mirror of
https://github.com/navidrome/navidrome.git
synced 2026-10-08 18:37:09 +02:00
* fix(share): always assign the authenticated user as share owner A share's UserID was taken from the request body and only defaulted when empty, so any authenticated user could create a share attributed to another user. For playlist shares the contents are resolved in the owner's library-access context, turning the spoofed owner into an access-escalation vector in multi-library setups. Force the owner from the request context at both the service boundary and the persistence layer, ignoring any client-supplied UserID. * fix(plugins): block SSRF to private IPs resolved from hostnames The HTTP host client only checked the literal host string, so a symbolic hostname (or a trailing-dot "localhost.") resolving to a private/loopback address bypassed the SSRF guard when a plugin declared no requiredHosts. Enforce the check at dial time via net.Dialer.Control on the resolved IP, which also covers redirect hops and DNS rebinding. When an explicit requiredHosts allowlist is set, defer to it as the operator's trust decision. * fix(plugins): gate private IPs on explicit IP/CIDR allowlist entries Following review feedback: an allowlisted hostname authorizes the external service, not whatever private IP it may resolve or rebind to. Enforce the resolved-IP guard even when requiredHosts is set, permitting a private address only when a literal IP or CIDR entry explicitly covers it. This keeps "reach this external API" and "reach my internal network" as two separate, explicit operator decisions. * fix(plugins): treat unspecified addresses as private in the SSRF guard Dialing 0.0.0.0 or :: reaches the local host, so they bypassed the private/loopback check. * fix(plugins): let a bare "*" allowlist reach private addresses Plugins such as AudioMuse-AI declare requiredHosts ["*"] to reach a user-configured service on the LAN, whose address the manifest cannot know. Requiring a literal IP/CIDR entry broke them. Named hosts and subdomain wildcards still cannot resolve to private addresses. * refactor(plugins): simplify the SSRF-guarded HTTP client and release its pool Build the client directly around the guarded transport instead of replacing a throwaway one, fail closed on an unparseable dial address, and close the per-plugin transport's idle connections when the plugin unloads. Trim stale comments. * fix(plugins): stop enabling extism's unguarded http_request host function Passing requiredHosts as the extism manifest's AllowedHosts enabled extism's own http_request (pdk.NewHTTPRequest), which only glob-matches the hostname and follows redirects without re-checking, bypassing the resolved-IP SSRF guard. Plugins must use host.HTTPSend. * fix(plugins): move bundled Rust examples to the host HTTP service Extism's built-in http_request is now disabled, so the webhook and Discord examples switch to nd_pdk::host::http::send. Update the README to say host.HTTPSend is the only supported way to make HTTP requests. * fix(plugins): move the Python example to the host HTTP service coverartarchive-py used extism's built-in Http.request, which is now disabled. Call Navidrome's http_send host function instead. The plugin can no longer run under the standalone extism CLI, so drop the CLI test targets and instructions.
107 lines
3.9 KiB
Go
107 lines
3.9 KiB
Go
package core
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/deluan/rest"
|
|
"github.com/navidrome/navidrome/model"
|
|
"github.com/navidrome/navidrome/model/request"
|
|
"github.com/navidrome/navidrome/tests"
|
|
. "github.com/onsi/ginkgo/v2"
|
|
. "github.com/onsi/gomega"
|
|
)
|
|
|
|
var _ = Describe("Share", func() {
|
|
var ds model.DataStore
|
|
var share Share
|
|
var mockedRepo rest.Persistable
|
|
ctx := context.Background()
|
|
|
|
BeforeEach(func() {
|
|
ds = &tests.MockDataStore{}
|
|
mockedRepo = ds.Share(ctx).(rest.Persistable)
|
|
share = NewShare(ds)
|
|
})
|
|
|
|
Describe("NewRepository", func() {
|
|
var repo rest.Persistable
|
|
|
|
BeforeEach(func() {
|
|
repo = share.NewRepository(ctx).(rest.Persistable)
|
|
_ = ds.Album(ctx).Put(&model.Album{ID: "123", Name: "Album"})
|
|
})
|
|
|
|
Describe("Save", func() {
|
|
It("it sets a random ID", func() {
|
|
entity := &model.Share{Description: "test", ResourceIDs: "123"}
|
|
id, err := repo.Save(entity)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(id).ToNot(BeEmpty())
|
|
Expect(entity.ID).To(Equal(id))
|
|
})
|
|
|
|
It("assigns the logged-in user as owner, ignoring a client-supplied UserID", func() {
|
|
loggedInCtx := request.WithUser(context.Background(), model.User{ID: "logged-in-user"})
|
|
repo := share.NewRepository(loggedInCtx).(rest.Persistable)
|
|
entity := &model.Share{Description: "test", ResourceIDs: "123", UserID: "victim-user"}
|
|
_, err := repo.Save(entity)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(entity.UserID).To(Equal("logged-in-user"))
|
|
})
|
|
|
|
It("does not truncate ASCII labels shorter than 30 characters", func() {
|
|
_ = ds.MediaFile(ctx).Put(&model.MediaFile{ID: "456", Title: "Example Media File"})
|
|
entity := &model.Share{Description: "test", ResourceIDs: "456"}
|
|
_, err := repo.Save(entity)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(entity.Contents).To(Equal("Example Media File"))
|
|
})
|
|
|
|
It("truncates ASCII labels longer than 30 characters", func() {
|
|
_ = ds.MediaFile(ctx).Put(&model.MediaFile{ID: "789", Title: "Example Media File But The Title Is Really Long For Testing Purposes"})
|
|
entity := &model.Share{Description: "test", ResourceIDs: "789"}
|
|
_, err := repo.Save(entity)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(entity.Contents).To(Equal("Example Media File But The ..."))
|
|
})
|
|
|
|
It("does not truncate CJK labels shorter than 30 runes", func() {
|
|
_ = ds.MediaFile(ctx).Put(&model.MediaFile{ID: "456", Title: "青春コンプレックス"})
|
|
entity := &model.Share{Description: "test", ResourceIDs: "456"}
|
|
_, err := repo.Save(entity)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(entity.Contents).To(Equal("青春コンプレックス"))
|
|
})
|
|
|
|
It("truncates CJK labels longer than 30 runes", func() {
|
|
_ = ds.MediaFile(ctx).Put(&model.MediaFile{ID: "789", Title: "私の中の幻想的世界観及びその顕現を想起させたある現実での出来事に関する一考察"})
|
|
entity := &model.Share{Description: "test", ResourceIDs: "789"}
|
|
_, err := repo.Save(entity)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(entity.Contents).To(Equal("私の中の幻想的世界観及びその顕現を想起させたある現実で..."))
|
|
})
|
|
|
|
It("fails when any of the resource IDs does not exist", func() {
|
|
entity := &model.Share{Description: "test", ResourceIDs: "123,missing"}
|
|
_, err := repo.Save(entity)
|
|
Expect(err).To(MatchError(model.ErrNotFound))
|
|
})
|
|
|
|
It("fails when the resource IDs are of mixed types", func() {
|
|
_ = ds.MediaFile(ctx).Put(&model.MediaFile{ID: "456", Title: "Example Media File"})
|
|
entity := &model.Share{Description: "test", ResourceIDs: "123,456"}
|
|
_, err := repo.Save(entity)
|
|
Expect(err).To(HaveOccurred())
|
|
})
|
|
})
|
|
|
|
Describe("Update", func() {
|
|
It("filters out read-only fields", func() {
|
|
entity := &model.Share{}
|
|
err := repo.Update("id", entity)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(mockedRepo.(*tests.MockShareRepo).Cols).To(ConsistOf("description", "downloadable"))
|
|
})
|
|
})
|
|
})
|
|
})
|