Skip to content

Commit 12fa040

Browse files
billchurchbillchurch
committed
chore: litning
1 parent a80c32e commit 12fa040

File tree

2 files changed

+100
-58
lines changed

2 files changed

+100
-58
lines changed

‎app/routes.ts‎

Lines changed: 81 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,6 @@ type ReqWithSession = Request & {
4343
headers: Record<string, unknown>
4444
}
4545

46-
4746
/**
4847
* Result of SSH credential validation
4948
*/
@@ -92,18 +91,35 @@ async function validateSshCredentials(
9291
const err = error as Error & { code?: string; level?: string }
9392
debug(`SSH validation failed for ${username}@${host}:${port}:`, err.message)
9493
debug(`Error details - code: ${err.code}, level: ${err.level}`)
95-
94+
9695
// Analyze error type
9796
let errorType: SshValidationResult['errorType'] = 'unknown'
98-
97+
9998
// Network/connectivity errors
100-
if (err.code === 'ENOTFOUND' || err.message.includes('getaddrinfo') || err.message.includes('ENOTFOUND')) {
99+
if (
100+
err.code === 'ENOTFOUND' ||
101+
err.message.includes('getaddrinfo') ||
102+
err.message.includes('ENOTFOUND')
103+
) {
101104
errorType = 'network' // DNS resolution failed
102-
} else if (err.code === 'ECONNREFUSED' || err.message.includes('Connection refused') || err.message.includes('ECONNREFUSED')) {
105+
} else if (
106+
err.code === 'ECONNREFUSED' ||
107+
err.message.includes('Connection refused') ||
108+
err.message.includes('ECONNREFUSED')
109+
) {
103110
errorType = 'network' // Port closed or service not running
104-
} else if (err.code === 'ETIMEDOUT' || err.code === 'ECONNRESET' || err.message.includes('timeout') || err.message.includes('ETIMEDOUT')) {
111+
} else if (
112+
err.code === 'ETIMEDOUT' ||
113+
err.code === 'ECONNRESET' ||
114+
err.message.includes('timeout') ||
115+
err.message.includes('ETIMEDOUT')
116+
) {
105117
errorType = 'timeout' // Connection timeout
106-
} else if (err.code === 'ENETUNREACH' || err.message.includes('Network is unreachable') || err.message.includes('ENETUNREACH')) {
118+
} else if (
119+
err.code === 'ENETUNREACH' ||
120+
err.message.includes('Network is unreachable') ||
121+
err.message.includes('ENETUNREACH')
122+
) {
107123
errorType = 'network' // Network unreachable
108124
}
109125
// Authentication errors
@@ -116,13 +132,13 @@ async function validateSshCredentials(
116132
) {
117133
errorType = 'auth'
118134
}
119-
135+
120136
debug(`Determined error type: ${errorType}`)
121-
122-
return {
123-
success: false,
137+
138+
return {
139+
success: false,
124140
errorType,
125-
errorMessage: err.message
141+
errorMessage: err.message,
126142
}
127143
} finally {
128144
// Ensure connection is always cleaned up
@@ -176,8 +192,10 @@ export function createRoutes(config: Config): Router {
176192
)
177193

178194
if (!validationResult.success) {
179-
debug(`SSH validation failed for ${sshCredentials.username}@${host}:${port}: ${validationResult.errorType} - ${validationResult.errorMessage}`)
180-
195+
debug(
196+
`SSH validation failed for ${sshCredentials.username}@${host}:${port}: ${validationResult.errorType} - ${validationResult.errorMessage}`
197+
)
198+
181199
// Return appropriate status code based on error type
182200
switch (validationResult.errorType) {
183201
case 'auth':
@@ -187,15 +205,23 @@ export function createRoutes(config: Config): Router {
187205
break
188206
case 'network':
189207
// Network/connectivity issue - no point in re-authenticating
190-
res.status(502).send(`Bad Gateway: Unable to connect to SSH server at ${host}:${port} - ${validationResult.errorMessage}`)
208+
res
209+
.status(502)
210+
.send(
211+
`Bad Gateway: Unable to connect to SSH server at ${host}:${port} - ${validationResult.errorMessage}`
212+
)
191213
break
192214
case 'timeout':
193215
// Connection timeout
194216
res.status(504).send(`Gateway Timeout: SSH connection to ${host}:${port} timed out`)
195217
break
218+
case undefined:
219+
case 'unknown':
196220
default:
197221
// Unknown error - return 502 as it's likely a connectivity issue
198-
res.status(502).send(`Bad Gateway: SSH connection failed - ${validationResult.errorMessage}`)
222+
res
223+
.status(502)
224+
.send(`Bad Gateway: SSH connection failed - ${validationResult.errorMessage}`)
199225
}
200226
return
201227
}
@@ -248,8 +274,10 @@ export function createRoutes(config: Config): Router {
248274
)
249275

250276
if (!validationResult.success) {
251-
debug(`SSH validation failed for ${sshCredentials.username}@${host}:${port}: ${validationResult.errorType} - ${validationResult.errorMessage}`)
252-
277+
debug(
278+
`SSH validation failed for ${sshCredentials.username}@${host}:${port}: ${validationResult.errorType} - ${validationResult.errorMessage}`
279+
)
280+
253281
// Return appropriate status code based on error type
254282
switch (validationResult.errorType) {
255283
case 'auth':
@@ -259,15 +287,23 @@ export function createRoutes(config: Config): Router {
259287
break
260288
case 'network':
261289
// Network/connectivity issue - no point in re-authenticating
262-
res.status(502).send(`Bad Gateway: Unable to connect to SSH server at ${host}:${port} - ${validationResult.errorMessage}`)
290+
res
291+
.status(502)
292+
.send(
293+
`Bad Gateway: Unable to connect to SSH server at ${host}:${port} - ${validationResult.errorMessage}`
294+
)
263295
break
264296
case 'timeout':
265297
// Connection timeout
266298
res.status(504).send(`Gateway Timeout: SSH connection to ${host}:${port} timed out`)
267299
break
300+
case undefined:
301+
case 'unknown':
268302
default:
269303
// Unknown error - return 502 as it's likely a connectivity issue
270-
res.status(502).send(`Bad Gateway: SSH connection failed - ${validationResult.errorMessage}`)
304+
res
305+
.status(502)
306+
.send(`Bad Gateway: SSH connection failed - ${validationResult.errorMessage}`)
271307
}
272308
return
273309
}
@@ -295,32 +331,32 @@ export function createRoutes(config: Config): Router {
295331
router.post('/', (req: Request, res: Response) => {
296332
const r = req as ReqWithSession
297333
debug('router.post./: POST /ssh route for SSO authentication')
298-
334+
299335
try {
300336
const body = req.body as Record<string, unknown>
301337
const query = r.query as Record<string, unknown>
302-
338+
303339
// Username and password are required in body
304340
const { username, password } = body
305341
if (!username || !password) {
306342
return void res.status(400).send('Missing required fields in body: username, password')
307343
}
308-
344+
309345
// Host can come from body or query params (body takes precedence)
310-
const host = (body.host || query.host || query.hostname) as string | undefined
346+
const host = (body['host'] ?? query['host'] ?? query['hostname']) as string | undefined
311347
if (!host) {
312348
return void res.status(400).send('Missing required field: host (in body or query params)')
313349
}
314-
350+
315351
// Port can come from body or query params (body takes precedence)
316352
// Handle both string and number types
317-
const portParam = (body.port || query.port) as string | number | undefined
353+
const portParam = (body['port'] ?? query['port']) as string | number | undefined
318354
const port = getValidatedPort(String(portParam))
319-
355+
320356
// SSH term can come from body or query params (body takes precedence)
321-
const sshterm = (body.sshterm || query.sshterm) as string | undefined
357+
const sshterm = (body['sshterm'] ?? query['sshterm']) as string | undefined
322358
const term = validateSshTerm(sshterm)
323-
359+
324360
// Store credentials in session for this POST auth
325361
r.session.authMethod = 'POST'
326362
r.session.sshCredentials = {
@@ -332,19 +368,20 @@ export function createRoutes(config: Config): Router {
332368
if (term) {
333369
r.session.sshCredentials.term = term
334370
}
335-
371+
336372
const sanitized = maskSensitiveData({
337373
host,
338374
port,
339375
username: username as string,
340376
password: '********',
341377
})
342378
debug('POST /ssh - Credentials stored in session:', sanitized)
343-
debug('POST /ssh - Source: body=%o, query=%o',
344-
{ host: body.host, port: body.port, sshterm: body.sshterm },
345-
{ host: query.host || query.hostname, port: query.port, sshterm: query.sshterm }
379+
debug(
380+
'POST /ssh - Source: body=%o, query=%o',
381+
{ host: body['host'], port: body['port'], sshterm: body['sshterm'] },
382+
{ host: query['host'] ?? query['hostname'], port: query['port'], sshterm: query['sshterm'] }
346383
)
347-
384+
348385
// Serve the client page
349386
void handleConnection(r, res, { host })
350387
} catch (err) {
@@ -367,22 +404,21 @@ export function createRoutes(config: Config): Router {
367404
router.get('/reauth', (req: Request, res: Response) => {
368405
const r = req as ReqWithSession
369406
debug('router.get.reauth: Clearing session credentials and forcing re-authentication')
370-
407+
371408
// Clear all SSH-related session data
372409
delete (r.session as Record<string, unknown>)['sshCredentials']
373410
delete (r.session as Record<string, unknown>)['usedBasicAuth']
374411
delete (r.session as Record<string, unknown>)['authMethod']
375-
412+
376413
// Clear any other auth-related session data
377-
if (r.session) {
378-
const session = r.session as Record<string, unknown>
379-
Object.keys(session).forEach(key => {
380-
if (key.startsWith('ssh') || key.includes('auth') || key.includes('cred')) {
381-
delete session[key]
382-
}
383-
})
384-
}
385-
414+
const session = r.session as Record<string, unknown>
415+
Object.keys(session).forEach((key) => {
416+
if (key.startsWith('ssh') || key.includes('auth') || key.includes('cred')) {
417+
// Use bracket notation to avoid object injection detection
418+
delete session[key as keyof typeof session]
419+
}
420+
})
421+
386422
// Redirect to the main SSH page for fresh authentication
387423
res.redirect('/ssh')
388424
})

‎app/socket.ts‎

Lines changed: 19 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ class WebSSH2Socket extends EventEmitter {
172172
// When credentials are explicitly provided (e.g., from the modal), always update them
173173
// This ensures that user-provided credentials override any session-stored credentials
174174
// including when the user changes connection parameters like the port
175-
if (creds && Object.keys(creds).length > 0) {
175+
if (Object.keys(creds).length > 0) {
176176
if (!this.authPipeline.setManualCredentials(creds)) {
177177
debug(`handleAuthenticate: ${this.socket.id}, CREDENTIALS INVALID`)
178178
this.socket.emit('authentication', {
@@ -182,7 +182,7 @@ class WebSSH2Socket extends EventEmitter {
182182
})
183183
return
184184
}
185-
185+
186186
// CRITICAL: Also update session credentials so reconnections use the new values
187187
// This fixes the issue where updated port/host from modal were ignored on reconnect
188188
const req = this.socket.request as ExtendedRequest
@@ -194,12 +194,14 @@ class WebSSH2Socket extends EventEmitter {
194194
username: creds['username'] as string,
195195
password: creds['password'] as string,
196196
}
197-
if (creds['term'] && req.session.sshCredentials) {
197+
if (creds['term']) {
198198
req.session.sshCredentials.term = creds['term'] as string
199199
}
200200
}
201-
202-
debug(`handleAuthenticate: Updated credentials from user input (was ${originalAuthMethod}, now manual)`)
201+
202+
debug(
203+
`handleAuthenticate: Updated credentials from user input (was ${originalAuthMethod}, now manual)`
204+
)
203205
}
204206

205207
// Track original auth method for debugging
@@ -278,14 +280,18 @@ class WebSSH2Socket extends EventEmitter {
278280

279281
// Clear session credentials on network/connectivity errors to prevent stuck loops
280282
// Network errors indicate the host/port is wrong, not the credentials
281-
if (error.code === 'ECONNREFUSED' ||
282-
error.code === 'ENOTFOUND' ||
283-
error.code === 'ETIMEDOUT' ||
284-
error.code === 'ENETUNREACH' ||
285-
error.message?.includes('ECONNREFUSED') ||
286-
error.message?.includes('ENOTFOUND') ||
287-
error.message?.includes('timeout')) {
288-
debug(`Network error detected (${error.code || 'unknown'}), clearing session credentials to prevent loop`)
283+
if (
284+
error.code === 'ECONNREFUSED' ||
285+
error.code === 'ENOTFOUND' ||
286+
error.code === 'ETIMEDOUT' ||
287+
error.code === 'ENETUNREACH' ||
288+
error.message.includes('ECONNREFUSED') ||
289+
error.message.includes('ENOTFOUND') ||
290+
error.message.includes('timeout')
291+
) {
292+
debug(
293+
`Network error detected (${error.code ?? 'unknown'}), clearing session credentials to prevent loop`
294+
)
289295
const req = this.socket.request as ExtendedRequest
290296
if (req.session) {
291297
delete req.session.sshCredentials

0 commit comments

Comments
 (0)