| 1 | /** |
| 2 | * Files people supply, served from an origin of their own: a repository's |
| 3 | * files and uploaded avatars at `USERCONTENT_URL` (g1tusercontent.com on |
| 4 | * g1t.sh). The site's session cookie is never sent there, and nothing |
| 5 | * served there can run script. |
| 6 | * |
| 7 | * <usercontent>/<owner>/<repo>/raw/<ref>/<path> a file at a branch, tag or commit |
| 8 | * <usercontent>/avatars/<sha256> an uploaded avatar |
| 9 | * <usercontent>/emoji/<sha256> a workspace's custom emoji |
| 10 | * <usercontent>/production-images/<sha256> a project's uploaded production image |
| 11 | * <usercontent>/attachments/<id> an image in an issue, pull request or comment |
| 12 | * |
| 13 | * A public repository's files are there for anyone. A private one's carry |
| 14 | * `?token=`, a signature the site makes for someone who can read the |
| 15 | * repository (routes/repo/raw.ts), good for one file for an hour or two. |
| 16 | * No Workers imports, so it can be tested under Node. |
| 17 | */ |
| 18 | |
| 19 | /** What every file served there runs under: nothing runs, images and inline styles of its own only. */ |
| 20 | export const USERCONTENT_POLICY = "default-src 'none'; img-src 'self'; style-src 'unsafe-inline'; sandbox"; |
| 21 | /** A PDF: the same, but not sandboxed, which browsers' PDF viewers refuse to open under. */ |
| 22 | export const PDF_POLICY = "default-src 'none'; img-src 'self'; style-src 'unsafe-inline'; object-src 'none'; base-uri 'none'; form-action 'none'"; |
| 23 | |
| 24 | /** The largest file served, in bytes. */ |
| 25 | export const MAX_RAW_BYTES = 10 * 1024 * 1024; |
| 26 | |
| 27 | /** A signed address lasts until the end of the next whole hour, so a page's addresses stay the same for an hour. */ |
| 28 | const TOKEN_HOURS = 2; |
| 29 | |
| 30 | export type RawFile = { owner: string; repo: string; ref: string; path: string }; |
| 31 | |
| 32 | const segment = (value: string) => encodeURIComponent(value); |
| 33 | |
| 34 | /** `/<owner>/<repo>/raw/<ref>/<path>`, each part encoded; a ref's slashes too, so it stays one segment. */ |
| 35 | export function rawPath(file: RawFile): string { |
| 36 | const path = file.path.split("/").filter(Boolean).map(segment).join("/"); |
| 37 | return `/${segment(file.owner)}/${segment(file.repo)}/raw/${segment(file.ref)}/${path}`; |
| 38 | } |
| 39 | |
| 40 | /** The parts of a raw file's path, decoded; null for any other path. */ |
| 41 | export function parseRawPath(pathname: string): RawFile | null { |
| 42 | const parts = pathname.split("/").slice(1); |
| 43 | if (parts.length < 5 || parts[2] !== "raw") return null; |
| 44 | try { |
| 45 | const [owner, repo, , ref, ...rest] = parts.map(decodeURIComponent); |
| 46 | const path = rest.join("/"); |
| 47 | if (!owner || !repo || !ref || !path || rest.some((part) => !part || part === "." || part === "..")) return null; |
| 48 | return { owner, repo, ref, path }; |
| 49 | } catch { |
| 50 | return null; |
| 51 | } |
| 52 | } |
| 53 | |
| 54 | /** |
| 55 | * The part of `url` under the usercontent address `base`, or null when it |
| 56 | * is not there: on its own host, any path; as a path on the site |
| 57 | * (`<site>/-/usercontent`), what follows that path, whatever the host the |
| 58 | * request came in on (a proxy may change it). |
| 59 | */ |
| 60 | export function usercontentPath(url: URL, base: string): string | null { |
| 61 | const at = new URL(base); |
| 62 | const prefix = at.pathname.replace(/\/+$/, ""); |
| 63 | if (!prefix) return url.host === at.host ? url.pathname : null; |
| 64 | if (url.pathname === prefix || url.pathname.startsWith(`${prefix}/`)) return url.pathname.slice(prefix.length) || "/"; |
| 65 | return null; |
| 66 | } |
| 67 | |
| 68 | /** Whether a ref names a commit, whose files never change. */ |
| 69 | export function isCommit(ref: string): boolean { |
| 70 | return /^[0-9a-f]{40}$/.test(ref); |
| 71 | } |
| 72 | |
| 73 | const encoder = new TextEncoder(); |
| 74 | |
| 75 | function base64url(bytes: ArrayBuffer): string { |
| 76 | return btoa(String.fromCharCode(...new Uint8Array(bytes))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""); |
| 77 | } |
| 78 | |
| 79 | function fromBase64url(text: string): Uint8Array<ArrayBuffer> | null { |
| 80 | try { |
| 81 | const plain = atob(text.replace(/-/g, "+").replace(/_/g, "/")); |
| 82 | return Uint8Array.from(plain, (c) => c.charCodeAt(0)); |
| 83 | } catch { |
| 84 | return null; |
| 85 | } |
| 86 | } |
| 87 | |
| 88 | function hmacKey(secret: string, use: KeyUsage): Promise<CryptoKey> { |
| 89 | return crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [use]); |
| 90 | } |
| 91 | |
| 92 | /** What a token signs: the file, by the repository's path and id, and when it ends. */ |
| 93 | function signed(file: RawFile, repoId: string, expires: number): Uint8Array<ArrayBuffer> { |
| 94 | return encoder.encode(["raw", file.owner.toLowerCase(), file.repo.toLowerCase(), repoId, file.ref, file.path, String(expires)].join("\n")); |
| 95 | } |
| 96 | |
| 97 | /** A token for one file of a private repository: `<expires>.<repoId>.<signature>`. */ |
| 98 | export async function signRaw(secret: string, file: RawFile, repoId: string, nowMs = Date.now()): Promise<string> { |
| 99 | const hour = 3600; |
| 100 | const expires = (Math.floor(nowMs / 1000 / hour) + TOKEN_HOURS) * hour; |
| 101 | const signature = await crypto.subtle.sign("HMAC", await hmacKey(secret, "sign"), signed(file, repoId, expires)); |
| 102 | return `${expires}.${repoId}.${base64url(signature)}`; |
| 103 | } |
| 104 | |
| 105 | /** The repository id a token is good for, when it is for this file and has not ended; else null. */ |
| 106 | export async function verifyRaw(secret: string, file: RawFile, token: string, nowMs = Date.now()): Promise<string | null> { |
| 107 | const match = /^(\d{1,12})\.([A-Za-z0-9_-]{1,64})\.([A-Za-z0-9_-]{43})$/.exec(token); |
| 108 | if (!match) return null; |
| 109 | const [, at, repoId, signature] = match; |
| 110 | const expires = Number(at); |
| 111 | if (expires * 1000 <= nowMs) return null; |
| 112 | const bytes = fromBase64url(signature!); |
| 113 | if (!bytes) return null; |
| 114 | const ok = await crypto.subtle.verify("HMAC", await hmacKey(secret, "verify"), bytes, signed(file, repoId!, expires)); |
| 115 | return ok ? repoId! : null; |
| 116 | } |
| 117 | |
| 118 | const IMAGES: Record<string, string> = { |
| 119 | png: "image/png", |
| 120 | jpg: "image/jpeg", |
| 121 | jpeg: "image/jpeg", |
| 122 | gif: "image/gif", |
| 123 | webp: "image/webp", |
| 124 | avif: "image/avif", |
| 125 | ico: "image/x-icon", |
| 126 | bmp: "image/bmp", |
| 127 | svg: "image/svg+xml", |
| 128 | }; |
| 129 | |
| 130 | const MEDIA: Record<string, string> = { |
| 131 | mp4: "video/mp4", |
| 132 | webm: "video/webm", |
| 133 | mov: "video/quicktime", |
| 134 | mp3: "audio/mpeg", |
| 135 | ogg: "audio/ogg", |
| 136 | wav: "audio/wav", |
| 137 | woff: "font/woff", |
| 138 | woff2: "font/woff2", |
| 139 | pdf: "application/pdf", |
| 140 | }; |
| 141 | |
| 142 | function extension(path: string): string { |
| 143 | const name = path.split("/").pop() ?? ""; |
| 144 | return name.includes(".") ? name.split(".").pop()!.toLowerCase() : ""; |
| 145 | } |
| 146 | |
| 147 | /** Whether a file shows as an image in a page, by its name. */ |
| 148 | export function isImagePath(path: string): boolean { |
| 149 | return extension(path) in IMAGES; |
| 150 | } |
| 151 | |
| 152 | /** Whether the bytes look like text: no NUL in the first 8,000. */ |
| 153 | function looksLikeText(bytes: Uint8Array): boolean { |
| 154 | return !bytes.subarray(0, 8000).includes(0); |
| 155 | } |
| 156 | |
| 157 | /** |
| 158 | * The headers a file is served with. Images, media and PDFs as |
| 159 | * themselves; any other text (HTML, SVG's script, XML, JavaScript |
| 160 | * included) as plain text; anything else as bytes to save. Never sniffed, |
| 161 | * and nothing in it runs. |
| 162 | */ |
| 163 | export function rawHeaders(path: string, bytes: Uint8Array): Headers { |
| 164 | const ext = extension(path); |
| 165 | const type = IMAGES[ext] ?? MEDIA[ext] ?? (looksLikeText(bytes) ? "text/plain; charset=utf-8" : "application/octet-stream"); |
| 166 | const headers = new Headers({ |
| 167 | "content-type": type, |
| 168 | "content-length": String(bytes.byteLength), |
| 169 | "x-content-type-options": "nosniff", |
| 170 | "content-security-policy": type === "application/pdf" ? PDF_POLICY : USERCONTENT_POLICY, |
| 171 | "cross-origin-resource-policy": "cross-origin", |
| 172 | "referrer-policy": "no-referrer", |
| 173 | }); |
| 174 | if (type === "application/octet-stream") { |
| 175 | const name = path.split("/").pop() ?? "file"; |
| 176 | headers.set("content-disposition", `attachment; filename="${name.replace(/[^\x20-\x7e]|["\\%;]/g, "_")}"; filename*=UTF-8''${encodeURIComponent(name)}`); |
| 177 | } |
| 178 | return headers; |
| 179 | } |
| 180 | |
| 181 | /** |
| 182 | * An image's address: an external one as written; a relative one as the |
| 183 | * repository's raw file at the same commit, or nothing when it climbs out |
| 184 | * of the repository. `rawBase` is the document's folder under |
| 185 | * `/<owner>/<repo>/raw/<ref>`. |
| 186 | */ |
| 187 | export function imageSource(src: string, rawBase: string | undefined): string | undefined { |
| 188 | if (/^[a-z][a-z0-9+.-]*:/i.test(src) || src.startsWith("//") || !rawBase || src.startsWith("#")) return src; |
| 189 | const root = /^\/[^/]+\/[^/]+\/raw\/[^/]+/.exec(rawBase)?.[0]; |
| 190 | if (!root) return src; |
| 191 | const path = src.split(/[?#]/)[0]!; |
| 192 | if (!path) return undefined; |
| 193 | const from = path.startsWith("/") ? `${root}/` : `${rawBase.replace(/\/+$/, "")}/`; |
| 194 | const resolved = new URL(path.replace(/^\/+/, ""), `https://g1t.invalid${from}`).pathname; |
| 195 | return resolved.startsWith(`${root}/`) ? resolved : undefined; |
| 196 | } |