Adrian Perez 8757de0c36 fix(mcp,editor): close PUT-route URL bypass + vision-tool SSRF (Phase 10 A2)
Pre-push audit agent A2 flagged two HIGH-severity security issues that
would have shipped in the PR had we not checked:

1. PUT /api/scenes/[id] URL-validation bypass. Phase 8 P4 fixed
   the POST /api/scenes route by replacing a loose z.unknown() graph
   schema with AnyNode superRefine. The fix never made it to the PUT
   handler - an attacker could resubmit the same javascript:/file:///
   payloads via PUT. Fixed by extracting the tight validator into
   apps/editor/lib/graph-schema.ts and sharing it across both routes.

2. SSRF in photo_to_scene / analyze_floorplan_image /
   analyze_room_photo. All three tools called raw fetch(image) on
   user-supplied URLs with no validation - a direct
   http://169.254.169.254/latest/meta-data/ exfil primitive on any
   cloud host. Added packages/mcp/src/lib/safe-fetch.ts that:
   - Blocks loopback (127.0.0.0/8, ::1)
   - Blocks link-local incl. cloud metadata (169.254.0.0/16)
   - Blocks private ranges (10/8, 172.16/12, 192.168/16, fc00::/7)
   - Blocks .local/.internal/.corp hostnames + localhost variants
   - Blocks v4-mapped IPv6 loopback (::ffff:127.0.0.1)
   - Manual redirects (max 3), revalidating the allowlist per hop
   - 20 MB response-size cap (streamed, enforced per-chunk)
   - 10s timeout
   - Optional PASCAL_ALLOWED_ASSET_ORIGINS env allowlist

Tests: 8 new SSRF guard tests, all vision tests still pass, full
suite 302/302.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-19 20:59:26 +02:00

189 lines
5.7 KiB
TypeScript

import { type NextRequest, NextResponse } from 'next/server'
import { z } from 'zod'
import { apiGraphSchema } from '@/lib/graph-schema'
import { getSceneStore } from '@/lib/scene-store-server'
export const dynamic = 'force-dynamic'
type RouteParams = { params: Promise<{ id: string }> }
const putSceneSchema = z.object({
name: z.string().min(1).max(200).optional(),
graph: apiGraphSchema,
thumbnailUrl: z.string().url().nullable().optional(),
expectedVersion: z.number().int().nonnegative().optional(),
})
const patchSceneSchema = z.object({
name: z.string().min(1).max(200),
expectedVersion: z.number().int().nonnegative().optional(),
})
export async function GET(_request: NextRequest, { params }: RouteParams) {
const { id } = await params
const store = await getSceneStore()
try {
const scene = await store.load(id)
if (!scene) {
return NextResponse.json({ error: 'not_found' }, { status: 404 })
}
return NextResponse.json(scene, {
headers: { ETag: `"${scene.version}"` },
})
} catch (error) {
return handleStoreError(error)
}
}
export async function PUT(request: NextRequest, { params }: RouteParams) {
const { id } = await params
let body: unknown
try {
body = await request.json()
} catch {
return NextResponse.json(
{ error: 'invalid_request', details: 'body must be valid JSON' },
{ status: 400 },
)
}
const parsed = putSceneSchema.safeParse(body)
if (!parsed.success) {
return NextResponse.json(
{ error: 'invalid_request', details: parsed.error.issues },
{ status: 400 },
)
}
const ifMatch = parseIfMatch(request.headers.get('If-Match'))
const expectedVersion = ifMatch ?? parsed.data.expectedVersion
const store = await getSceneStore()
try {
const existing = await store.load(id)
if (!existing) {
return NextResponse.json({ error: 'not_found' }, { status: 404 })
}
const meta = await store.save({
id,
name: parsed.data.name ?? existing.name,
projectId: existing.projectId,
ownerId: existing.ownerId,
graph: parsed.data.graph as never,
thumbnailUrl:
parsed.data.thumbnailUrl === undefined ? existing.thumbnailUrl : parsed.data.thumbnailUrl,
expectedVersion,
})
return NextResponse.json(meta, {
headers: { ETag: `"${meta.version}"` },
})
} catch (error) {
return handleStoreError(error, { includeCurrentVersionFor: id })
}
}
export async function DELETE(request: NextRequest, { params }: RouteParams) {
const { id } = await params
const ifMatch = parseIfMatch(request.headers.get('If-Match'))
const store = await getSceneStore()
try {
const removed = await store.delete(id, { expectedVersion: ifMatch })
if (!removed) {
return NextResponse.json({ error: 'not_found' }, { status: 404 })
}
return new NextResponse(null, { status: 204 })
} catch (error) {
return handleStoreError(error, { includeCurrentVersionFor: id })
}
}
export async function PATCH(request: NextRequest, { params }: RouteParams) {
const { id } = await params
let body: unknown
try {
body = await request.json()
} catch {
return NextResponse.json(
{ error: 'invalid_request', details: 'body must be valid JSON' },
{ status: 400 },
)
}
const parsed = patchSceneSchema.safeParse(body)
if (!parsed.success) {
return NextResponse.json(
{ error: 'invalid_request', details: parsed.error.issues },
{ status: 400 },
)
}
const ifMatch = parseIfMatch(request.headers.get('If-Match'))
const expectedVersion = ifMatch ?? parsed.data.expectedVersion
const store = await getSceneStore()
try {
const meta = await store.rename(id, parsed.data.name, { expectedVersion })
return NextResponse.json(meta, {
headers: { ETag: `"${meta.version}"` },
})
} catch (error) {
return handleStoreError(error, { includeCurrentVersionFor: id })
}
}
/**
* Parses an `If-Match` header value per RFC 7232. Accepts `"<version>"` or
* weak `W/"<version>"` forms. Returns `undefined` when the header is absent,
* the wildcard `*`, or unparseable as a non-negative integer.
*/
function parseIfMatch(raw: string | null): number | undefined {
if (!raw) return undefined
const trimmed = raw.trim()
if (trimmed === '*') return undefined
const match = trimmed.match(/^(?:W\/)?"([^"]+)"$/)
const inner = match ? match[1] : trimmed
if (!inner) return undefined
const n = Number(inner)
if (!Number.isFinite(n) || !Number.isInteger(n) || n < 0) return undefined
return n
}
async function handleStoreError(
error: unknown,
opts: { includeCurrentVersionFor?: string } = {},
): Promise<NextResponse> {
const code = (error as { code?: string })?.code
if (code === 'version_conflict') {
let currentVersion: number | undefined
if (opts.includeCurrentVersionFor) {
try {
const store = await getSceneStore()
const current = await store.load(opts.includeCurrentVersionFor)
currentVersion = current?.version
} catch {
// Best-effort; skip reporting currentVersion on secondary failure.
}
}
return NextResponse.json(
currentVersion === undefined
? { error: 'version_conflict' }
: { error: 'version_conflict', currentVersion },
{ status: 409 },
)
}
if (code === 'not_found') {
return NextResponse.json({ error: 'not_found' }, { status: 404 })
}
if (code === 'too_large') {
return NextResponse.json({ error: 'too_large' }, { status: 413 })
}
if (code === 'invalid') {
return NextResponse.json({ error: 'invalid' }, { status: 400 })
}
const message = error instanceof Error ? error.message : 'unexpected_error'
return NextResponse.json({ error: 'internal_error', message }, { status: 500 })
}