt(0));
82 } catch {
83 return null;
84 }
85}
86
87function hmacKey(secret: string, use: KeyUsage): Promise<CryptoKey> {
88 return crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [use]);
89}
90
91/** What a token signs: the file, by the repository's path and id, and when it ends. */
92function signed(file: RawFile, repoId: string, expires: number): Uint8Array<ArrayBuffer> {
93 return encoder.encode(["raw", file.owner.toLowerCase(), file.repo.toLowerCase(), repoId, file.ref, file.path, String(expires)].join("\n"));
94}
95
96/** A token for one file of a private repository: `<expires>.<repoId>.<signature>`. */
97export async function signRaw(secret: string, file: RawFile, repoId: string, nowMs = Date.now()): Promise<string> {
98 const hour = 3600;
99 const expires = (Math.floor(nowMs / 1000 / hour) + TOKEN_HOURS) * hour;
100 const signature = await crypto.subtle.sign("HMAC", await hmacKey(secret, "sign"), signed(file, repoId, expires));
101 return `${expires}.${repoId}.${base64url(signature)}`;
102}
103
104/** The repository id a token is good for, when it is for this file and has not ended; else null. */
105export async function verifyRaw(secret: string, file: RawFile, token: string, nowMs = Date.now()): Promise<string | null> {
106 const match = /^(\d{1,12})\.([A-Za-z0-9_-]{1,64})\.([A-Za-z0-9_-]{43})$/.exec(token);
107 if (!match) return null;
108 const [, at, repoId, signature] = match;
109 const expires = Number(at);
110 if (expires * 1000 <= nowMs) return null;
111 const bytes = fromBase64url(signature!);
112 if (!bytes) return null;
113 const ok = await crypto.subtle.verify("HMAC", await hmacKey(secret, "verify"), bytes, signed(file, repoId!, expires));
114 return ok ? repoId! : null;
115}
116
117const IMAGES: Record<string, string> = {
118 png: "image/png",
119 jpg: "image/jpeg",
120 jpeg: "image/jpeg",
121 gif: "image/gif",
122 webp: "image/webp",
123 avif: "image/avif",
124 ico: "image/x-icon",
125 bmp: "image/bmp",
126 svg: "image/svg+xml",
127};
128
129const MEDIA: Record<string, string> = {
130 mp4: "video/mp4",
131 webm: "video/webm",
132 mov: "video/quicktime",
133 mp3: "audio/mpeg",
134 ogg: "audio/ogg",
135 wav: "audio/wav",
136 woff: "font/woff",
137 woff2: "font/woff2",
138 pdf: "application/pdf",
139};
140
141function extension(path: string): string {
142 const name = path.split("/").pop() ?? "";
143 return name.includes(".") ? name.split(".").pop()!.toLowerCase() : "";
144}
145
146/** Whether a file shows as an image in a page, by its name. */
147export function isImagePath(path: string): boolean {
148 return extension(path) in IMAGES;
149}
150
151/** Whether the bytes look like text: no NUL in the first 8,000. */
152function looksLikeText(bytes: Uint8Array): boolean {
153 return !bytes.subarray(0, 8000).includes(0);
154}
155
156/**
157 * The headers a file is served with. Images, media and PDFs as
158 * themselves; any other text (HTML, SVG's script, XML, JavaScript
159 * included) as plain text; anything else as bytes to save. Never sniffed,
160 * and nothing in it runs.
161 */
162export function rawHeaders(path: string, bytes: Uint8Array): Headers {
163 const ext = extension(path);
164 const type = IMAGES[ext] ?? MEDIA[ext] ?? (looksLikeText(bytes) ? "text/plain; charset=utf-8" : "application/octet-stream");
165 const headers = new Headers({
166 "content-type": type,
167 "content-length": String(bytes.byteLength),
168 "x-content-type-options": "nosniff",
169 "content-security-policy": type === "application/pdf" ? PDF_POLICY : USERCONTENT_POLICY,
170 "cross-origin-resource-policy": "cross-origin",
171 "referrer-policy": "no-referrer",
172 });
173 if (type === "application/octet-stream") {
174 const name = path.split("/").pop() ?? "file";
175 headers.set("content-disposition", `attachment; filename="${name.replace(/[^\x20-\x7e]|["\\%;]/g, "_")}"; filename*=UTF-8''${encodeURIComponent(name)}`);
176 }
177 return headers;
178}
179
180/**
181 * An image's address: an external one as written; a relative one as the
182 * repository's raw file at the same commit, or nothing when it climbs out
183 * of the repository. `rawBase` is the document's folder under
184 * `/<owner>/<repo>/raw/<ref>`.
185 */
186export function imageSource(src: string, rawBase: string | undefined): string | undefined {
187 if (/^[a-z][a-z0-9+.-]*:/i.test(src) || src.startsWith("//") || !rawBase || src.startsWith("#")) return src;
188 const root = /^\/[^/]+\/[^/]+\/raw\/[^/]+/.exec(rawBase)?.[0];
189 if (!root) return src;
190 const path = src.split(/[?#]/)[0]!;
191 if (!path) return undefined;
192 const from = path.startsWith("/") ? `${root}/` : `${rawBase.replace(/\/+$/, "")}/`;
193 const resolved = new URL(path.replace(/^\/+/, ""), `https://g1t.invalid${from}`).pathname;
194 return resolved.startsWith(`${root}/`) ? resolved : undefined;
195}