fix: harden authentication and file access security

back/loaders/express.ts

@@ -48,7 +48,26 @@ export default ({ app }: { app: Application }) => {
   }
 
   app.get(`${config.api.prefix}/env.js`, serveEnv);
-  app.use(`${config.api.prefix}/static`, express.static(config.uploadPath));
+  app.use(
+    `${config.api.prefix}/static`,
+    express.static(config.uploadPath, {
+      setHeaders: (res) => {
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        res.setHeader('Content-Security-Policy', "sandbox; default-src 'none'");
+      },
+    }),
+  );
+
+  const credentialPaths = ['/api', '/open'].flatMap((prefix) =>
+    ['/user/login', '/user/init', '/user/two-factor/login'].map(
+      (route) => `${prefix}${route}`,
+    ),
+  );
+  app.use(
+    credentialPaths,
+    bodyParser.json({ limit: '16kb' }),
+    bodyParser.urlencoded({ limit: '16kb', extended: false }),
+  );
 
   app.use(bodyParser.json({ limit: '50mb' }));
   app.use(bodyParser.urlencoded({ limit: '50mb', extended: true }));
@@ -123,7 +142,7 @@ export default ({ app }: { app: Application }) => {
     }
 
     const authInfo = await shareStore.getAuthInfo();
-    if (isValidToken(authInfo, headerToken, req.platform)) {
+    if (isValidToken(authInfo, headerToken, req.platform, config.jwt.secret)) {
       return next();
     }
 

back/loaders/sock.ts

@@ -8,26 +8,44 @@ import { isValidToken } from '../shared/auth';
 import config from '../config';
 
 export default async ({ server }: { server: Server }) => {
-  const echo = sockJs.createServer({ prefix: `${config.baseUrl}/api/ws`, log: () => { } });
+  const echo = sockJs.createServer({
+    prefix: `${config.baseUrl}/api/ws`,
+    log: () => {},
+  });
   const sockService = Container.get(SockService);
 
   echo.on('connection', async (conn) => {
     if (!conn.headers || !conn.url || !conn.pathname) {
       conn.close('404');
+      return;
     }
 
     const authInfo = await shareStore.getAuthInfo();
     const platform = getPlatform(conn.headers['user-agent'] || '') || 'desktop';
     const headerToken = conn.url.replace(`${conn.pathname}?token=`, '');
 
-    if (isValidToken(authInfo, headerToken, platform)) {
+    if (isValidToken(authInfo, headerToken, platform, config.jwt.secret)) {
       sockService.addClient(conn);
+      const checkSession = setInterval(async () => {
+        try {
+          const current = await shareStore.getAuthInfo();
+          if (
+            !isValidToken(current, headerToken, platform, config.jwt.secret)
+          ) {
+            conn.close('401');
+          }
+        } catch {
+          conn.close('401');
+        }
+      }, 1000);
+      checkSession.unref();
 
       conn.on('data', (message) => {
         conn.write(message);
       });
 
       conn.on('close', function () {
+        clearInterval(checkSession);
         sockService.removeClient(conn);
       });