Move security checks to users.js

60448f4ce876245e8eb30efba721b27cba856cfa

Cohee <18619528+Cohee1207@users.noreply.github.com>

Parents: d5056a556313da8d09ef459f5fe7edda885a3cb0

index.d.ts+6 -0 Viewed

 import { UserDirectoryList, User } from "./src/users";
 +import { CommandLineArguments } from "./src/command-line";
 import { CsrfSyncedToken } from "csrf-sync";
 declare global {

      * The root directory for user data.
      */
     var DATA_ROOT: string;
++
 +    /**
 +     * Parsed command line arguments.
 +     */
 +    var COMMAND_LINE_ARGS: CommandLineArguments;
+}

server.js+23 -115 Viewed

     initUserStorage,
     getCookieSecret,
     getCookieSessionName,
 -    getAllEnabledUsers,
     ensurePublicDirectoriesExist,
     getUserDirectoriesList,
     migrateSystemPrompts,

     requireLoginMiddleware,
     setUserDataMiddleware,
     shouldRedirectToLogin,
 -    tryAutoLogin,
     cleanUploads,
     getSessionCookieAge,
 +    verifySecuritySettings,
 +    loginPageMiddleware,
 } from './src/users.js';
 import getWebpackServeMiddleware from './src/middleware/webpack-serve.js';

 import corsProxyMiddleware from './src/middleware/corsProxy.js';
 import {
     getVersion,
 -    getConfigValue,
     color,
     removeColorFormatting,
     getSeparator,

 util.inspect.defaultOptions.maxStringLength = null;
 util.inspect.defaultOptions.depth = 4;
 +// Set a working directory for the server
 +const serverDirectory = import.meta.dirname ?? path.dirname(fileURLToPath(import.meta.url));
 +console.log(`Node version: ${process.version}. Running in ${process.env.NODE_ENV} environment. Server directory: ${serverDirectory}`);
 +process.chdir(serverDirectory);
++
 // Work around a node v20.0.0, v20.1.0, and v20.2.0 bug. The issue was fixed in v20.3.0.
 // https://github.com/nodejs/node/issues/47822#issuecomment-1564708870
 // Safe to remove once support for Node v20 is dropped.

     if (net.setDefaultAutoSelectFamily) net.setDefaultAutoSelectFamily(false);
+}
 const cliParsercliArgs = new CommandLineParser().parse(process.argv);
 -const cliArgs = cliParser.parse(process.argv);
 globalThis.DATA_ROOT = cliArgs.dataRoot;
 +globalThis.COMMAND_LINE_ARGS = cliArgs;
 if (!cliArgs.enableIPv6 && !cliArgs.enableIPv4) {
     console.error('error: You can\'t disable all internet protocols: at least IPv6 or IPv4 must be enabled.');
     process.exit(1);
+}
 -// change all relative paths
 +try {
 -const serverDirectory = import.meta.dirname ?? path.dirname(fileURLToPath(import.meta.url));
 +    if (cliArgs.dnsPreferIPv6) {
 -console.log(`Node version: ${process.version}. Running in ${process.env.NODE_ENV} environment. Server directory: ${serverDirectory}`);
 +        dns.setDefaultResultOrder('ipv6first');
 -process.chdir(serverDirectory);
 +        console.log('Preferring IPv6 for DNS resolution');
 +    } else {
 +        dns.setDefaultResultOrder('ipv4first');
 +        console.log('Preferring IPv4 for DNS resolution');
 +    }
 +} catch (error) {
 +    console.warn('Failed to set DNS resolution order. Possibly unsupported in this Node version.');
 +}
 const app = express();
 app.use(helmet({

 app.use(compression());
 app.use(responseTime());
 -/** @type {boolean} */
 -const enableAccounts = getConfigValue('enableUserAccounts', false, 'boolean');
+-
 -if (cliArgs.dnsPreferIPv6) {
 -    // Set default DNS resolution order to IPv6 first
 -    dns.setDefaultResultOrder('ipv6first');
 -    console.log('Preferring IPv6 for DNS resolution');
 -} else {
 -    // Set default DNS resolution order to IPv4 first
 -    dns.setDefaultResultOrder('ipv4first');
 -    console.log('Preferring IPv4 for DNS resolution');
 -}
+-
 // CORS Settings //
 const CORS = cors({
     origin: 'null',

 });
 // Host login page
 app.get('/login', async (request, responseloginPageMiddleware) => {;
 -    if (!enableAccounts) {
 -        console.log('User accounts are disabled. Redirecting to index page.');
 -        return response.redirect('/');
 -    }
+-
 -    try {
 -        const autoLogin = await tryAutoLogin(request, cliArgs.basicAuthMode);
+-
 -        if (autoLogin) {
 -            return response.redirect('/');
 -        }
 -    } catch (error) {
 -        console.error('Error during auto-login:', error);
 -    }
+-
 -    return response.sendFile('login.html', { root: path.join(process.cwd(), 'public') });
 -});
 // Host frontend assets
 const webpackMiddleware = getWebpackServeMiddleware();

     await settingsInit();
     await statsInit();
     const cleanupPluginspluginsDirectory = await initializePluginspath.join(serverDirectory, 'plugins');
 +    const cleanupPlugins = await loadPlugins(app, pluginsDirectory);
     const consoleTitle = process.title;
     let isExiting = false;

+}
 /**
 - * Loads server plugins from a directory.
 - * @returns {Promise<Function>} Function to be run on server exit
 - */
 -async function initializePlugins() {
 -    try {
 -        const pluginDirectory = path.join(serverDirectory, 'plugins');
 -        const cleanupPlugins = await loadPlugins(app, pluginDirectory);
 -        return cleanupPlugins;
 -    } catch {
 -        console.log('Plugin loading failed.');
 -        return () => { };
 -    }
 -}
+-
 -/**
 - * Prints an error message and exits the process if necessary
 - * @param {string} message The error message to print
 - * @returns {void}
 - */
 -function logSecurityAlert(message) {
 -    if (cliArgs.basicAuthMode || cliArgs.whitelistMode) return; // safe!
 -    console.error(color.red(message));
 -    if (getConfigValue('securityOverride', false, 'boolean')) {
 -        console.warn(color.red('Security has been overridden. If it\'s not a trusted network, change the settings.'));
 -        return;
 -    }
 -    process.exit(1);
 -}
+-
 -async function verifySecuritySettings() {
 -    // Skip all security checks as listen is set to false
 -    if (!cliArgs.listen) {
 -        return;
 -    }
+-
 -    if (!enableAccounts) {
 -        logSecurityAlert('Your current SillyTavern configuration is insecure (listening to non-localhost). Enable whitelisting, basic authentication or user accounts.');
 -    }
+-
 -    const users = await getAllEnabledUsers();
 -    const unprotectedUsers = users.filter(x => !x.password);
 -    const unprotectedAdminUsers = unprotectedUsers.filter(x => x.admin);
+-
 -    if (unprotectedUsers.length > 0) {
 -        console.warn(color.blue('A friendly reminder that the following users are not password protected:'));
 -        unprotectedUsers.map(x => `${color.yellow(x.handle)} ${color.red(x.admin ? '(admin)' : '')}`).forEach(x => console.warn(x));
 -        console.log();
 -        console.warn(`Consider setting a password in the admin panel or by using the ${color.blue('recover.js')} script.`);
 -        console.log();
+-
 -        if (unprotectedAdminUsers.length > 0) {
 -            logSecurityAlert('If you are not using basic authentication or whitelisting, you should set a password for all admin users.');
 -        }
 -    }
+-
 -    if (cliArgs.basicAuthMode) {
 -        const perUserBasicAuth = getConfigValue('perUserBasicAuth', false, 'boolean');
 -        if (perUserBasicAuth && !enableAccounts) {
 -            console.error(color.red(
 -                'Per-user basic authentication is enabled, but user accounts are disabled. This configuration may be insecure.',
 -            ));
 -        } else if (!perUserBasicAuth) {
 -            const basicAuthUserName = getConfigValue('basicAuthUser.username', '');
 -            const basicAuthUserPassword = getConfigValue('basicAuthUser.password', '');
 -            if (!basicAuthUserName || !basicAuthUserPassword) {
 -                console.warn(color.yellow(
 -                    'Basic Authentication is enabled, but username or password is not set or empty!',
 -                ));
 -            }
 -        }
 -    }
 -}
+-
 -/**
  * Registers a not-found error response if a not-found error page exists. Should only be called after all other middlewares have been registered.
  */
 function apply404Middleware() {

src/plugin-loader.js+37 -32 Viewed

  * be called before the server shuts down.
  */
 export async function loadPlugins(app, pluginsPath) {
 -    const exitHooks = [];
 +    try {
 -    const emptyFn = () => { };
 +        const exitHooks = [];
 +        const emptyFn = () => { };
             // Server plugins are disabled.
             if (!enableServerPlugins) {
                     return emptyFn;
+            }
             // Plugins directory does not exist.
             if (!fs.existsSync(pluginsPath)) {
                     return emptyFn;
+            }
             const files = fs.readdirSync(pluginsPath);
             // No plugins to load.
             if (files.length === 0) {
                     return emptyFn;
+            }
             await updatePlugins(pluginsPath);
             for (const file of files) {
                     const pluginFilePath = path.join(pluginsPath, file);
                     if (fs.statSync(pluginFilePath).isDirectory()) {
                             await loadFromDirectory(app, pluginFilePath, exitHooks);
                             continue;
+                    }
++
 +            // Not a JavaScript file.
 +            if (!isCommonJS(file) && !isESModule(file)) {
 +                continue;
 +            }
 -        // Not a JavaScript file.
 +            await loadFromFile(app, pluginFilePath, exitHooks);
 -        if (!isCommonJS(file) && !isESModule(file)) {
 -            continue;
+        }
 -        await loadFromFile(app, pluginFilePath, exitHooks);
 +        if (loadedPlugins.size > 0) {
 -    }
 +            console.log(`${loadedPlugins.size} server plugin(s) are currently loaded. Make sure you know exactly what they do, and only install plugins from trusted sources!`);
 +        }
 -    if (loadedPlugins.size > 0) {
 +        // Call all plugin "exit" functions at once and wait for them to finish
 -        console.log(`${loadedPlugins.size} server plugin(s) are currently loaded. Make sure you know exactly what they do, and only install plugins from trusted sources!`);
 +        return () => Promise.all(exitHooks.map(exitFn => exitFn()));
 +    } catch (error) {
 +        console.error('Plugin loading failed.', error);
 +        return () => { };
+    }
+-
 -    // Call all plugin "exit" functions at once and wait for them to finish
 -    return () => Promise.all(exitHooks.map(exitFn => exitFn()));
+}
 async function loadFromDirectory(app, pluginDirectoryPath, exitHooks) {

src/users.js+91 -0 Viewed

     return directoriesList;
+}
 +/**
 + * Prints an error message and exits the process if necessary
 + * @param {string} message The error message to print
 + * @returns {void}
 + */
 +function logSecurityAlert(message) {
 +    const { basicAuthMode, whitelistMode } = globalThis.COMMAND_LINE_ARGS;
 +    if (basicAuthMode || whitelistMode) return; // safe!
 +    console.error(color.red(message));
 +    if (getConfigValue('securityOverride', false, 'boolean')) {
 +        console.warn(color.red('Security has been overridden. If it\'s not a trusted network, change the settings.'));
 +        return;
 +    }
 +    process.exit(1);
 +}
++
 +/**
 + * Verifies the security settings and prints warnings if necessary
 + * @returns {Promise<void>}
 + */
 +export async function verifySecuritySettings() {
 +    const { listen, basicAuthMode } = globalThis.COMMAND_LINE_ARGS;
++
 +    // Skip all security checks as listen is set to false
 +    if (!listen) {
 +        return;
 +    }
++
 +    if (!ENABLE_ACCOUNTS) {
 +        logSecurityAlert('Your current SillyTavern configuration is insecure (listening to non-localhost). Enable whitelisting, basic authentication or user accounts.');
 +    }
++
 +    const users = await getAllEnabledUsers();
 +    const unprotectedUsers = users.filter(x => !x.password);
 +    const unprotectedAdminUsers = unprotectedUsers.filter(x => x.admin);
++
 +    if (unprotectedUsers.length > 0) {
 +        console.warn(color.blue('A friendly reminder that the following users are not password protected:'));
 +        unprotectedUsers.map(x => `${color.yellow(x.handle)} ${color.red(x.admin ? '(admin)' : '')}`).forEach(x => console.warn(x));
 +        console.log();
 +        console.warn(`Consider setting a password in the admin panel or by using the ${color.blue('recover.js')} script.`);
 +        console.log();
++
 +        if (unprotectedAdminUsers.length > 0) {
 +            logSecurityAlert('If you are not using basic authentication or whitelisting, you should set a password for all admin users.');
 +        }
 +    }
++
 +    if (basicAuthMode) {
 +        const perUserBasicAuth = getConfigValue('perUserBasicAuth', false, 'boolean');
 +        if (perUserBasicAuth && !ENABLE_ACCOUNTS) {
 +            console.error(color.red(
 +                'Per-user basic authentication is enabled, but user accounts are disabled. This configuration may be insecure.',
 +            ));
 +        } else if (!perUserBasicAuth) {
 +            const basicAuthUserName = getConfigValue('basicAuthUser.username', '');
 +            const basicAuthUserPassword = getConfigValue('basicAuthUser.password', '');
 +            if (!basicAuthUserName || !basicAuthUserPassword) {
 +                console.warn(color.yellow(
 +                    'Basic Authentication is enabled, but username or password is not set or empty!',
 +                ));
 +            }
 +        }
 +    }
 +}
++
 export function cleanUploads() {
     try {
         const uploadsPath = path.join(globalThis.DATA_ROOT, UPLOADS_DIRECTORY);

+}
 /**
 + * Middleware to host the login page.
 + * @param {import('express').Request} request Request object
 + * @param {import('express').Response} response Response object
 + */
 +export async function loginPageMiddleware(request, response) {
 +    if (!ENABLE_ACCOUNTS) {
 +        console.log('User accounts are disabled. Redirecting to index page.');
 +        return response.redirect('/');
 +    }
++
 +    try {
 +        const { basicAuthMode } = globalThis.COMMAND_LINE_ARGS;
 +        const autoLogin = await tryAutoLogin(request, basicAuthMode);
++
 +        if (autoLogin) {
 +            return response.redirect('/');
 +        }
 +    } catch (error) {
 +        console.error('Error during auto-login:', error);
 +    }
++
 +    return response.sendFile('login.html', { root: path.join(process.cwd(), 'public') });
 +}
++
 +/**
  * Creates a route handler for serving files from a specific directory.
  * @param {(req: import('express').Request) => string} directoryFn A function that returns the directory path to serve files from
  * @returns {import('express').RequestHandler}