Restricting access to some HTTP API endpoints to top domain

CHANGELOG.md

@@ -21,12 +21,17 @@
     - The browser-reported `Origin` header will now be checked by
       default, and the ACL system can be used to restrict access
       to applications for added security.
+    - Users can add `trustedApp` entries to their profile using a new databrowser pane.
+      You will see an 'A' icon added while you view a Person's profile URL
+      with the data browser (might have to hit refresh in your browser and make sure you
+      are viewing a WebId URL like https://localhost:8443/profile/card#me).
 - Logging is now verbose by default so the `-v` option has been
   removed and a `--quiet` option has been added to mute the log.
 - To be bug compliant with 4.x releases, if a rule for public readable
   root / does not exist, it will check in /index.html.acl (see issue #1063)
 - Command line options are now kebab-cased rather than camelCased,
   config options may be both.
+- Resource with no extension now have '$.ttl' appended in the filename (see upgrades notes below).
 - Many smaller fixes.
 
 #### 5.0.0 Upgrade Notes

bin/lib/cli.js

@@ -25,10 +25,15 @@ function getVersion () {
     // Obtain version from git
     const options = { cwd: __dirname, encoding: 'utf8' }
     const { stdout } = spawnSync('git', ['describe', '--tags'], options)
-    return stdout.trim()
+    const version = stdout.trim()
+    if (version === '') {
+      throw new Error('No git version here')
+    }
+    return version
   } catch (e) {
     // Obtain version from package.json
     const { version } = require(path.join(__dirname, '../../package.json'))
     return version
   }
 }
+

config/defaults.js

@@ -12,7 +12,7 @@ module.exports = {
   'serverUri': 'https://localhost:8443',
   'webid': true,
   'strictOrigin': true,
-  'trustedOrigins': ['https://apps.solid.invalid'],
+  'trustedOrigins': [],
   'dataBrowserPath': 'default'
 
   // For use in Enterprises to configure a HTTP proxy for all outbound HTTP requests from the SOLID server (we use

lib/acl-checker.js

@@ -16,11 +16,10 @@ class ACLChecker {
   constructor (resource, options = {}) {
     this.resource = resource
     this.resourceUrl = new URL(resource)
-    this.agentOrigin = options.agentOrigin
+    this.agentOrigin = options.strictOrigin && options.agentOrigin ? rdf.sym(options.agentOrigin) : null
     this.fetch = options.fetch
     this.fetchGraph = options.fetchGraph
-    this.strictOrigin = options.strictOrigin
-    this.trustedOrigins = options.trustedOrigins
+    this.trustedOrigins = options.strictOrigin && options.trustedOrigins ? options.trustedOrigins.map(trustedOrigin => rdf.sym(trustedOrigin)) : null
     this.suffix = options.suffix || DEFAULT_ACL_SUFFIX
     this.aclCached = {}
     this.messagesCached = {}
@@ -56,17 +55,23 @@ class ACLChecker {
     const aclFile = rdf.sym(acl.acl)
     const agent = user ? rdf.sym(user) : null
     const modes = [ACL(mode)]
-    const agentOrigin = this.agentOrigin ? rdf.sym(this.agentOrigin) : null
-    const trustedOrigins = this.trustedOrigins ? this.trustedOrigins.map(trustedOrigin => rdf.sym(trustedOrigin)) : null
-    const accessDenied = aclCheck.accessDenied(acl.graph, resource, directory, aclFile, agent, modes, agentOrigin, trustedOrigins)
-    if (accessDenied && this.agentOrigin && this.resourceUrl.origin !== this.agentOrigin) {
-      this.messagesCached[cacheKey].push(HTTPError(403, accessDenied))
-    } else if (accessDenied && user) {
+    const agentOrigin = this.agentOrigin
+    const trustedOrigins = this.trustedOrigins
+    let originTrustedModes = []
+    try {
+      this.fetch(aclFile.doc().value)
+      originTrustedModes = await aclCheck.getTrustedModesForOrigin(acl.graph, resource, directory, aclFile, agentOrigin, (uriNode) => {
+        return this.fetch(uriNode.doc().value, acl.graph)
+      })
+    } catch (e) {
+      // FIXME: https://github.com/solid/acl-check/issues/23
+      // console.error(e.message)
+    }
+    const accessDenied = aclCheck.accessDenied(acl.graph, resource, directory, aclFile, agent, modes, agentOrigin, trustedOrigins, originTrustedModes)
+    if (accessDenied && user) {
       this.messagesCached[cacheKey].push(HTTPError(403, accessDenied))
-    } else if (accessDenied && !user) {
-      this.messagesCached[cacheKey].push(HTTPError(401, 'Unauthenticated'))
     } else if (accessDenied) {
-      this.messagesCached[cacheKey].push(HTTPError(401, accessDenied))
+      this.messagesCached[cacheKey].push(HTTPError(401, 'Unauthenticated'))
     }
     this.aclCached[cacheKey] = Promise.resolve(!accessDenied)
     return this.aclCached[cacheKey]

lib/api/accounts/user-accounts.js

@@ -4,6 +4,8 @@ const express = require('express')
 const bodyParser = require('body-parser').urlencoded({ extended: false })
 const debug = require('../../debug').accounts
 
+const restrictToTopDomain = require('../../handlers/restrict-to-top-domain')
+
 const CreateAccountRequest = require('../../requests/create-account-request')
 const AddCertificateRequest = require('../../requests/add-cert-request')
 const DeleteAccountRequest = require('../../requests/delete-account-request')
@@ -65,16 +67,16 @@ function middleware (accountManager) {
 
   router.get('/', checkAccountExists(accountManager))
 
-  router.post('/api/accounts/new', bodyParser, CreateAccountRequest.post)
-  router.get(['/register', '/api/accounts/new'], CreateAccountRequest.get)
+  router.post('/api/accounts/new', restrictToTopDomain, bodyParser, CreateAccountRequest.post)
+  router.get(['/register', '/api/accounts/new'], restrictToTopDomain, CreateAccountRequest.get)
 
-  router.post('/api/accounts/cert', bodyParser, newCertificate(accountManager))
+  router.post('/api/accounts/cert', restrictToTopDomain, bodyParser, newCertificate(accountManager))
 
-  router.get('/account/delete', DeleteAccountRequest.get)
-  router.post('/account/delete', bodyParser, DeleteAccountRequest.post)
+  router.get('/account/delete', restrictToTopDomain, DeleteAccountRequest.get)
+  router.post('/account/delete', restrictToTopDomain, bodyParser, DeleteAccountRequest.post)
 
-  router.get('/account/delete/confirm', DeleteAccountConfirmRequest.get)
-  router.post('/account/delete/confirm', bodyParser, DeleteAccountConfirmRequest.post)
+  router.get('/account/delete/confirm', restrictToTopDomain, DeleteAccountConfirmRequest.get)
+  router.post('/account/delete/confirm', restrictToTopDomain, bodyParser, DeleteAccountConfirmRequest.post)
 
   return router
 }

lib/api/authn/webid-oidc.js

@@ -9,6 +9,8 @@ const bodyParser = require('body-parser').urlencoded({ extended: false })
 const OidcManager = require('../../models/oidc-manager')
 const { LoginRequest } = require('../../requests/login-request')
 
+const restrictToTopDomain = require('../../handlers/restrict-to-top-domain')
+
 const PasswordResetEmailRequest = require('../../requests/password-reset-email-request')
 const PasswordChangeRequest = require('../../requests/password-change-request')
 
@@ -71,11 +73,11 @@ function middleware (oidc) {
 
   router.post('/login/tls', bodyParser, LoginRequest.loginTls)
 
-  router.get('/account/password/reset', PasswordResetEmailRequest.get)
-  router.post('/account/password/reset', bodyParser, PasswordResetEmailRequest.post)
+  router.get('/account/password/reset', restrictToTopDomain, PasswordResetEmailRequest.get)
+  router.post('/account/password/reset', restrictToTopDomain, bodyParser, PasswordResetEmailRequest.post)
 
-  router.get('/account/password/change', PasswordChangeRequest.get)
-  router.post('/account/password/change', bodyParser, PasswordChangeRequest.post)
+  router.get('/account/password/change', restrictToTopDomain, PasswordChangeRequest.get)
+  router.post('/account/password/change', restrictToTopDomain, bodyParser, PasswordChangeRequest.post)
 
   router.get('/.well-known/solid/logout/', (req, res) => res.redirect('/logout'))
 

lib/capability-discovery.js

@@ -3,22 +3,7 @@
  * @module capability-discovery
  */
 const express = require('express')
-
-const serviceConfigDefaults = {
-  'api': {
-    'accounts': {
-      // 'changePassword': '/api/account/changePassword',
-      // 'delete': '/api/accounts/delete',
-
-      // Create new user (see IdentityProvider.post() in identity-provider.js)
-      'new': '/api/accounts/new',
-      'recover': '/api/accounts/recover',
-      'signin': '/login',
-      'signout': '/logout',
-      'validateToken': '/api/accounts/validateToken'
-    }
-  }
-}
+const { URL } = require('url')
 
 module.exports = capabilityDiscovery
 
@@ -31,7 +16,7 @@ function capabilityDiscovery () {
   const router = express.Router('/')
 
   // Advertise the server capability discover endpoint
-  router.get('/.well-known/solid', serviceCapabilityDocument(serviceConfigDefaults))
+  router.get('/.well-known/solid', serviceCapabilityDocument())
   return router
 }
 
@@ -43,12 +28,27 @@ function capabilityDiscovery () {
  * @param res
  * @param next
  */
-function serviceCapabilityDocument (serviceConfig) {
+function serviceCapabilityDocument () {
   return (req, res) => {
-    // Add the server root url
-    serviceConfig.root = req.app.locals.ldp.resourceMapper.resolveUrl(req.hostname, req.path)
-    // Add the 'apps' urls section
-    serviceConfig.apps = req.app.locals.appUrls
-    res.json(serviceConfig)
+    const ldp = req.app.locals.ldp
+    res.json({
+      // Add the server root url
+      root: req.app.locals.ldp.resourceMapper.resolveUrl(req.hostname, req.path),
+      // Add the 'apps' urls section
+      apps: req.app.locals.appUrls,
+      api: {
+        accounts: {
+          // 'changePassword': '/api/account/changePassword',
+          // 'delete': '/api/accounts/delete',
+
+          // Create new user (see IdentityProvider.post() in identity-provider.js)
+          new: new URL('/api/accounts/new', ldp.serverUri),
+          recover: new URL('/api/accounts/recover', ldp.serverUri),
+          signin: req.app.locals.ldp.resourceMapper.resolveUrl(req.hostname, '/login'),
+          signout: req.app.locals.ldp.resourceMapper.resolveUrl(req.hostname, '/logout'),
+          validateToken: new URL('/api/accounts/validateToken', ldp.serverUri)
+        }
+      }
+    })
   }
 }

lib/create-app.js

@@ -42,18 +42,24 @@ function createApp (argv = {}) {
   // Override default configs (defaults) with passed-in params (argv)
   argv = Object.assign({}, defaults, argv)
 
-  argv.host = SolidHost.from({ port: argv.port, serverUri: argv.serverUri })
+  argv.host = SolidHost.from(argv)
 
   argv.resourceMapper = new ResourceMapper({
     rootUrl: argv.serverUri,
     rootPath: path.resolve(argv.root || process.cwd()),
     includeHost: argv.multiuser,
-    defaultContentType: argv.defaultContentType
+    defaultContentType: argv.defaultContentType,
+    fileSuffixes: [
+      argv.suffixAcl || '.acl',
+      argv.suffixMeta || '.meta'
+    ]
   })
 
   const configPath = config.initConfigDir(argv)
   argv.templates = config.initTemplateDirs(configPath)
 
+  config.printDebugInfo(argv)
+
   const ldp = new LDP(argv)
 
   const app = express()
@@ -206,14 +212,27 @@ function initWebId (argv, app, ldp) {
   // without permission by including the credentials set by the Solid server.
   app.use((req, res, next) => {
     const origin = req.get('origin')
-    const trustedOrigins = argv.trustedOrigins
+    const trustedOrigins = ldp.getTrustedOrigins(req)
     const userId = req.session.userId
     // Exception: allow logout requests from all third-party apps
     // such that OIDC client can log out via cookie auth
     // TODO: remove this exception when OIDC clients
     // use Bearer token to authenticate instead of cookie
     // (https://github.com/solid/node-solid-server/pull/835#issuecomment-426429003)
-    if (!argv.host.allowsSessionFor(userId, origin, trustedOrigins) && !isLogoutRequest(req)) {
+    //
+    // Authentication cookies are an optimization:
+    // instead of going through the process of
+    // fully validating authentication on every request,
+    // we go through this process once,
+    // and store its successful result in a cookie
+    // that will be reused upon the next request.
+    // However, that cookie can then be sent by any server,
+    // even servers that have not gone through the proper authentication mechanism.
+    // However, if trusted origins are enabled,
+    // then any origin is allowed to take the shortcut route,
+    // since malicious origins will be banned at the ACL checking phase.
+    // https://github.com/solid/node-solid-server/issues/1117
+    if (!argv.strictOrigin && !argv.host.allowsSessionFor(userId, origin, trustedOrigins) && !isLogoutRequest(req)) {
       debug.authentication(`Rejecting session for ${userId} from ${origin}`)
       // Destroy session data
       delete req.session.userId

lib/create-server.js

@@ -80,20 +80,20 @@ function createServer (argv, app) {
   }
 
   // Look for port or list of ports to redirect to argv.port
-  if ('redirectHTTPFrom' in argv) {
-    const redirectHTTPFroms = argv.redirectHTTPFrom.constructor === Array
-          ? argv.redirectHTTPFrom
-          : [argv.redirectHTTPFrom]
+  if ('redirectHttpFrom' in argv) {
+    const redirectHttpFroms = argv.redirectHttpFrom.constructor === Array
+          ? argv.redirectHttpFrom
+          : [argv.redirectHttpFrom]
     const portStr = argv.port === 443 ? '' : ':' + argv.port
-    redirectHTTPFroms.forEach(redirectHTTPFrom => {
-      debug.settings('will redirect from port ' + redirectHTTPFrom + ' to port ' + argv.port)
+    redirectHttpFroms.forEach(redirectHttpFrom => {
+      debug.settings('will redirect from port ' + redirectHttpFrom + ' to port ' + argv.port)
       let redirectingServer = express()
       redirectingServer.get('*', function (req, res) {
         let host = req.headers.host.split(':') // ignore port
         debug.server(host, '=> https://' + host + portStr + req.url)
         res.redirect('https://' + host + portStr + req.url)
       })
-      redirectingServer.listen(redirectHTTPFrom)
+      redirectingServer.listen(redirectHttpFrom)
     })
   }
 

lib/handlers/patch.js

@@ -10,6 +10,7 @@ const $rdf = require('rdflib')
 const crypto = require('crypto')
 const overQuota = require('../utils').overQuota
 const getContentType = require('../utils').getContentType
+const { lock } = require('proper-lockfile')
 
 // Patch parsers by request body content type
 const PATCH_PARSERS = {
@@ -23,6 +24,7 @@ const DEFAULT_FOR_NEW_CONTENT_TYPE = 'text/turtle'
 async function patchHandler (req, res, next) {
   debug(`PATCH -- ${req.originalUrl}`)
   res.header('MS-Author-Via', 'SPARQL')
+  let releaseLock
   try {
     // Obtain details of the target resource
     const ldp = req.app.locals.ldp
@@ -50,22 +52,24 @@ async function patchHandler (req, res, next) {
       throw error(415, `Unsupported patch content type: ${patch.contentType}`)
     }
 
-    // Parse the target graph and the patch document,
-    // and verify permission for performing this specific patch
-    const [graph, patchObject] = await Promise.all([
-      readGraph(resource),
-      parsePatch(url, patch.uri, patch.text)
-        .then(patchObject => checkPermission(req, patchObject))
-    ])
+    // Parse the patch document and verify permissions
+    const patchObject = await parsePatch(url, patch.uri, patch.text)
+    await checkPermission(req, patchObject)
 
     // Patch the graph and write it back to the file
+    releaseLock = await lock(path, { retries: 10, realpath: false })
+    const graph = await readGraph(resource)
     await applyPatch(patchObject, graph, url)
     const result = await writeGraph(graph, resource, ldp.resourceMapper.rootPath, ldp.serverUri)
 
     // Send the result to the client
     res.send(result)
   } catch (err) {
     return next(err)
+  } finally {
+    if (releaseLock) {
+      await releaseLock()
+    }
   }
   return next()
 }

lib/handlers/restrict-to-top-domain.js

@@ -0,0 +1,13 @@
+const HTTPError = require('../http-error')
+
+module.exports = function (req, res, next) {
+  const locals = req.app.locals
+  const ldp = locals.ldp
+  const serverUri = locals.host.serverUri
+  const hostname = ldp.resourceMapper.resolveUrl(req.hostname)
+  if (hostname === serverUri) {
+    return next()
+  }
+  const isLoggedIn = !!(req.session && req.session.userId)
+  return next(new HTTPError(isLoggedIn ? 403 : 401, 'Not allowed to access top-level APIs on accounts'))
+}