8757de0c36
Pre-push audit agent A2 flagged two HIGH-severity security issues that would have shipped in the PR had we not checked: 1. PUT /api/scenes/[id] URL-validation bypass. Phase 8 P4 fixed the POST /api/scenes route by replacing a loose z.unknown() graph schema with AnyNode superRefine. The fix never made it to the PUT handler - an attacker could resubmit the same javascript:/file:/// payloads via PUT. Fixed by extracting the tight validator into apps/editor/lib/graph-schema.ts and sharing it across both routes. 2. SSRF in photo_to_scene / analyze_floorplan_image / analyze_room_photo. All three tools called raw fetch(image) on user-supplied URLs with no validation - a direct http://169.254.169.254/latest/meta-data/ exfil primitive on any cloud host. Added packages/mcp/src/lib/safe-fetch.ts that: - Blocks loopback (127.0.0.0/8, ::1) - Blocks link-local incl. cloud metadata (169.254.0.0/16) - Blocks private ranges (10/8, 172.16/12, 192.168/16, fc00::/7) - Blocks .local/.internal/.corp hostnames + localhost variants - Blocks v4-mapped IPv6 loopback (::ffff:127.0.0.1) - Manual redirects (max 3), revalidating the allowlist per hop - 20 MB response-size cap (streamed, enforced per-chunk) - 10s timeout - Optional PASCAL_ALLOWED_ASSET_ORIGINS env allowlist Tests: 8 new SSRF guard tests, all vision tests still pass, full suite 302/302. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
96 lines
2.8 KiB
TypeScript
96 lines
2.8 KiB
TypeScript
import { type NextRequest, NextResponse } from 'next/server'
|
|
import { z } from 'zod'
|
|
import { apiGraphSchema } from '@/lib/graph-schema'
|
|
import { getSceneStore } from '@/lib/scene-store-server'
|
|
|
|
export const dynamic = 'force-dynamic'
|
|
|
|
const createSceneSchema = z.object({
|
|
id: z.string().min(1).max(64).optional(),
|
|
name: z.string().min(1).max(200),
|
|
projectId: z.string().min(1).max(200).nullable().optional(),
|
|
graph: apiGraphSchema,
|
|
thumbnailUrl: z.string().url().nullable().optional(),
|
|
})
|
|
|
|
const listQuerySchema = z.object({
|
|
projectId: z.string().min(1).max(200).optional(),
|
|
limit: z.coerce.number().int().positive().max(500).optional(),
|
|
})
|
|
|
|
export async function GET(request: NextRequest) {
|
|
const url = new URL(request.url)
|
|
const parsed = listQuerySchema.safeParse({
|
|
projectId: url.searchParams.get('projectId') ?? undefined,
|
|
limit: url.searchParams.get('limit') ?? undefined,
|
|
})
|
|
if (!parsed.success) {
|
|
return NextResponse.json(
|
|
{ error: 'invalid_request', details: parsed.error.issues },
|
|
{ status: 400 },
|
|
)
|
|
}
|
|
|
|
const store = await getSceneStore()
|
|
const scenes = await store.list({
|
|
projectId: parsed.data.projectId,
|
|
limit: parsed.data.limit,
|
|
})
|
|
return NextResponse.json({ scenes })
|
|
}
|
|
|
|
export async function POST(request: NextRequest) {
|
|
let body: unknown
|
|
try {
|
|
body = await request.json()
|
|
} catch {
|
|
return NextResponse.json(
|
|
{ error: 'invalid_request', details: 'body must be valid JSON' },
|
|
{ status: 400 },
|
|
)
|
|
}
|
|
|
|
const parsed = createSceneSchema.safeParse(body)
|
|
if (!parsed.success) {
|
|
return NextResponse.json(
|
|
{ error: 'invalid_request', details: parsed.error.issues },
|
|
{ status: 400 },
|
|
)
|
|
}
|
|
|
|
const store = await getSceneStore()
|
|
try {
|
|
const meta = await store.save({
|
|
id: parsed.data.id,
|
|
name: parsed.data.name,
|
|
projectId: parsed.data.projectId ?? null,
|
|
graph: parsed.data.graph as never,
|
|
thumbnailUrl: parsed.data.thumbnailUrl ?? null,
|
|
})
|
|
return NextResponse.json(meta, {
|
|
status: 201,
|
|
headers: { Location: `/scene/${meta.id}` },
|
|
})
|
|
} catch (error) {
|
|
return handleStoreError(error)
|
|
}
|
|
}
|
|
|
|
function handleStoreError(error: unknown): NextResponse {
|
|
const code = (error as { code?: string })?.code
|
|
if (code === 'version_conflict') {
|
|
return NextResponse.json({ error: 'version_conflict' }, { status: 409 })
|
|
}
|
|
if (code === 'not_found') {
|
|
return NextResponse.json({ error: 'not_found' }, { status: 404 })
|
|
}
|
|
if (code === 'too_large') {
|
|
return NextResponse.json({ error: 'too_large' }, { status: 413 })
|
|
}
|
|
if (code === 'invalid') {
|
|
return NextResponse.json({ error: 'invalid' }, { status: 400 })
|
|
}
|
|
const message = error instanceof Error ? error.message : 'unexpected_error'
|
|
return NextResponse.json({ error: 'internal_error', message }, { status: 500 })
|
|
}
|