etherpad/src/node/handler/PadMessageHandler.ts at develop · ether/etherpad · GitHub

History

1761 lines (1595 loc) · 73.7 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

497

498

499

500

501

502

503

504

505

506

507

508

509

510

511

512

513

514

515

516

517

518

519

520

521

522

523

524

525

526

527

528

529

530

531

532

533

534

535

536

537

538

539

540

541

542

543

544

545

546

547

548

549

550

551

552

553

554

555

556

557

558

559

560

561

562

563

564

565

566

567

568

569

570

571

572

573

574

575

576

577

578

579

580

581

582

583

584

585

586

587

588

589

590

591

592

593

594

595

596

597

598

599

600

601

602

603

604

605

606

607

608

609

610

611

612

613

614

615

616

617

618

619

620

621

622

623

624

625

626

627

628

629

630

631

632

633

634

635

636

637

638

639

640

641

642

643

644

645

646

647

648

649

650

651

652

653

654

655

656

657

658

659

660

661

662

663

664

665

666

667

668

669

670

671

672

673

674

675

676

677

678

679

680

681

682

683

684

685

686

687

688

689

690

691

692

693

694

695

696

697

698

699

700

701

702

703

704

705

706

707

708

709

710

711

712

713

714

715

716

717

718

719

720

721

722

723

724

725

726

727

728

729

730

731

732

733

734

735

736

737

738

739

740

741

742

743

744

745

746

747

748

749

750

751

752

753

754

755

756

757

758

759

760

761

762

763

764

765

766

767

768

769

770

771

772

773

774

775

776

777

778

779

780

781

782

783

784

785

786

787

788

789

790

791

792

793

794

795

796

797

798

799

800

801

802

803

804

805

806

807

808

809

810

811

812

813

814

815

816

817

818

819

820

821

822

823

824

825

826

827

828

829

830

831

832

833

834

835

836

837

838

839

840

841

842

843

844

845

846

847

848

849

850

851

852

853

854

855

856

857

858

859

860

861

862

863

864

865

866

867

868

869

870

871

872

873

874

875

876

877

878

879

880

881

882

883

884

885

886

887

888

889

890

891

892

893

894

895

896

897

898

899

900

901

902

903

904

905

906

907

908

909

910

911

912

913

914

915

916

917

918

919

920

921

922

923

924

925

926

927

928

929

930

931

932

933

934

935

936

937

938

939

940

941

942

943

944

945

946

947

948

949

950

951

952

953

954

955

956

957

958

959

960

961

962

963

964

965

966

967

968

969

970

971

972

973

974

975

976

977

978

979

980

981

982

983

984

985

986

987

988

989

990

991

992

993

994

995

996

997

998

999

1000

'use strict';

/**

* The MessageHandler handles all Messages that comes from Socket.IO and controls the sessions

* Licensed under the Apache License, Version 2.0 (the "License");

* you may not use this file except in compliance with the License.

* You may obtain a copy of the License at

* http://www.apache.org/licenses/LICENSE-2.0

* Unless required by applicable law or agreed to in writing, software

* distributed under the License is distributed on an "AS-IS" BASIS,

* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

* See the License for the specific language governing permissions and

* limitations under the License.

import {MapArrayType} from "../types/MapType";

import AttributeMap from '../../static/js/AttributeMap';

const padManager = require('../db/PadManager');

const padDeletionManager = require('../db/PadDeletionManager');

import {applyToText, checkRep, cloneAText, compose, deserializeOps, follow, identity, inverse, makeAText, moveOpsToNewPool, mutateAttributionLines, mutateTextLines, oldLen, prepareForWire, splitAttributionLines, splitTextLines, unpack} from '../../static/js/Changeset';

import ChatMessage from '../../static/js/ChatMessage';

import AttributePool from '../../static/js/AttributePool';

const AttributeManager = require('../../static/js/AttributeManager');

const authorManager = require('../db/AuthorManager');

import padutils from '../../static/js/pad_utils';

import readOnlyManager from '../db/ReadOnlyManager';

import settings, {

exportAvailable,

getPublicPrivacyBanner,

sofficeAvailable

} from '../utils/Settings';

import {anonymizeIp} from '../utils/anonymizeIp';

import {isAcceptingConnections} from '../updater/SessionDrainer';

import {SYSTEM_AUTHOR_ID, isSystemAuthor} from '../utils/SystemAuthor';

const logIp = (ip: string | null | undefined) => anonymizeIp(ip, settings.ipLogging);

const securityManager = require('../db/SecurityManager');

const plugins = require('../../static/js/pluginfw/plugin_defs');

import log4js from 'log4js';

const messageLogger = log4js.getLogger('message');

const accessLogger = log4js.getLogger('access');

const hooks = require('../../static/js/pluginfw/hooks');

const stats = require('../stats')

const assert = require('assert').strict;

import {recordChangesetApply, recordSocketEmit} from '../prom-instruments';

import {RateLimiterMemory} from 'rate-limiter-flexible';

import {ChangesetRequest, PadUserInfo, SocketClientRequest} from "../types/SocketClientRequest";

import {APool, AText, PadAuthor, PadType} from "../types/PadType";

import {ChangeSet} from "../types/ChangeSet";

import {ChatMessageMessage, ClientReadyMessage, ClientSaveRevisionMessage, ClientSuggestUserName, ClientUserChangesMessage, ClientVarMessage, CustomMessage, PadDeleteMessage, PadOptionsMessage, UserNewInfoMessage} from "../../static/js/types/SocketIOMessage";

import {Builder} from "../../static/js/Builder";

const webaccess = require('../hooks/express/webaccess');

const { checkValidRev } = require('../utils/checkValidRev');

let rateLimiter:any;

let socketio: any = null;

hooks.deprecationNotices.clientReady = 'use the userJoin hook instead';

const addContextToError = (err:any, pfx:string) => {

const newErr = new Error(`${pfx}${err.message}`, {cause: err});

if (Error.captureStackTrace) Error.captureStackTrace(newErr, addContextToError);

// Check for https://github.com/tc39/proposal-error-cause support, available in Node.js >= v16.10.

if (newErr.cause === err) return newErr;

err.message = `${pfx}${err.message}`;

return err;

};

exports.socketio = () => {

// The rate limiter is created in this hook so that restarting the server resets the limiter. The

// settings.commitRateLimiting object is passed directly to the rate limiter so that the limits

// can be dynamically changed during runtime by modifying its properties.

rateLimiter = new RateLimiterMemory(settings.commitRateLimiting);

};

/**

* Contains information about socket.io connections:

* - key: Socket.io socket ID.

* - value: Object that is initially empty immediately after connect. Once the client's

* CLIENT_READY message is processed, it has the following properties:

* - auth: Object with the following properties copied from the client's CLIENT_READY message:

* - padID: Pad ID requested by the user. Unlike the padId property described below, this

* may be a read-only pad ID.

* - sessionID: The value returned from the createSession() HTTP API, normally set as

* the `sessionID` cookie by the integrator. Read from the socket.io handshake's

* Cookie header (so the cookie can be HttpOnly — issue #7045) and falls back to a

* deprecated `sessionID` field on the CLIENT_READY message for legacy clients.

* This will be null/undefined if createSession() isn't used or the integrator

* doesn't set the sessionID cookie.

* - token: User-supplied token.

* - author: The user's author ID.

* - padId: The real (not read-only) ID of the pad.

* - readOnlyPadId: The read-only ID of the pad.

* - readonly: Whether the client has read-only access (true) or read/write access (false).

* - rev: The last revision that was sent to the client.

const sessioninfos:MapArrayType<any> = {};

exports.sessioninfos = sessioninfos;

function getTotalActiveUsers() {

return socketio ? socketio.engine.clientsCount : 0;

}

exports.getTotalActiveUsers = getTotalActiveUsers;

function getActivePadCountFromSessionInfos() {

const padIds = new Set();

for (const {padId} of Object.values(sessioninfos)) {

if (!padId) continue;

padIds.add(padId);

}

return padIds.size;

}

exports.getActivePadCountFromSessionInfos = getActivePadCountFromSessionInfos;

// Per-pad user counts derived on demand from sessioninfos. Used by

// prometheus.ts to populate `etherpad_pad_users{padId}` so the #7756

// scaling-dive harness can confirm the pad it's pointing at actually

// has the expected concurrency.

function getPadUsersMap(): Map<string, number> {

const out = new Map<string, number>();

for (const {padId} of Object.values(sessioninfos)) {

if (!padId) continue;

out.set(padId, (out.get(padId) ?? 0) + 1);

}

return out;

}

exports.getPadUsersMap = getPadUsersMap;

/**

* Build a sanitized copy of the plugins registry suitable for sending to the

* client as part of clientVars. The shape is preserved but each plugin's

* `package` field is reduced to `{name, version}` so internal paths (realPath,

* path, location) are not leaked to the browser.

* CRITICAL: this function MUST NOT mutate the shared server-side registry.

* Other components — notably `src/node/utils/Minify.ts` — read

* `plugins.plugins[x].package.realPath` on every static asset request to

* resolve `/static/plugins/ep_<name>/...` URLs to disk. Mutating the shared object

* in place would clobber `realPath` and cause every such request to 500 with

* `ERR_INVALID_ARG_TYPE: The "path" argument must be of type string`.

const sanitizePluginsForWire = (

pluginsRegistry: MapArrayType<any>,

): MapArrayType<any> => {

const out: MapArrayType<any> = {};

for (const [name, plugin] of Object.entries(pluginsRegistry)) {

const p: any = plugin.package;

out[name] = {

...plugin,

package: {name: p.name, version: p.version},

};

}

return out;

};

exports.sanitizePluginsForWire = sanitizePluginsForWire;

stats.gauge('totalUsers', () => getTotalActiveUsers());

stats.gauge('activePads', () => {

return getActivePadCountFromSessionInfos();

});

/**

* Processes one task at a time per channel.

class Channels {

private readonly _exec: (ch:any, task:any) => any;

private _promiseChains: Map<any, Promise<any>>;

/**

* @param {(ch, task) => any} [exec] - Task executor. If omitted, tasks are assumed to be

* functions that will be executed with the channel as the only argument.

constructor(exec = (ch: string, task:any) => task(ch)) {

this._exec = exec;

this._promiseChains = new Map();

}

/**

* Schedules a task for execution. The task will be executed once all previously enqueued tasks

* for the named channel have completed.

* @param {any} ch - Identifies the channel.

* @param {any} task - The task to give to the executor.

* @returns {Promise<any>} The value returned by the executor.

async enqueue(ch:any, task:any): Promise<any> {

const p = (this._promiseChains.get(ch) || Promise.resolve()).then(() => this._exec(ch, task));

const pc = p

.catch(() => {}) // Prevent rejections from halting the queue.

.then(() => {

// Clean up this._promiseChains if there are no more tasks for the channel.

if (this._promiseChains.get(ch) === pc) this._promiseChains.delete(ch);

});

this._promiseChains.set(ch, pc);

return await p;

}

/**

* A changeset queue per pad that is processed by handleUserChanges()

// The channel key `ch` is the pad id captured at enqueue time (see the enqueue

// call). Pass it through to handleUserChanges so the write targets the pad that

// was authorized when the message arrived — NOT whatever pad the mutable

// sessioninfos[socket.id].padId happens to point at by apply time. A concurrent

// same-socket CLIENT_READY can swap that padId between enqueue and apply, which

// otherwise redirects the queued write onto a read-only / unauthorized pad

// (GHSA-6mcx-x5h6-rpw2).

const padChannels = new Channels((ch, {socket, message}) => handleUserChanges(socket, message, ch));

/**

* This Method is called by server.ts to tell the message handler on which socket it should send

* @param socket_io The Socket

exports.setSocketIO = (socket_io:any) => {

socketio = socket_io;

};

/**

* Handles the connection of a new user

* @param socket the socket.io Socket object for the new connection from the client

exports.handleConnect = (socket:any) => {

stats.meter('connects').mark();

// Initialize sessioninfos for this new session

sessioninfos[socket.id] = {};

};

/**

* Kicks all sessions from a pad

exports.kickSessionsFromPad = (padID: string) => {

if(socketio.sockets == null) return;

// skip if there is nobody on this pad

if (_getRoomSockets(padID).length === 0) return;

// disconnect everyone from this pad

socketio.in(padID).emit('message', {disconnect: 'deleted'});

};

/**

* Handles the disconnection of a user

* @param socket the socket.io Socket object for the client

exports.handleDisconnect = async (socket:any) => {

stats.meter('disconnects').mark();

const session = sessioninfos[socket.id];

delete sessioninfos[socket.id];

// session.padId can be nullish if the user disconnects before sending CLIENT_READY.

if (!session || !session.author || !session.padId) return;

const {session: {user} = {}} = socket.client.request as SocketClientRequest;

/* eslint-disable prefer-template -- it doesn't support breaking across multiple lines */

accessLogger.info('[LEAVE]' +

` pad:${session.padId}` +

` socket:${socket.id}` +

` IP:${logIp(socket.request.ip)}` +

` authorID:${session.author}` +

(user && user.username ? ` username:${user.username}` : ''));

/* eslint-enable prefer-template */

// Client presence is keyed by authorID. With the #7656 fix, multiple sockets

// can share an authorID (same authenticated identity across windows/devices),

// so emitting USER_LEAVE on every socket disconnect would drop the author

// from presence even when another socket of theirs is still connected. Only

// broadcast — and only run the userLeave hook — when the *last* socket for

// this author leaves the pad.

const isLastSocketForAuthor = !_getRoomSockets(session.padId).some(

(s: any) => sessioninfos[s.id]?.author === session.author);

if (isLastSocketForAuthor) {

socket.broadcast.to(session.padId).emit('message', {

type: 'COLLABROOM',

data: {

type: 'USER_LEAVE',

userInfo: {

colorId: await authorManager.getAuthorColorId(session.author),

userId: session.author,

});

await hooks.aCallAll('userLeave', {

...session, // For backwards compatibility.

authorId: session.author,

readOnly: session.readonly,

socket,

});

}

};

const handlePadDelete = async (socket: any, padDeleteMessage: PadDeleteMessage) => {

const session = sessioninfos[socket.id];

if (!session || !session.author || !session.padId) throw new Error('session not ready');

const padId = padDeleteMessage.data.padId;

if (session.padId !== padId) throw new Error('refusing cross-pad delete');

if (!await padManager.doesPadExist(padId)) return;

const retrievedPad = await padManager.getPad(padId);

const firstContributor = await retrievedPad.getRevisionAuthor(0);

const isCreator = session.author === firstContributor;

const suppliedToken = padDeleteMessage.data.deletionToken;

const tokenSupplied = typeof suppliedToken === 'string' && suppliedToken !== '';

const tokenOk = tokenSupplied &&

await padDeletionManager.isValidDeletionToken(padId, suppliedToken);

// When a token is supplied it must validate. We deliberately do NOT fall

// back to the creator-cookie path, otherwise a creator pasting a wrong

// recovery token into the disclosure field would still succeed — masking a

// typo and contradicting the UI.

// Readonly sessions can never delete via the token-less paths: they cannot

// edit the pad, so they must not be able to destroy it just because

// allowPadDeletionByAllUsers is on (issue #7959). A valid recovery token

// (tokenOk) remains a sufficient credential regardless of session mode.

const writable = !session.readonly;

const creatorOk = !tokenSupplied && isCreator && writable;

const flagOk = !tokenSupplied && !isCreator && settings.allowPadDeletionByAllUsers && writable;

if (creatorOk || tokenOk || flagOk) {

await retrievedPad.remove();

return;

}

// tokenSupplied-but-invalid is a different user-facing message from

// not-the-creator. The client localizes via the l10n key.

const messageKey = tokenSupplied

? 'pad.deletionToken.invalid'

: 'pad.deletionToken.notCreator';

socket.emit('shout', {

type: 'COLLABROOM',

data: {

type: 'shoutMessage',

payload: {

message: {

messageKey,

sticky: false,

timestamp: Date.now(),

});

};

const isPadCreator = async (pad: any, authorId: string) => authorId === await pad.getRevisionAuthor(0);

const handlePadOptionsMessage = async (

socket: any, message: PadOptionsMessage & {data: {payload: PadOptionsMessage}}) => {

const session = sessioninfos[socket.id];

if (!session || !session.author || !session.padId) throw new Error('session not ready');

if (!settings.enablePadWideSettings) return;

if (!await padManager.doesPadExist(session.padId)) {

messageLogger.warn(`Ignoring padoptions for missing pad ${session.padId}`);

return;

}

const pad = await padManager.getPad(session.padId, null, session.author);

if (!await isPadCreator(pad, session.author)) {

socket.emit('shout', {

type: 'COLLABROOM',

data: {

type: 'shoutMessage',

payload: {

message: {

message: 'Only the pad creator can change pad settings',

sticky: false,

timestamp: Date.now(),

});

return;

}

pad.setPadSettings(message.data.payload.options);

await pad.saveToDatabase();

_getRoomSockets(session.padId).forEach((socket) => {

socket.emit('message', message);

});

};

/**

* Handles a message from a user

* @param socket the socket.io Socket object for the client

* @param message the message from the client

exports.handleMessage = async (socket:any, message: ClientVarMessage) => {

const env = process.env.NODE_ENV || 'development';

if (env === 'production') {

try {

await rateLimiter.consume(socket.request.ip); // consume 1 point per event from IP

} catch (err) {

messageLogger.warn(`Rate limited IP ${logIp(socket.request.ip)}. To reduce the amount of rate ` +

'limiting that happens edit the rateLimit values in settings.json');

stats.meter('rateLimited').mark();

socket.emit('message', {disconnect: 'rateLimited'});

throw err;

}

if (message == null) throw new Error('message is null');

if (!message.type) throw new Error('message type missing');

const thisSession = sessioninfos[socket.id];

if (!thisSession) throw new Error('message from an unknown connection');

if (message.type === 'CLIENT_READY') {

// Refuse new joiners while the updater drainer is running. Existing sockets

// are unaffected — only the initial CLIENT_READY handshake is gated. The

// pad UI will show the drain announcement separately via shoutMessage.

// Use socket.emit('message', ...) for consistency with the other disconnect

// paths in this file (see line ~221, 569). socket.json.send is a socket.io

// v2/v3-era API that may not exist on v4 Socket objects.

if (!isAcceptingConnections()) {

socket.emit('message', {disconnect: 'updateInProgress'});

socket.disconnect(true);

return;

}

// Prefer the HttpOnly author-token cookie over the in-message token (GDPR

// PR3). Legacy clients (pre-PR3 browsers or API consumers) still send

// `token` in the CLIENT_READY payload — honour it one more release, warn

// once so the migration is visible in logs. The socket.io handshake does

// not run cookie-parser, so pull the cookie directly from the Cookie

// header.

// The same applies to the integrator-set `sessionID` cookie (issue #7045):

// historically the client read it from `document.cookie`, which forced the

// cookie to be non-HttpOnly and exposed it to XSS. Now we read it from the

// handshake Cookie header so integrators can set it `HttpOnly`.

const cookiePrefix = settings.cookie?.prefix || '';

const cookieHeader: string = socket.request?.headers?.cookie || '';

const readCookie = (name: string): string | null => {

const match = cookieHeader.split(/;\s*/).find(

if (!match) return null;

const raw = match.split('=').slice(1).join('=');

// A malformed value (e.g. `name=%ZZ`) makes decodeURIComponent throw

// URIError. Without this guard a single bad cookie aborts CLIENT_READY,

// letting an unauthenticated peer spam server error logs and block

// itself from joining (flagged by Qodo on #7755). Treat undecodable

// values as absent.

try {

return decodeURIComponent(raw);

} catch (err) {

if (err instanceof URIError) return null;

throw err;

}

};

const cookieToken = readCookie(`${cookiePrefix}token`);

const legacyToken = typeof message.token === 'string' ? message.token : null;

const resolvedToken = cookieToken || legacyToken;

if (!cookieToken && legacyToken && !thisSession.legacyTokenWarned) {

messageLogger.warn(

'client sent author token via CLIENT_READY message; cookie migration ' +

'will take effect on next HTTP response. ' +

'See docs/superpowers/specs/2026-04-19-gdpr-pr3-anon-identity-design.md');

thisSession.legacyTokenWarned = true;

}

const cookieSessionID =

readCookie(`${cookiePrefix}sessionID`) || readCookie('sessionID');

const legacySessionID =

typeof message.sessionID === 'string' ? message.sessionID : null;

const resolvedSessionID = cookieSessionID || legacySessionID;

if (!cookieSessionID && legacySessionID && !thisSession.legacySessionIdWarned) {

messageLogger.warn(

'client sent sessionID via CLIENT_READY message; integrators should ' +

'set the sessionID cookie as HttpOnly (issue #7045). The in-message ' +

'field is deprecated and will be removed in a future release.');

thisSession.legacySessionIdWarned = true;

}

// Remember this information since we won't have the cookie in further socket.io messages. This

// information will be used to check if the sessionId of this connection is still valid since it

// could have been deleted by the API.

thisSession.auth = {

sessionID: resolvedSessionID,

padID: message.padId,

token: resolvedToken,

};

// Issue #7659: connections from the in-place history iframe must not

// trigger the duplicate-author kick — they share the parent's author

// by design, and kicking the parent on iframe load would tear down

// the live editor mid-session. The iframe sets `embed=1` in its

// socket.io handshake query.

thisSession.embed = socket.handshake?.query?.embed === '1';

// Pad does not exist, so we need to sanitize the id

if (!(await padManager.doesPadExist(thisSession.auth.padID))) {

thisSession.auth.padID = await padManager.sanitizePadId(thisSession.auth.padID);

}

const padIds = await readOnlyManager.getIds(thisSession.auth.padID);

thisSession.padId = padIds.padId;

thisSession.readOnlyPadId = padIds.readOnlyPadId;

thisSession.readonly =

padIds.readonly || !webaccess.userCanModify(thisSession.auth.padID, socket.client.request);

}

// Outside of the checks done by this function, message.padId must not be accessed because it is

// too easy to introduce a security vulnerability that allows malicious users to read or modify

// pads that they should not be able to access. Code should instead use

// sessioninfos[socket.id].padId if the real pad ID is needed or

// sessioninfos[socket.id].auth.padID if the original user-supplied pad ID is needed.

Object.defineProperty(message, 'padId', {get: () => {

throw new Error('message.padId must not be accessed (for security reasons)');

}});

const auth = thisSession.auth;

if (!auth) {

const ip = logIp(socket.request.ip);

const msg = JSON.stringify(message, null, 2);

throw new Error(`pre-CLIENT_READY message from IP ${ip}: ${msg}`);

}

// Pin the pad this message is authorized against — together with `auth` and

// the read-only flag — BEFORE any of the awaits below (checkAccess and the

// handleMessageSecurity/handleMessage hooks). A concurrent same-socket

// CLIENT_READY can mutate sessioninfos[socket.id] (padId/readonly/auth) IN

// PLACE during those awaits (the object identity check below does not catch an

// in-place mutation). Using these pinned values for the read-only gate, the

// queue key and the write keeps them all referring to the SAME pad, closing

// the cross-pad write TOCTOU (GHSA-6mcx-x5h6-rpw2).

const messagePadId = thisSession.padId;

const messageReadonly = thisSession.readonly;

const {session: {user} = {}} = socket.client.request as SocketClientRequest;

const {accessStatus, authorID} =

await securityManager.checkAccess(auth.padID, auth.sessionID, auth.token, user);

if (accessStatus !== 'grant') {

socket.emit('message', {accessStatus});

throw new Error('access denied');

}

if (thisSession.author != null && thisSession.author !== authorID) {

socket.emit('message', {disconnect: 'rejected'});

throw new Error([

'Author ID changed mid-session. Bad or missing token or sessionID?',

`socket:${socket.id}`,

`IP:${logIp(socket.request.ip)}`,

`originalAuthorID:${thisSession.author}`,

`newAuthorID:${authorID}`,

...(user && user.username) ? [`username:${user.username}`] : [],

`message:${message}`,

].join(' '));

}

thisSession.author = authorID;

// Allow plugins to bypass the readonly message blocker. Base the decision on

// the value pinned above so a concurrent CLIENT_READY can't flip it mid-message.

let readOnly = messageReadonly;

const context = {

message,

sessionInfo: {

authorId: thisSession.author,

padId: messagePadId,

readOnly: messageReadonly,

socket,

get client() {

padutils.warnDeprecated(

'the `client` context property for the handleMessageSecurity and handleMessage hooks ' +

'is deprecated; use the `socket` property instead');

return this.socket;

};

for (const res of await hooks.aCallAll('handleMessageSecurity', context)) {

switch (res) {

case true:

padutils.warnDeprecated(

'returning `true` from a `handleMessageSecurity` hook function is deprecated; ' +

'return "permitOnce" instead');

thisSession.readonly = false;

// Fall through:

case 'permitOnce':

readOnly = false;

break;

default:

messageLogger.warn(

'Ignoring unsupported return value from handleMessageSecurity hook function:', res);

}

// Call handleMessage hook. If a plugin returns null, the message will be dropped.

if ((await hooks.aCallAll('handleMessage', context)).some((m: null|string) => m == null)) {

return;

}

// Drop the message if the client disconnected during the above processing.

if (sessioninfos[socket.id] !== thisSession) throw new Error('client disconnected');

const {type} = message;

try {

switch (type) {

case 'CLIENT_READY': await handleClientReady(socket, message); break;

case 'CHANGESET_REQ': await handleChangesetRequest(socket, message); break;

case 'COLLABROOM': {

if (readOnly) throw new Error('write attempt on read-only pad');

const {type} = message.data;

try {

switch (type) {

case 'USER_CHANGES':

stats.counter('pendingEdits').inc();

// Queue key = the pinned pad, NOT the (possibly-swapped) live

// session padId. This value is forwarded to handleUserChanges as

// the write target (see the padChannels executor).

await padChannels.enqueue(messagePadId, {socket, message});

break;

case 'PAD_DELETE': await handlePadDelete(socket, message.data as unknown as PadDeleteMessage); break;

case 'USERINFO_UPDATE': await handleUserInfoUpdate(socket, message as unknown as UserNewInfoMessage); break;

case 'CHAT_MESSAGE': await handleChatMessage(socket, message as unknown as ChatMessageMessage); break;

case 'GET_CHAT_MESSAGES': await handleGetChatMessages(socket, message); break;

case 'SAVE_REVISION': await handleSaveRevisionMessage(socket, message as unknown as ClientSaveRevisionMessage); break;

case 'CLIENT_MESSAGE': {

const {type} = message.data.payload;

try {

switch (type) {

case 'suggestUserName': handleSuggestUserName(socket, message as unknown as ClientSuggestUserName); break;

case 'padoptions':

await handlePadOptionsMessage(

socket,

message as unknown as PadOptionsMessage & {data: {payload: PadOptionsMessage}});

break;

default: throw new Error('unknown message type');

}

} catch (err) {

throw addContextToError(err, `${type}: `);

}

break;

}

default: throw new Error('unknown message type');

}

} catch (err) {

throw addContextToError(err, `${type}: `);

}

break;

}

default: throw new Error('unknown message type');

}

} catch (err) {

throw addContextToError(err, `${type}: `);

}

};

/**

* Handles a save revision message

* @param socket the socket.io Socket object for the client

* @param message the message from the client

const handleSaveRevisionMessage = async (socket:any, message: ClientSaveRevisionMessage) => {

const {padId, author: authorId} = sessioninfos[socket.id];

const pad = await padManager.getPad(padId, null, authorId);

const savedRevision = await pad.addSavedRevision(pad.head, authorId);

// Notify every client in the pad room — including any open timeslider —

// so saved-revision markers appear live instead of only on the next

// timeslider load (#7946). The client's NEW_SAVEDREV handler existed but

// was never reached because this broadcast was missing; live editors that

// don't handle the type ignore it. Skip the emit for duplicate saves.

if (savedRevision) {

socketio.sockets.in(padId).emit('message', {

type: 'COLLABROOM',

data: {type: 'NEW_SAVEDREV', savedRev: savedRevision},

});

}

};

/**

* Handles a custom message, different to the function below as it handles

* objects not strings and you can direct the message to specific sessionID

* @param msg {Object} the message we're sending

* @param sessionID {string} the socketIO session to which we're sending this message

exports.handleCustomObjectMessage = (msg: CustomMessage, sessionID: string) => {

if (msg.data.type === 'CUSTOM') {

if (sessionID) {

// a sessionID is targeted: directly to this sessionID

socketio.sockets.socket(sessionID).emit('message', msg);

} else {

// broadcast to all clients on this pad

socketio.sockets.in(msg.data.payload.padId).emit('message', msg);

recordSocketEmit(msg.data.type);

}

};

/**

* Handles a custom message (sent via HTTP API request)

* @param padID {Pad} the pad to which we're sending this message

* @param msgString {String} the message we're sending

exports.handleCustomMessage = (padID: string, msgString:string) => {

const time = Date.now();

const msg = {

type: 'COLLABROOM',

data: {

type: msgString,

time,

};

socketio.sockets.in(padID).emit('message', msg);

recordSocketEmit(msg.data.type);

};

/**

* Handles a Chat Message

* @param socket the socket.io Socket object for the client

* @param message the message from the client

const handleChatMessage = async (socket:any, message: ChatMessageMessage) => {

const chatMessage = ChatMessage.fromObject(message.data.message);

const {padId, author: authorId} = sessioninfos[socket.id];

// Don't trust the user-supplied values.

chatMessage.time = Date.now();

chatMessage.authorId = authorId;

await exports.sendChatMessageToPadClients(chatMessage, padId);

};

/**

* Adds a new chat message to a pad and sends it to connected clients.

* @param {(ChatMessage|number)} mt - Either a chat message object (recommended) or the timestamp of

* the chat message in ms since epoch (deprecated).

* @param {string} puId - If `mt` is a chat message object, this is the destination pad ID.

* Otherwise, this is the user's author ID (deprecated).

* @param {string} [text] - The text of the chat message. Deprecated; use `mt.text` instead.

* @param {string} [padId] - The destination pad ID. Deprecated; pass a chat message

* object as the first argument and the destination pad ID as the second argument instead.

exports.sendChatMessageToPadClients = async (mt: ChatMessage|number, puId: string, text:string|null = null, padId:string|null = null) => {

const message = mt instanceof ChatMessage ? mt : new ChatMessage(text, puId, mt);

padId = mt instanceof ChatMessage ? puId : padId;

const pad = await padManager.getPad(padId, null, message.authorId);

await hooks.aCallAll('chatNewMessage', {message, pad, padId});

// pad.appendChatMessage() ignores the displayName property so we don't need to wait for

// authorManager.getAuthorName() to resolve before saving the message to the database.

const promise = pad.appendChatMessage(message);

message.displayName = await authorManager.getAuthorName(message.authorId);

socketio.sockets.in(padId).emit('message', {

type: 'COLLABROOM',

data: {type: 'CHAT_MESSAGE', message},

});

recordSocketEmit('CHAT_MESSAGE');

await promise;

};

/**

* Handles the clients request for more chat-messages

* @param socket the socket.io Socket object for the client

* @param message the message from the client

const handleGetChatMessages = async (socket:any, {data: {start, end}}:any) => {

if (!Number.isInteger(start)) throw new Error(`missing or invalid start: ${start}`);

if (!Number.isInteger(end)) throw new Error(`missing or invalid end: ${end}`);

const count = end - start;

if (count < 0 || count > 100) throw new Error(`invalid number of messages: ${count}`);

const {padId, author: authorId} = sessioninfos[socket.id];

const pad = await padManager.getPad(padId, null, authorId);

const chatMessages = await pad.getChatMessages(start, end);

const infoMsg = {

type: 'COLLABROOM',

data: {

type: 'CHAT_MESSAGES',

messages: chatMessages,

};

// send the messages back to the client

socket.emit('message', infoMsg);

};

/**

* Handles a handleSuggestUserName, that means a user have suggest a userName for a other user

* @param socket the socket.io Socket object for the client

* @param message the message from the client

const handleSuggestUserName = (socket:any, message: ClientSuggestUserName) => {

const {newName, unnamedId} = message.data.payload;

if (newName == null) throw new Error('missing newName');

if (unnamedId == null) throw new Error('missing unnamedId');

const padId = sessioninfos[socket.id].padId;

// search the author and send him this message

_getRoomSockets(padId).forEach((socket) => {

const session = sessioninfos[socket.id];

if (session && session.author === unnamedId) {

socket.emit('message', message);

}

});

};

/**

* Handles a USERINFO_UPDATE, that means that a user have changed his color or name.

* Anyway, we get both informations

* @param socket the socket.io Socket object for the client

* @param message the message from the client

const handleUserInfoUpdate = async (socket:any, {data: {userInfo: {name, colorId}}}: UserNewInfoMessage) => {

if (colorId == null) throw new Error('missing colorId');

if (!name) name = null;

const session = sessioninfos[socket.id];

if (!session || !session.author || !session.padId) throw new Error('session not ready');

const author = session.author;

if (!/(^#[0-9A-F]{6}$)|(^#[0-9A-F]{3}$)/i.test(colorId)) {

throw new Error(`malformed color: ${colorId}`);

}

// Tell the authorManager about the new attributes

const p = Promise.all([

authorManager.setAuthorColorId(author, colorId),

authorManager.setAuthorName(author, name),

]);

const padId = session.padId;

const infoMsg = {

type: 'COLLABROOM',

data: {

// The Client doesn't know about USERINFO_UPDATE, use USER_NEWINFO

type: 'USER_NEWINFO',

userInfo: {userId: author, name, colorId},

};

// Send the other clients on the pad the update message

socket.broadcast.to(padId).emit('message',infoMsg);

// Block until the authorManager has stored the new attributes.

await p;

};

/**

* Handles a USER_CHANGES message, where the client submits its local

* edits as a changeset.

* This handler's job is to update the incoming changeset so that it applies

* to the latest revision, then add it to the pad, broadcast the changes

* to all other clients, and send a confirmation to the submitting client.

* This function is based on a similar one in the original Etherpad.

* See https://github.com/ether/pad/blob/master/etherpad/src/etherpad/collab/collab_server.js in the function applyUserChanges()

* @param socket the socket.io Socket object for the client

* @param message the message from the client

const handleUserChanges = async (socket:any, message: {

data: ClientUserChangesMessage

}, authorizedPadId: string) => {

// This one's no longer pending, as we're gonna process it now

stats.counter('pendingEdits').dec();

// The client might disconnect between our callbacks. We should still

// finish processing the changeset, so keep a reference to the session.

const thisSession = sessioninfos[socket.id];

// TODO: this might happen with other messages too => find one place to copy the session

// and always use the copy. atm a message will be ignored if the session is gone even

// if the session was valid when the message arrived in the first place

if (!thisSession) throw new Error('client disconnected');

// Measure time to process edit. stats.timer('edits') spans the full handler

// (apply + fan-out) for backwards-compat; the new Prometheus histogram below

// wraps only the apply path so the scaling-dive harness can distinguish

// "apply is slow" from "fan-out is slow". Failed applies do not call the

// stopper — leaving the timer un-observed keeps the success-path

// distribution clean.

const stopWatch = stats.timer('edits').start();

const stopApplyHistogram = recordChangesetApply();

try {

const {data: {baseRev, apool, changeset}} = message;

if (baseRev == null) throw new Error('missing baseRev');

if (apool == null) throw new Error('missing apool');

if (changeset == null) throw new Error('missing changeset');

const wireApool = (new AttributePool()).fromJsonable(apool);

// Use the pad id captured at enqueue time, not the (mutable) session padId,

// which a concurrent CLIENT_READY may have swapped (GHSA-6mcx-x5h6-rpw2).

const pad = await padManager.getPad(authorizedPadId, null, thisSession.author);

// Verify that the changeset has valid syntax and is in canonical form

checkRep(changeset);

// Validate all added 'author' attribs to be the same value as the current user.

// Exception: '=' ops (attribute changes on existing text) are allowed to restore other authors'

// IDs, but only if that author already exists in the pad's pool (i.e., they genuinely

// contributed to this pad). This is necessary for undoing "clear authorship colors", which

// re-applies the original author attributes for all authors.

// See https://github.com/ether/etherpad-lite/issues/2802

for (const op of deserializeOps(unpack(changeset).ops)) {

// + can add text with attribs

// = can change or add attribs

// - can have attribs, but they are discarded and don't show up in the attribs -

// but do show up in the pool

// Besides verifying the author attribute, this serves a second purpose:

// AttributeMap.fromString() ensures that all attribute numbers are valid (it will throw if

// an attribute number isn't in the pool).

const opAuthorId = AttributeMap.fromString(op.attribs, wireApool).get('author');

if (opAuthorId && opAuthorId !== thisSession.author) {

if (op.opcode === '=') {

// Allow restoring author attributes on existing text (undo of clear authorship),

// but only if the author ID is already known to this pad. This prevents a user

// from attributing text to a fabricated author who never contributed to the pad.

const knownAuthor = pad.pool.putAttrib(['author', opAuthorId], true) !== -1;

if (!knownAuthor) {

throw new Error(`Author ${thisSession.author} tried to set unknown author ` +

`${opAuthorId} on existing text in changeset ${changeset}`);

}

} else {

// Reject '+' ops (inserting new text as another author) and '-' ops (deleting

// with another author's attribs). While '-' attribs are discarded from the

// document, they are added to the pad's attribute pool by moveOpsToNewPool,

// which could be exploited to inject fabricated author IDs into the pool and

// bypass the '=' op pool check above.

throw new Error(`Author ${thisSession.author} tried to submit changes as author ` +

`${opAuthorId} in changeset ${changeset}`);

}

// Reject '+' ops that do not carry the author attribute. The standard

// JS client always tags inserts with the author; rejecting unattributed

// inserts here keeps pad.atext.text and pad.atext.attribs in lock-step.

// Without this check, an insert op with empty attribs grows the text

// without contributing matching markers to the attribs string, leaving

// the stored AText in a state where the two iterables disagree on

// length — applyToAText then desyncs and breaks reconciliation in

// every client that later loads the pad.

if (op.opcode === '+' && !opAuthorId) {

throw new Error(`Author ${thisSession.author} submitted an insert without an ` +

`author attribute in changeset ${changeset}`);

}

// Defense-in-depth: reject any wire-borne `*N` that resolves to the

// system author. The session-author equality check above already

// catches the case where `*N` claims a different real user as

// author, but `Pad.SYSTEM_AUTHOR_ID` is server-internal — it's

// only used when `spliceText` / `setText` are called with an empty

// authorId from HTTP API or plugin paths. No legitimate

// socket.io session ever writes as the system author, so a wire

// op that names it is either a confused client or an attempt to

// launder writes through a reserved attribution slot. Either way,

// refuse.

// `SYSTEM_AUTHOR_ID` comes from the leaf module rather than

// `Pad.SYSTEM_AUTHOR_ID`: a `const {Pad} = require('../db/Pad')` at

// module scope returned a partially-initialized class here (circular

// load via padManager), so the static-field access ended up undefined

// and short-circuited the check at runtime.

if (opAuthorId === SYSTEM_AUTHOR_ID) {

throw new Error(`Author ${thisSession.author} attempted to submit changes as the ` +

`reserved system author ${opAuthorId} in changeset ${changeset}`);

}

// ex. adoptChangesetAttribs

// Afaik, it copies the new attributes from the changeset, to the global Attribute Pool

let rebasedChangeset = moveOpsToNewPool(changeset, wireApool, pad.pool);

// Snapshot the post-pool-mapping form so the retransmission check below

// can recognise our changeset against the stored revision form. Comparing

// the raw client `changeset` against `c` would miss legitimate

// retransmissions whenever moveOpsToNewPool renumbered an attribute

// (e.g. `*0` -> `*1` because the pad pool already had something at slot 0).

const canonicalCs = rebasedChangeset;

// ex. applyUserChanges

let r = baseRev;

// The client's changeset might not be based on the latest revision,

// since other clients are sending changes at the same time.

// Update the changeset so that it can be applied to the latest revision.

while (r < pad.getHeadRevisionNumber()) {

r++;

const {changeset: c, meta: {author: authorId}} = await pad.getRevision(r);

if (canonicalCs === c && thisSession.author === authorId) {

// Assume this is a retransmission of an already applied changeset.

rebasedChangeset = identity(unpack(canonicalCs).oldLen);

}

// At this point, both "c" (from the pad) and "changeset" (from the

// client) are relative to revision r - 1. The follow function

// rebases "changeset" so that it is relative to revision r

// and can be applied after "c".

rebasedChangeset = follow(c, rebasedChangeset, false, pad.pool);

}

const prevText = pad.text();

if (oldLen(rebasedChangeset) !== prevText.length) {

throw new Error(

`Can't apply changeset ${rebasedChangeset} with oldLen ` +

`${oldLen(rebasedChangeset)} to document of length ${prevText.length}`);

}

// Defensive: reject any rebased changeset whose application would leave

// the pad text not ending with '\n'. Previously the server silently

// appended a separate `nlChangeset` correction revision; that worked

// for the stored pad but the FIRST broadcast (the malformed user

// revision) reached browsers BEFORE the correction did, and the

// browser's line assembler asserts "line assembler not finished" on

// a doc that doesn't end with '\n', taking the session out. Refuse to

// accept such changesets — clients must always preserve the

// trailing-newline invariant.

const projectedText = applyToText(rebasedChangeset, prevText);

if (!projectedText.endsWith('\n')) {

View remainder of file in raw view

etherpad/src/node/handler/PadMessageHandler.ts at develop · ether/etherpad · GitHub

Uh oh!

Uh oh!

etherpad/src/node/handler/PadMessageHandler.ts at develop · ether/etherpad · GitHub

Uh oh!

Uh oh!

Expand file tree

Breadcrumbs

PadMessageHandler.ts

Latest commit

History

Breadcrumbs

PadMessageHandler.ts

File metadata and controls