From 6dbcf71c7f8ec1cd59fb80526d031de20351992f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 4 Jul 2025 13:03:03 +0000 Subject: [PATCH 1/4] Initial plan From ed88d496c0306077701c5a12ab08aa7f09bf1af5 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 4 Jul 2025 13:08:45 +0000 Subject: [PATCH 2/4] Implement URL title autofill feature for Activity Title field Co-authored-by: horner <6094599+horner@users.noreply.github.com> --- .meteor/packages | 1 + client/main.html | 6 ++- client/main.js | 88 +++++++++++++++++++++++++++++++++++++++ server/main.js | 105 +++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 199 insertions(+), 1 deletion(-) diff --git a/.meteor/packages b/.meteor/packages index 044a30e..aa9de54 100644 --- a/.meteor/packages +++ b/.meteor/packages @@ -25,3 +25,4 @@ hot-module-replacement@0.5.4 # Update code in development without reloading the blaze-hot # Update files using Blaze's API with HMR accounts-base accounts-password +http diff --git a/client/main.html b/client/main.html index 9bf9543..c904bd7 100644 --- a/client/main.html +++ b/client/main.html @@ -140,7 +140,11 @@

My Activities & Tasks

{{#if showCreateTicketForm}}
- + +
diff --git a/client/main.js b/client/main.js index e2be577..304015a 100644 --- a/client/main.js +++ b/client/main.js @@ -14,6 +14,51 @@ const currentScreen = new ReactiveVar('authPage'); const currentTime = new ReactiveVar(Date.now()); setInterval(() => currentTime.set(Date.now()), 1000); +// URL detection and title fetching utilities +let titleFetchTimeout = null; + +function isValidUrl(string) { + try { + const url = new URL(string); + return url.protocol === 'http:' || url.protocol === 'https:'; + } catch (_) { + return false; + } +} + +function showTitleFetchStatus(show = true) { + const statusEl = document.getElementById('titleFetchStatus'); + if (statusEl) { + if (show) { + statusEl.classList.remove('hidden'); + } else { + statusEl.classList.add('hidden'); + } + } +} + +function fetchAndSetTitle(url, inputElement) { + showTitleFetchStatus(true); + + Meteor.call('fetchUrlTitle', url, (error, title) => { + showTitleFetchStatus(false); + + if (error) { + console.warn('Failed to fetch URL title:', error.reason); + return; + } + + if (title && title.trim()) { + // Only set title if the input is still focused on the URL or is empty/unchanged + const currentValue = inputElement.value.trim(); + if (currentValue === url || currentValue === '') { + inputElement.value = title; + inputElement.dispatchEvent(new Event('input', { bubbles: true })); + } + } + }); +} + Template.mainLayout.onCreated(function () { this.autorun(() => { if (Meteor.userId()) { @@ -349,6 +394,49 @@ Template.tickets.events({ 'click #cancelCreateTicket'(e, t) { t.showCreateTicketForm.set(false); }, + 'paste #activityTitle'(e) { + // Handle paste events for URL detection + setTimeout(() => { + const input = e.target; + const value = input.value.trim(); + + if (isValidUrl(value)) { + // Clear any existing timeout + if (titleFetchTimeout) { + clearTimeout(titleFetchTimeout); + } + + // Debounce the request by 300ms + titleFetchTimeout = setTimeout(() => { + fetchAndSetTitle(value, input); + }, 300); + } + }, 10); // Small delay to ensure paste content is available + }, + 'input #activityTitle'(e) { + // Handle typing for URL detection + const input = e.target; + const value = input.value.trim(); + + // Clear any existing timeout + if (titleFetchTimeout) { + clearTimeout(titleFetchTimeout); + } + + // Hide status if no longer a URL + if (!isValidUrl(value)) { + showTitleFetchStatus(false); + return; + } + + // Only trigger for complete URLs (basic heuristic) + if (value.length > 10 && (value.includes('.com') || value.includes('.org') || value.includes('.net') || value.includes('.edu') || value.includes('.gov'))) { + // Debounce the request by 300ms + titleFetchTimeout = setTimeout(() => { + fetchAndSetTitle(value, input); + }, 300); + } + }, 'submit #createTicketForm'(e, t) { e.preventDefault(); const teamId = t.selectedTeamId.get(); diff --git a/server/main.js b/server/main.js index 057b7ed..400fe9b 100644 --- a/server/main.js +++ b/server/main.js @@ -1,6 +1,7 @@ import { Meteor } from 'meteor/meteor'; import { Accounts } from 'meteor/accounts-base'; import { check } from 'meteor/check'; +import { HTTP } from 'meteor/http'; import { Tickets, Teams, Sessions, ClockEvents } from '../collections.js'; function generateTeamCode() { @@ -8,6 +9,66 @@ function generateTeamCode() { return Math.random().toString(36).substr(2, 8).toUpperCase(); } +// Security function to check if a URL is safe to fetch +function isUrlSafe(url) { + try { + const urlObj = new URL(url); + + // Only allow http and https protocols + if (!['http:', 'https:'].includes(urlObj.protocol)) { + return false; + } + + // Block local/private IP ranges + const hostname = urlObj.hostname.toLowerCase(); + + // Block localhost variations + if (['localhost', '127.0.0.1', '::1'].includes(hostname)) { + return false; + } + + // Block private IP ranges (simplified check) + if (hostname.match(/^10\./) || + hostname.match(/^192\.168\./) || + hostname.match(/^172\.(1[6-9]|2\d|3[01])\./) || + hostname.match(/^169\.254\./) || + hostname.match(/^fe80:/)) { + return false; + } + + // Block other local addresses + if (hostname.match(/\.local$/) || hostname.match(/\.localhost$/)) { + return false; + } + + return true; + } catch (e) { + return false; + } +} + +// Function to extract title from HTML content +function extractTitleFromHtml(html) { + try { + // Simple regex to extract title - in production, consider using a proper HTML parser + const titleMatch = html.match(/]*>([^<]*)<\/title>/i); + if (titleMatch && titleMatch[1]) { + // Decode HTML entities and clean up + return titleMatch[1] + .replace(/"/g, '"') + .replace(/&/g, '&') + .replace(/</g, '<') + .replace(/>/g, '>') + .replace(/'/g, "'") + .replace(/ /g, ' ') + .trim(); + } + return null; + } catch (e) { + return null; + } +} + Meteor.startup(async () => { // Code to run on server startup if (await Tickets.find().countAsync() === 0) { @@ -326,4 +387,48 @@ Meteor.methods({ ); } }, + + async fetchUrlTitle(url) { + check(url, String); + + // Validate URL format + if (!url || typeof url !== 'string') { + throw new Meteor.Error('invalid-url', 'Invalid URL provided'); + } + + // Check if URL is safe to fetch + if (!isUrlSafe(url)) { + throw new Meteor.Error('unsafe-url', 'URL is not safe to fetch'); + } + + try { + // Fetch the URL with security restrictions + const response = await HTTP.call('GET', url, { + timeout: 10000, // 10 second timeout + followRedirects: true, + maxRedirects: 5, + headers: { + 'User-Agent': 'TimeHarbor-Bot/1.0 (URL Title Fetcher)' + }, + npmRequestOptions: { + maxResponseSize: 1048576 // 1MB limit + } + }); + + // Extract title from the response + if (response && response.content) { + const title = extractTitleFromHtml(response.content); + if (title && title.length > 0) { + // Limit title length for safety + return title.substring(0, 200); + } + } + + return null; + } catch (error) { + // Log error but don't expose details to client + console.error('Error fetching URL title:', error); + throw new Meteor.Error('fetch-failed', 'Failed to fetch URL title'); + } + }, }); From 36b7b5a8afa09191521cfdca0de02ae3b0b50119 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 4 Jul 2025 13:14:22 +0000 Subject: [PATCH 3/4] Add cleanup and polish to URL title autofill feature Co-authored-by: horner <6094599+horner@users.noreply.github.com> --- client/main.js | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/client/main.js b/client/main.js index 304015a..279ad4a 100644 --- a/client/main.js +++ b/client/main.js @@ -392,6 +392,12 @@ Template.tickets.events({ t.showCreateTicketForm.set(true); }, 'click #cancelCreateTicket'(e, t) { + // Clear any pending title fetch timeout + if (titleFetchTimeout) { + clearTimeout(titleFetchTimeout); + titleFetchTimeout = null; + } + showTitleFetchStatus(false); t.showCreateTicketForm.set(false); }, 'paste #activityTitle'(e) { @@ -439,6 +445,14 @@ Template.tickets.events({ }, 'submit #createTicketForm'(e, t) { e.preventDefault(); + + // Clear any pending title fetch timeout + if (titleFetchTimeout) { + clearTimeout(titleFetchTimeout); + titleFetchTimeout = null; + } + showTitleFetchStatus(false); + const teamId = t.selectedTeamId.get(); const title = e.target.title.value.trim(); const github = e.target.github.value.trim(); From 9c71ffc49586bdf55e602b20287bdc651b72ef63 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 4 Jul 2025 13:27:03 +0000 Subject: [PATCH 4/4] Refactor URL title fetching with axios, configuration system, and enhanced security Co-authored-by: horner <6094599+horner@users.noreply.github.com> --- .gitignore | 3 + URL_TITLE_PROXY.md | 84 +++++++++++++ package-lock.json | 284 +++++++++++++++++++++++++++++++++++++++++- package.json | 1 + server/main.js | 150 ++++++++++++++++------ settings-example.json | 11 ++ 6 files changed, 493 insertions(+), 40 deletions(-) create mode 100644 URL_TITLE_PROXY.md create mode 100644 settings-example.json diff --git a/.gitignore b/.gitignore index c2658d7..4538ea8 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,4 @@ node_modules/ +settings.json +settings-*.json +!settings-example.json diff --git a/URL_TITLE_PROXY.md b/URL_TITLE_PROXY.md new file mode 100644 index 0000000..0dde57f --- /dev/null +++ b/URL_TITLE_PROXY.md @@ -0,0 +1,84 @@ +# URL Title Proxy Configuration + +The URL title autofill feature can be configured through Meteor settings. Create a `settings.json` file and pass it to Meteor using `--settings settings.json`. + +## Configuration Options + +```json +{ + "urlTitleProxy": { + "enabled": true, + "timeout": 10, + "maxResponseSize": 1048576, + "maxTitleLength": 200, + "requireAuth": true, + "allowedDomains": [], + "blockPrivateNetworks": true + } +} +``` + +### Settings Description + +- **enabled** (boolean, default: true): Enable or disable the URL title proxy service +- **timeout** (number, default: 10): Maximum timeout for HTTP requests in seconds +- **maxResponseSize** (number, default: 1048576): Maximum response size in bytes (1MB) +- **maxTitleLength** (number, default: 200): Maximum length of extracted titles +- **requireAuth** (boolean, default: true): Require user authentication to use the service +- **allowedDomains** (array, default: []): List of allowed domains. Empty array allows all external domains +- **blockPrivateNetworks** (boolean, default: true): Block access to private/internal IP ranges + +## Security Features + +### SSRF Protection +- Blocks localhost and loopback addresses (`127.0.0.1`, `::1`, `localhost`) +- Prevents access to private IP ranges (`10.x`, `192.168.x`, `172.16-31.x`) +- Blocks local domains (`.local`, `.localhost`) +- Only allows HTTP/HTTPS protocols + +### Request Safety +- Configurable timeout prevents hanging requests +- Configurable response size limit prevents memory exhaustion +- Configurable title length limit for reasonable display +- Proper User-Agent identification +- Authentication requirement by default + +### Domain Restrictions +- Optional domain allowlist for additional security +- Configurable private network blocking + +## Example Configurations + +### Development (Permissive) +```json +{ + "urlTitleProxy": { + "enabled": true, + "requireAuth": false, + "allowedDomains": [], + "blockPrivateNetworks": true + } +} +``` + +### Production (Restrictive) +```json +{ + "urlTitleProxy": { + "enabled": true, + "requireAuth": true, + "allowedDomains": ["github.com", "stackoverflow.com", "docs.company.com"], + "blockPrivateNetworks": true, + "timeout": 5 + } +} +``` + +### Disabled +```json +{ + "urlTitleProxy": { + "enabled": false + } +} +``` \ No newline at end of file diff --git a/package-lock.json b/package-lock.json index ac5af6e..44a4077 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,13 +1,14 @@ { - "name": "meteor-app", + "name": "timeharbor", "lockfileVersion": 3, "requires": true, "packages": { "": { - "name": "meteor-app", + "name": "timeharbor", "dependencies": { "@babel/runtime": "^7.17.9", "@tailwindcss/postcss": "^4.1.7", + "axios": "^1.6.0", "jquery": "^3.6.0", "meteor-node-stubs": "^1.2.1", "postcss-load-config": "^6.0.1" @@ -374,6 +375,12 @@ "tailwindcss": "4.1.7" } }, + "node_modules/asynckit": { + "version": "0.4.0", + "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz", + "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==", + "license": "MIT" + }, "node_modules/autoprefixer": { "version": "10.4.21", "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.21.tgz", @@ -412,6 +419,17 @@ "postcss": "^8.1.0" } }, + "node_modules/axios": { + "version": "1.10.0", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.10.0.tgz", + "integrity": "sha512-/1xYAC4MP/HEG+3duIhFr4ZQXR4sQXOIe+o6sdqzeykGLx6Upp/1p8MHqhINOvGeP7xyNHe7tsiJByc4SSVUxw==", + "license": "MIT", + "dependencies": { + "follow-redirects": "^1.15.6", + "form-data": "^4.0.0", + "proxy-from-env": "^1.1.0" + } + }, "node_modules/browserslist": { "version": "4.24.5", "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.24.5.tgz", @@ -445,6 +463,19 @@ "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7" } }, + "node_modules/call-bind-apply-helpers": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz", + "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==", + "license": "MIT", + "dependencies": { + "es-errors": "^1.3.0", + "function-bind": "^1.1.2" + }, + "engines": { + "node": ">= 0.4" + } + }, "node_modules/caniuse-lite": { "version": "1.0.30001718", "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001718.tgz", @@ -475,6 +506,18 @@ "node": ">=18" } }, + "node_modules/combined-stream": { + "version": "1.0.8", + "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz", + "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==", + "license": "MIT", + "dependencies": { + "delayed-stream": "~1.0.0" + }, + "engines": { + "node": ">= 0.8" + } + }, "node_modules/daisyui": { "version": "5.0.35", "resolved": "https://registry.npmjs.org/daisyui/-/daisyui-5.0.35.tgz", @@ -485,6 +528,15 @@ "url": "https://github.com/saadeghi/daisyui?sponsor=1" } }, + "node_modules/delayed-stream": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz", + "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==", + "license": "MIT", + "engines": { + "node": ">=0.4.0" + } + }, "node_modules/detect-libc": { "version": "2.0.4", "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.0.4.tgz", @@ -494,6 +546,20 @@ "node": ">=8" } }, + "node_modules/dunder-proto": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz", + "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==", + "license": "MIT", + "dependencies": { + "call-bind-apply-helpers": "^1.0.1", + "es-errors": "^1.3.0", + "gopd": "^1.2.0" + }, + "engines": { + "node": ">= 0.4" + } + }, "node_modules/electron-to-chromium": { "version": "1.5.155", "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.155.tgz", @@ -514,6 +580,51 @@ "node": ">=10.13.0" } }, + "node_modules/es-define-property": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz", + "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/es-errors": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz", + "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/es-object-atoms": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz", + "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==", + "license": "MIT", + "dependencies": { + "es-errors": "^1.3.0" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/es-set-tostringtag": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz", + "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==", + "license": "MIT", + "dependencies": { + "es-errors": "^1.3.0", + "get-intrinsic": "^1.2.6", + "has-tostringtag": "^1.0.2", + "hasown": "^2.0.2" + }, + "engines": { + "node": ">= 0.4" + } + }, "node_modules/escalade": { "version": "3.2.0", "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz", @@ -524,6 +635,42 @@ "node": ">=6" } }, + "node_modules/follow-redirects": { + "version": "1.15.9", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.9.tgz", + "integrity": "sha512-gew4GsXizNgdoRyqmyfMHyAmXsZDk6mHkSxZFCzW9gwlbtOW44CDtYavM+y+72qD/Vq2l550kMF52DT8fOLJqQ==", + "funding": [ + { + "type": "individual", + "url": "https://github.com/sponsors/RubenVerborgh" + } + ], + "license": "MIT", + "engines": { + "node": ">=4.0" + }, + "peerDependenciesMeta": { + "debug": { + "optional": true + } + } + }, + "node_modules/form-data": { + "version": "4.0.3", + "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.3.tgz", + "integrity": "sha512-qsITQPfmvMOSAdeyZ+12I1c+CKSstAFAwu+97zrnWAbIr5u8wfsExUzCesVLC8NgHuRUqNN4Zy6UPWUTRGslcA==", + "license": "MIT", + "dependencies": { + "asynckit": "^0.4.0", + "combined-stream": "^1.0.8", + "es-set-tostringtag": "^2.1.0", + "hasown": "^2.0.2", + "mime-types": "^2.1.12" + }, + "engines": { + "node": ">= 6" + } + }, "node_modules/fraction.js": { "version": "4.3.7", "resolved": "https://registry.npmjs.org/fraction.js/-/fraction.js-4.3.7.tgz", @@ -538,12 +685,109 @@ "url": "https://github.com/sponsors/rawify" } }, + "node_modules/function-bind": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz", + "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==", + "license": "MIT", + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/get-intrinsic": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz", + "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==", + "license": "MIT", + "dependencies": { + "call-bind-apply-helpers": "^1.0.2", + "es-define-property": "^1.0.1", + "es-errors": "^1.3.0", + "es-object-atoms": "^1.1.1", + "function-bind": "^1.1.2", + "get-proto": "^1.0.1", + "gopd": "^1.2.0", + "has-symbols": "^1.1.0", + "hasown": "^2.0.2", + "math-intrinsics": "^1.1.0" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/get-proto": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz", + "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==", + "license": "MIT", + "dependencies": { + "dunder-proto": "^1.0.1", + "es-object-atoms": "^1.0.0" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/gopd": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz", + "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, "node_modules/graceful-fs": { "version": "4.2.11", "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz", "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==", "license": "ISC" }, + "node_modules/has-symbols": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz", + "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/has-tostringtag": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz", + "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==", + "license": "MIT", + "dependencies": { + "has-symbols": "^1.0.3" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/hasown": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz", + "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==", + "license": "MIT", + "dependencies": { + "function-bind": "^1.1.2" + }, + "engines": { + "node": ">= 0.4" + } + }, "node_modules/jiti": { "version": "2.4.2", "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.4.2.tgz", @@ -808,6 +1052,15 @@ "@jridgewell/sourcemap-codec": "^1.5.0" } }, + "node_modules/math-intrinsics": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz", + "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + } + }, "node_modules/meteor-node-stubs": { "version": "1.2.17", "resolved": "https://registry.npmjs.org/meteor-node-stubs/-/meteor-node-stubs-1.2.17.tgz", @@ -1977,6 +2230,27 @@ "node": ">=0.4" } }, + "node_modules/mime-db": { + "version": "1.52.0", + "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz", + "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/mime-types": { + "version": "2.1.35", + "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz", + "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==", + "license": "MIT", + "dependencies": { + "mime-db": "1.52.0" + }, + "engines": { + "node": ">= 0.6" + } + }, "node_modules/minipass": { "version": "7.1.2", "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz", @@ -2131,6 +2405,12 @@ "dev": true, "license": "MIT" }, + "node_modules/proxy-from-env": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz", + "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==", + "license": "MIT" + }, "node_modules/source-map-js": { "version": "1.2.1", "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz", diff --git a/package.json b/package.json index f454e2c..87ee9fc 100644 --- a/package.json +++ b/package.json @@ -10,6 +10,7 @@ "dependencies": { "@babel/runtime": "^7.17.9", "@tailwindcss/postcss": "^4.1.7", + "axios": "^1.6.0", "jquery": "^3.6.0", "meteor-node-stubs": "^1.2.1", "postcss-load-config": "^6.0.1" diff --git a/server/main.js b/server/main.js index 400fe9b..b082e50 100644 --- a/server/main.js +++ b/server/main.js @@ -1,15 +1,39 @@ import { Meteor } from 'meteor/meteor'; import { Accounts } from 'meteor/accounts-base'; import { check } from 'meteor/check'; -import { HTTP } from 'meteor/http'; +import axios from 'axios'; import { Tickets, Teams, Sessions, ClockEvents } from '../collections.js'; +// Server configuration for URL title proxy service +const UrlTitleConfig = { + // Enable/disable the URL title fetching service + enabled: Meteor.settings.urlTitleProxy?.enabled ?? true, + + // Maximum timeout for requests (seconds) + timeout: Meteor.settings.urlTitleProxy?.timeout ?? 10, + + // Maximum response size (bytes) + maxResponseSize: Meteor.settings.urlTitleProxy?.maxResponseSize ?? 1048576, // 1MB + + // Maximum title length (characters) + maxTitleLength: Meteor.settings.urlTitleProxy?.maxTitleLength ?? 200, + + // Allow only authenticated users + requireAuth: Meteor.settings.urlTitleProxy?.requireAuth ?? true, + + // Allowed domains (empty array means all external domains allowed) + allowedDomains: Meteor.settings.urlTitleProxy?.allowedDomains ?? [], + + // Block private/internal networks + blockPrivateNetworks: Meteor.settings.urlTitleProxy?.blockPrivateNetworks ?? true +}; + function generateTeamCode() { // Simple random code, can be improved for production return Math.random().toString(36).substr(2, 8).toUpperCase(); } -// Security function to check if a URL is safe to fetch +// Enhanced security function to check if a URL is safe to fetch function isUrlSafe(url) { try { const urlObj = new URL(url); @@ -19,26 +43,38 @@ function isUrlSafe(url) { return false; } - // Block local/private IP ranges const hostname = urlObj.hostname.toLowerCase(); - // Block localhost variations - if (['localhost', '127.0.0.1', '::1'].includes(hostname)) { - return false; - } - - // Block private IP ranges (simplified check) - if (hostname.match(/^10\./) || - hostname.match(/^192\.168\./) || - hostname.match(/^172\.(1[6-9]|2\d|3[01])\./) || - hostname.match(/^169\.254\./) || - hostname.match(/^fe80:/)) { - return false; + // If allowedDomains is configured, only allow those domains + if (UrlTitleConfig.allowedDomains.length > 0) { + const isAllowed = UrlTitleConfig.allowedDomains.some(domain => { + return hostname === domain.toLowerCase() || hostname.endsWith('.' + domain.toLowerCase()); + }); + if (!isAllowed) { + return false; + } } - // Block other local addresses - if (hostname.match(/\.local$/) || hostname.match(/\.localhost$/)) { - return false; + // Block private/internal networks if configured + if (UrlTitleConfig.blockPrivateNetworks) { + // Block localhost variations + if (['localhost', '127.0.0.1', '::1'].includes(hostname)) { + return false; + } + + // Block private IP ranges + if (hostname.match(/^10\./) || + hostname.match(/^192\.168\./) || + hostname.match(/^172\.(1[6-9]|2\d|3[01])\./) || + hostname.match(/^169\.254\./) || + hostname.match(/^fe80:/)) { + return false; + } + + // Block other local addresses + if (hostname.match(/\.local$/) || hostname.match(/\.localhost$/)) { + return false; + } } return true; @@ -47,14 +83,14 @@ function isUrlSafe(url) { } } -// Function to extract title from HTML content +// Safe HTML title extraction function function extractTitleFromHtml(html) { try { - // Simple regex to extract title - in production, consider using a proper HTML parser + // Simple regex to extract title - using established approach for security const titleMatch = html.match(/]*>([^<]*)<\/title>/i); if (titleMatch && titleMatch[1]) { - // Decode HTML entities and clean up - return titleMatch[1] + // Decode common HTML entities and clean up + let title = titleMatch[1] .replace(/"/g, '"') .replace(/&/g, '&') .replace(/</g, '<') @@ -62,6 +98,13 @@ function extractTitleFromHtml(html) { .replace(/'/g, "'") .replace(/ /g, ' ') .trim(); + + // Limit title length for safety + if (title.length > UrlTitleConfig.maxTitleLength) { + title = title.substring(0, UrlTitleConfig.maxTitleLength).trim(); + } + + return title; } return null; } catch (e) { @@ -391,6 +434,16 @@ Meteor.methods({ async fetchUrlTitle(url) { check(url, String); + // Check if the service is enabled + if (!UrlTitleConfig.enabled) { + throw new Meteor.Error('service-disabled', 'URL title proxy service is disabled'); + } + + // Check authentication if required + if (UrlTitleConfig.requireAuth && !this.userId) { + throw new Meteor.Error('not-authorized', 'Authentication required to use URL title proxy service'); + } + // Validate URL format if (!url || typeof url !== 'string') { throw new Meteor.Error('invalid-url', 'Invalid URL provided'); @@ -398,37 +451,58 @@ Meteor.methods({ // Check if URL is safe to fetch if (!isUrlSafe(url)) { - throw new Meteor.Error('unsafe-url', 'URL is not safe to fetch'); + throw new Meteor.Error('unsafe-url', 'URL is not allowed by security policy'); } try { - // Fetch the URL with security restrictions - const response = await HTTP.call('GET', url, { - timeout: 10000, // 10 second timeout - followRedirects: true, + // Create axios instance with security configurations + const axiosInstance = axios.create({ + timeout: UrlTitleConfig.timeout * 1000, // Convert to milliseconds maxRedirects: 5, + maxContentLength: UrlTitleConfig.maxResponseSize, + maxBodyLength: UrlTitleConfig.maxResponseSize, headers: { - 'User-Agent': 'TimeHarbor-Bot/1.0 (URL Title Fetcher)' + 'User-Agent': 'TimeHarbor-URLProxy/1.0 (URL Title Fetcher)', + 'Accept': 'text/html,application/xhtml+xml', + 'Accept-Language': 'en-US,en;q=0.9', + 'Accept-Encoding': 'gzip, deflate', + 'Cache-Control': 'no-cache', + 'Connection': 'close' }, - npmRequestOptions: { - maxResponseSize: 1048576 // 1MB limit - } + validateStatus: (status) => status >= 200 && status < 400 }); + // Fetch the URL with security restrictions + const response = await axiosInstance.get(url); + // Extract title from the response - if (response && response.content) { - const title = extractTitleFromHtml(response.content); + if (response && response.data) { + const title = extractTitleFromHtml(response.data); if (title && title.length > 0) { - // Limit title length for safety - return title.substring(0, 200); + return title; } } return null; } catch (error) { - // Log error but don't expose details to client - console.error('Error fetching URL title:', error); - throw new Meteor.Error('fetch-failed', 'Failed to fetch URL title'); + // Log error for debugging but don't expose details to client + console.error('URL title fetch error:', { + url: url, + error: error.message, + code: error.code, + userId: this.userId + }); + + // Return user-friendly error messages + if (error.code === 'ENOTFOUND') { + throw new Meteor.Error('url-not-found', 'URL could not be reached'); + } else if (error.code === 'ETIMEDOUT' || error.code === 'ECONNABORTED') { + throw new Meteor.Error('request-timeout', 'Request timed out'); + } else if (error.response?.status >= 400) { + throw new Meteor.Error('http-error', 'Server returned an error'); + } else { + throw new Meteor.Error('fetch-failed', 'Failed to fetch URL title'); + } } }, }); diff --git a/settings-example.json b/settings-example.json new file mode 100644 index 0000000..ab39ef4 --- /dev/null +++ b/settings-example.json @@ -0,0 +1,11 @@ +{ + "urlTitleProxy": { + "enabled": true, + "timeout": 10, + "maxResponseSize": 1048576, + "maxTitleLength": 200, + "requireAuth": true, + "allowedDomains": [], + "blockPrivateNetworks": true + } +} \ No newline at end of file