jcoffey-dev
f1a2972d3a
**The login rate limiter could be sidestepped.** X-Forwarded-For is a list each hop appends to, and nginx's $proxy_add_x_forwarded_for appends ours — so a client sending "X-Forwarded-For: 1.2.3.4" arrives as "1.2.3.4, <their real address>". Reading the leftmost entry, as we did, handed the caller a rate-limit key they could change per request: unlimited password guessing against a deployment that looks correctly configured. Read from the right instead, skip hops that are themselves trusted proxies, and believe the header only when the peer is one (loopback and the private ranges by default, TRUSTED_PROXIES to be explicit). **The upload cap was a suggestion.** It read content-length, which a chunked request simply omits. Count the bytes through a stream, as the image proxy already does. **App password secrets were drawn with a modulo.** 256 is not a multiple of 33, so the first 25 characters of the alphabet came up on 8 byte values and the last 8 on only 7. Rejection sampling instead. The test weighs the whole tail of the alphabet rather than single characters, because a 7/8 skew is invisible per character against the noise — and it does fail when the bias is put back. **Upstream headers were relayed wholesale.** Anything the mail server set — cookies, auth challenges, CORS grants — landed on our origin, where it means something else. Allowlist what is actually wanted.
89 lines
3.4 KiB
TypeScript
89 lines
3.4 KiB
TypeScript
import { randomBytes } from "node:crypto";
|
|
import { fileURLToPath } from "node:url";
|
|
import { existsSync, readFileSync } from "node:fs";
|
|
import { resolve } from "node:path";
|
|
|
|
/** Minimal .env loader (no dependency): first match wins, never overrides real env. */
|
|
function loadDotEnv() {
|
|
const candidates = [resolve(process.cwd(), ".env"), fileURLToPath(new URL("../../.env", import.meta.url)), fileURLToPath(new URL("../.env", import.meta.url))];
|
|
for (const file of candidates) {
|
|
if (!existsSync(file)) continue;
|
|
for (const line of readFileSync(file, "utf8").split(/\r?\n/)) {
|
|
const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)\s*$/.exec(line);
|
|
if (!m || line.trim().startsWith("#")) continue;
|
|
let v = m[2]!;
|
|
if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) v = v.slice(1, -1);
|
|
if (process.env[m[1]!] === undefined) process.env[m[1]!] = v;
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
loadDotEnv();
|
|
|
|
function env(name: string, fallback?: string): string {
|
|
const v = process.env[name];
|
|
if (v === undefined || v === "") {
|
|
if (fallback === undefined) throw new Error(`Missing required environment variable ${name}`);
|
|
return fallback;
|
|
}
|
|
return v;
|
|
}
|
|
|
|
function bool(name: string, fallback: boolean): boolean {
|
|
const v = process.env[name];
|
|
if (v === undefined || v === "") return fallback;
|
|
return ["1", "true", "yes", "on"].includes(v.toLowerCase());
|
|
}
|
|
|
|
function int(name: string, fallback: number): number {
|
|
const v = process.env[name];
|
|
if (v === undefined || v === "") return fallback;
|
|
const n = Number.parseInt(v, 10);
|
|
if (!Number.isFinite(n)) throw new Error(`Invalid integer for ${name}: ${v}`);
|
|
return n;
|
|
}
|
|
|
|
const isProd = process.env.NODE_ENV === "production";
|
|
let appSecret = process.env.APP_SECRET ?? "";
|
|
if (!appSecret || appSecret === "change-me") {
|
|
if (isProd) {
|
|
throw new Error("APP_SECRET must be set to a strong random value in production");
|
|
}
|
|
appSecret = randomBytes(32).toString("base64");
|
|
console.warn(
|
|
"[ihasmail] APP_SECRET not set - using an ephemeral secret (persisted sessions will not survive restarts)",
|
|
);
|
|
}
|
|
|
|
const stalwartUrl = env("STALWART_URL", "https://mail.example.com").replace(/\/+$/, "");
|
|
|
|
export const config = {
|
|
isProd,
|
|
appName: env("APP_NAME", "ihasmail"),
|
|
host: env("HOST", "0.0.0.0"),
|
|
port: int("PORT", 8080),
|
|
stalwartUrl,
|
|
appSecret,
|
|
trustProxy: bool("TRUST_PROXY", true),
|
|
/**
|
|
* Peers whose X-Forwarded-* headers are believed. Empty falls back to
|
|
* loopback and the private ranges, which covers the usual reverse proxy on
|
|
* the same host or Docker network. A peer outside this is attributed by its
|
|
* socket address whatever it claims.
|
|
*/
|
|
trustedProxies: (process.env.TRUSTED_PROXIES ?? "").split(",").map((s) => s.trim()).filter(Boolean),
|
|
/** "auto" = Secure when the request arrived over https; "1"/"0" to force. */
|
|
secureCookies: (process.env.SECURE_COOKIES ?? "auto").toLowerCase(),
|
|
sessionTtl: int("SESSION_TTL", 12 * 60 * 60),
|
|
sessionRememberTtl: int("SESSION_REMEMBER_TTL", 30 * 24 * 60 * 60),
|
|
sessionFile: process.env.SESSION_FILE ?? "",
|
|
upstreamTimeout: int("UPSTREAM_TIMEOUT", 30_000),
|
|
maxUploadBytes: int("MAX_UPLOAD_BYTES", 50 * 1024 * 1024),
|
|
imageProxy: bool("IMAGE_PROXY", true),
|
|
cookieName: env("COOKIE_NAME", "ihm_session"),
|
|
staticDir: process.env.STATIC_DIR ?? fileURLToPath(new URL("../../web/dist", import.meta.url)),
|
|
loginRateLimit: int("LOGIN_RATE_LIMIT", 10),
|
|
};
|
|
|
|
export type Config = typeof config;
|