Commit graph

648 commits

Author SHA1 Message Date
David Mehren
9ab8bf3cac Fix crash in LDAP authentication
Since https://github.com/vesse/node-ldapauth-fork/commit
/741a648df98d789856b3301d65103b74872fdeea, ldapauth-fork calls `push` on
 the attributes array.

 Since we deep-freeze our config object in https://github
 .com/hedgedoc/hedgedoc/blob/master/lib/config/index.js#L200, this
 causes a crash.

 This commit fixes the crash by creating a mutable clone of the LDAP
 config and passing that to the LDAP strategy.

 Fixes https://github.com/hedgedoc/hedgedoc/issues/2561

Signed-off-by: David Mehren <git@herrmehren.de>
2022-08-22 09:01:04 +02:00
Lautaro Alvarez
3585dc9ee6 Upload file to s3: make public a file on upload and allow to configure destination folder
New configurations:
- s3folder: (string) folder to save the files inside bucket
- s3publicFiles: (boolean) indicate if should send ACL parameters

Signed-off-by: Lautaro Alvarez <lautarolalvarez@gmail.com>
2022-07-10 17:44:17 +02:00
Renovate Bot
0e8631a5dc fix(deps): update dependency passport to ^0.6.0
Signed-off-by: Renovate Bot <bot@renovateapp.com>
Signed-off-by: David Mehren <git@herrmehren.de>
2022-06-05 22:36:55 +02:00
Sheogorath
dd539273fb fix(migrations): Remove unexpected shell call
This patch removes the call of `/usr/bin/env` when calling the migration
script in favour of using the processes own nodejs invocation path.

This should drop the requirement for `/usr/bin/env` to exist on a
system/in a container that runs hedgedoc.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2022-05-17 14:04:02 +02:00
David Mehren
d26dcd04a1
Adapt code for eslint-config-standard 17
Signed-off-by: David Mehren <git@herrmehren.de>
2022-05-01 21:19:44 +02:00
David Mehren
f544b15eea
Ignore stderr when calling git executable
This hopefully prevents confusing error messages in the docker image.

Signed-off-by: David Mehren <git@herrmehren.de>
2022-04-10 21:49:25 +02:00
Erik Michelson
0093aa4783 Fix GitLab snippet export
The snippet export broke due to two reasons.
First of all, the request to GitLab fail in the
default configuration due to the CSP not being
set properly. This commit adds the configured
GitLab base url to the connect-src directives.
The second problem is a change in the GitLab API
spec. Instead of `code` and `file_name` the
GitLab API now requires an `files` array with
`content` and `file_path` entries per snippet.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2022-04-10 21:24:30 +02:00
David Mehren
0195f16d9a
Fix linter errors in imageRouter
Signed-off-by: David Mehren <git@herrmehren.de>
2022-04-10 21:16:35 +02:00
Sheogorath
9e2f9e21e9 fix(imageRouter): Fix enumerable image upload issue
This patch adds an own filename function for `formidable`, which will
make sure to generate a random file name, using UUIDv4. This should
resolve GHSA-q6vv-2q26-j7rx.

This change is required due to a change in behaviour from version 1 to
version 2 of formidable. Formidable version 2 will generate predictable
filenames by default, which results in potential access to images, that
were uploaded while formidable v2 was used in Hedgedoc. This affects the
versions `1.9.1` and `1.9.2`.

Files generated previous to this commit will look like this:

```
<random string generated on app start><counter>.<file-extension>
38e56506ec2dcab52e9282c00.jpg
38e56506ec2dcab52e9282c01.jpg
38e56506ec2dcab52e9282c02.jpg
```

After this patch it'll look like this:

```
<uuid v4>.<file-extension>
a67f36b8-9afb-43c2-9ef2-a567a77d8628.jpg
56b3d5d0-c586-4679-9ae6-d2044843c2cd.jpg
2af727ac-a2d4-4aad-acb5-73596c2a7eb6.jpg
```

This patch was implemented using `uuid` since we already utilise this
package elsewhere in the project as well as using a secure function to
generate random strings. UUIDv4 is ideal for that. In order to be
consumable by formidable, it was wrapped in a function that makes sure
to keep the file extension.

This vulnerability was reported by Matias from [NCSC-FI](https://www.kyberturvallisuuskeskus.fi/).

References:
https://github.com/node-formidable/formidable/blob/v2-latest/src/Formidable.js#L574
https://github.com/node-formidable/formidable/issues/808#issuecomment-1007090762
https://www.npmjs.com/package/uuid
2022-04-10 21:08:32 +02:00
Moritz Schlarb
e6fc9f01a3 Allow SAML authentication provider to be named
Using `CMD_SAML_PROVIDERNAME` and the respective auth provider objects
in the configuration structures.

Signed-off-by: Moritz Schlarb <schlarbm@uni-mainz.de>
2022-03-20 19:59:53 +01:00
Erik Michelson
d8faf3e342
Use identicons as fallback for libravatar
The usage of identicons makes users more distinguishable as when only the default librvatar image is used.
This only applies to users that have no avatar on libravatar or gravatar.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2022-01-07 14:03:26 +01:00
Erik Michelson
6e983ba5dc
Use libravatar image if email address is defined
We use the attribute `emails` (plural) for email addresses with other auth providers like LDAP or SAML. In case of OAuth2 we used the attribute `email` (singular) which resulted in problems.
Furthermore the OAuth2 strategy fell into the default fallback of the provider switch statement. This statement did not check email addresses but did generate the letter-avatar instantly.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2022-01-07 14:01:32 +01:00
Yannick Bungers
386c08a339
Merge branch 'master' into renovate/master-formidable-2.x 2021-12-02 19:59:39 +01:00
David Mehren
6acb23f26d
Fix checkUploadType after upgrade to file-type 17
This package is now ESM-only, so we need to `import()` it and
raise the oldest supported Node version.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-12-02 17:30:47 +01:00
David Mehren
7c5c2f7981
Fix imageRouter after upgrade to formidable 2
file.path is now file.filepath, and we need to use the proper constructor

See https://github.com/node-formidable/formidable/blob/master/CHANGELOG.md#200

Signed-off-by: David Mehren <git@herrmehren.de>
2021-12-02 17:19:24 +01:00
Tilman Vatteroth
d7a3e0f58c
Don't throw error if gitlab response is not okay-ish
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2021-10-29 20:57:20 +02:00
Tilman Vatteroth
d7986b1920
Refactor existing code to add the configured domain to connect-src
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2021-09-16 19:43:20 +02:00
David Mehren
957d7d553e
Merge pull request #1394 from hedgedoc/remove-cdn 2021-08-15 20:11:26 +02:00
David Mehren
e6d167c63c
CSP: Allow all sources for media
Otherwise, `video` tags and reveal background video
does not work

Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-15 00:35:57 +02:00
David Mehren
6c722f0ad6
Add config option to disallow embedding PDFs
Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-15 00:22:31 +02:00
David Mehren
c002c7b681
CSP: Allow self as manifest-src
Chrome complains otherwise, as it can't download the Web Manifest.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-15 00:22:31 +02:00
David Mehren
46cd60c510
CSP: Allow self as frame-src
The reveal.js speaker view uses frames to display the slides

Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-15 00:22:30 +02:00
David Mehren
1642242078
CSP: Allow styles from /css/
Reveal.js styles are hosted there

Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-15 00:22:30 +02:00
David Mehren
1c0af5f75d
Cleanup csp.js
Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-15 00:22:30 +02:00
David Mehren
bd44cbc16c
Add config option to disallow framing via CSP
Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-15 00:22:30 +02:00
David Mehren
9499add64c
Tighten up default Content-Security-Policy
This commit changes the
- default-src to none, so everything is disallowed by default
- base-uri, connect-uri and font-src to self,
  so these are restricted to the current origin
- frame-src to allow SlideShare, Vimeo and YouTube
- script-src to the specific paths that are used by HedgeDoc to serve scripts.
  This explicitly does not include the /uploads route
 - style-src to the specific paths that are used by HedgeDoc to serve styles
 -

Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-15 00:22:30 +02:00
David Mehren
8b69ac1bcf
Fix unescaped line break in git output
Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-15 00:16:46 +02:00
Tilman Vatteroth
9498ee6bfe
Remove cdn support
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2021-08-15 00:09:53 +02:00
David Mehren
cc76201cfb
Merge pull request #1533 from hedgedoc/feature/database-env
feat(config): Improve configurability of database by env
2021-08-14 23:41:58 +02:00
David Mehren
de64142511
Merge pull request #1540 from hedgedoc/fix/get_git_commit 2021-08-14 21:47:18 +02:00
Sheogorath
c025d6abee
fix(image-upload): Fix swallowing of errors for filesystem
This patch fixes the swollowing of the actual error message that appears
when a file fails to move, after being uploaded to Hedgedoc on an
instance that is using the upload-method `filesystem` active.

This became apparent when the error messages provided by some users,
where less than helpful.

As a solution the error message of the copy command was added to the
error that is output to the console.

https://community.hedgedoc.org/t/image-upload-fail-docker/439

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2021-08-14 20:04:08 +02:00
David Mehren
b719ce79db
Fix crash while getting current git commit
HedgeDoc crashed with
`uncaughtException: ENOENT: no such file or directory`
on startup, when `.git/ref/heads` did not contain
a file for the current branch. This seems to happen
regularly with current Git versions.

This fixes the crash by first trying to use the `git` executable for
getting the current commit SHA (before running our own parsing code)
and introducing a separate check to prevent accessing a nonexistent
file in `.git/ref/heads`.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-14 16:08:55 +02:00
Sheogorath
1428a8e006
feat(config): Improve configurability of database by env
This patch implements 6 additional environment variables that are used
for configuration of the database in order to allow easier configuration
in containerised environments, such as Kubernetes.

An example is the upcoming deployment of the demo instance that will use
an operator-backed postgresql database. This operator exposes username
and password as separate variables and while it's obviously possible to
generate a dbURL from that, this won't be possible without additional
code. Aiming for a solution in Hedgedoc itself, will help us to enable
other people in using Hedgedoc on Kubernetes without resulting in overly
customised setups for simple tasks like this.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2021-08-13 01:58:53 +02:00
Matej Cotman
65fac143f6 fix(s3): replace dash with dot for s3 endpoint
According to the AWS documentation there is no situation that there is a dash in `s3-<region>.amazonaws.com`, the correct way is with a dot `s3.<region>.amazonaws.com`
Source: https://docs.aws.amazon.com/general/latest/gr/s3.html

Signed-off-by: Matej Cotman <matej.cotman@eficode.com>
2021-08-04 16:09:08 +03:00
David Mehren
84571ac0e8
Merge pull request #1474 from hedgedoc/failing-migrations-notice
[1.x] Add help link and short explanation for failing migrations
2021-08-01 18:22:37 +02:00
Erik Michelson
95a8b5c5be
Add help link and short explanation for failing migrations
See #1419

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2021-07-21 00:06:07 +02:00
Erik Michelson
90c5ab0833
Exclude /metrics and /status routes from session initialization
This commit adds a `useUnless` helper method which can be used as a middleware for express.
It receives an express-middleware and an array of paths.
When a request matches one of the given paths, this middleware does nothing.
Otherwise the given middleware is called.

For the express-session middleware this helper middleware is used to avoid session creation on purely status routes.
See #1446

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2021-07-20 23:56:54 +02:00
Yannick Bungers
1d082ae827
Merge pull request #1369 from hedgedoc/feature/remove_unsafe_eval 2021-06-08 22:16:07 +02:00
David Mehren
3cd169a650
Remove unsafe-eval from default CSP
As script-loader was removed in the previous commits,
we can finally tighten up security.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 23:04:45 +02:00
David Mehren
7283ccd5e8
Allow configuring Disqus & GA CSP with env vars
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 22:57:12 +02:00
David Mehren
52231f688d
Disable GA and Disqus in default CSP
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 22:57:12 +02:00
David Mehren
7f3c04c9fc
SAML: Use privateKey option
The old `privateCert` option was removed in
https://github.com/node-saml/passport-saml/pull/569

Signed-off-by: David Mehren <git@herrmehren.de>
2021-05-17 18:46:00 +02:00
David Mehren
f552b14e11
Sanitize username and photo URL
HedgeDoc displays the username and user photo at various places
by rendering the respective variables into an `ejs` template.
As the values are user-provided or generated from user-provided data,
it may be possible to inject unwanted HTML.

This commit sanitizes the username and photo URL by passing them
through the `xss` library.

Co-authored-by: Christoph (Sheogorath) Kern <sheogorath@shivering-isles.com>
Signed-off-by: David Mehren <git@herrmehren.de>
2021-05-09 19:28:44 +02:00
David Mehren
aece96f539
Automatically enable protocolUseSSL when useSSL is set
This makes the behavior consistent with the docs and
 saves the user from having to both set
 `useSSL` and `protocolUseSSL`.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-05-06 21:19:14 +02:00
David Mehren
0b61f48129
Fix upgradeInsecureRequests CSP directive
The `upgradeInsecureRequests` option of Helmets CSP middleware
was a boolean in Helmet 3, but with Helmet 4,
everything changed to lists.
This commit adjusts the addUpgradeUnsafeRequestsOptionTo
function accordingly.

Closes #1221

See also https://github.com/helmetjs/helmet/tree/v4.6.0/middlewares/content-security-policy

Signed-off-by: David Mehren <git@herrmehren.de>
2021-05-04 11:10:53 +02:00
Erik Michelson
e54236d057
Remove unneeded polyfill
This polyfill was added because node versions less than 10.5.0 didn't include scrypt support. As we now raised the minimum required version to 12.0.0, this polyfill isn't needed anymore.

Signed-off-by: Erik Michelson <opensource@erik.michelson.eu>
2021-04-26 17:05:20 +02:00
David Mehren
59f669e593
Merge pull request from GHSA-p528-555r-pf87
Fix Relative Path Traversal Attack on note creation
2021-04-25 21:28:18 +02:00
Sheogorath
44b7f607a5
Fix Relative Path Traversal Attack on note creation
Impact
---

An attacker can read arbitrary `.md` files from the server's filesystem due to an [improper input validation](https://cwe.mitre.org/data/definitions/20.html), which results in the ability to perform a [relative path traversal](https://cwe.mitre.org/data/definitions/23.html).

CVSSv3 string: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

PoC / Quicktest
---

To verify if you are affected, you can try to open the following URL: `http://localhost:3000/..%2F..%2FREADME#` (replace `http://localhost:3000` with your instance's base-URL e.g. `https://demo.hedgedoc.org/..%2F..%2FREADME#`).
- If you see a README page being rendered, you run an affected version.

Analysis
---

The attack works due the fact that [the internal router, passes the url-encoded alias](https://github.com/hedgedoc/hedgedoc/blob/master/lib/web/note/router.js#L26) to the `noteController.showNote`-function. This function passes the input directly to [`findNote()`](78a732abe6/lib/web/note/util.js (L10)) utility function, that will pass it on the the [`parseNoteId()`](78a732abe6/lib/models/note.js (L188-L258))-function, that tries to make sense out of the noteId/alias and check if a note already exists and if so, if a corresponding file on disk was updated.

If no note exists the [note creation-function is called](78a732abe6/lib/models/note.js (L240-L245)), which pass this unvalidated alias, with a `.md` appended, into a [`path.join()`-function](78a732abe6/lib/models/note.js (L99)) which is read from the filesystem in the follow up routine and provides the pre-filled content of the new note.

This allows an attacker to not only read arbitrary `.md` files from the filesystem, but also  observes changes to them.

The usefulness of this attack can be considered limited, since mainly markdown files are use the file-ending `.md` and all markdown files contained in the hedgedoc project, like the README, are public anyway. If other protections such as a chroot or container or proper file permissions are in place, this attack's usefulness is rather limited.

Workarounds
---
On a reverse-proxy level one can force a URL-decode, which will prevent this attack because the router will not accept such a path.

For more information
---

If you have any questions or comments about this advisory:
* Open an topic on [our community forum](https://community.hedgedoc.org)
* Join our [matrix room](https://chat.hedgedoc.org)

Advisory link
---

https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-p528-555r-pf87

Signed-off-by: Christoph (Sheogorath) Kern <sheogorath@shivering-isles.com>
2021-04-25 20:40:17 +02:00
David Mehren
5c70cc021f
Add custom prometheus metrics
This reuses the `realtime.getStatus` method to get the state of the
application state on every prometheus scrape cycle.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-04-25 20:06:56 +02:00
Philip Molares
f34d927e8c ImageRouterImgur: Replace imgur library with note-fetch request
This kinda is a backport of https://github.com/hedgedoc/hedgedoc/pull/961

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-04-22 21:23:27 +02:00