chore: update dependencies to latest versions for express, multer, and puppeteer

Author: pitazzo

CLAUDE.md

@@ -19,6 +19,9 @@ docker run -p 8080:3000 lucientes
 # With API key protection
 docker run -p 8080:3000 -e API_KEY=secret lucientes
 
+# With JavaScript enabled
+docker run -p 8080:3000 -e API_KEY=secret -e ALLOW_JAVASCRIPT=true lucientes
+
 # Test endpoints
 curl -X POST http://localhost:8080/html-to-image -F "file=@test.html" --output out.png
 curl -X POST http://localhost:8080/html-to-pdf -F "file=@test.html" --output out.pdf
@@ -39,6 +42,13 @@ PDF generation applies a DPI correction factor (96/72) to compensate for Puppete
 - `PORT` - server port (default 3000)
 - `API_KEY` - if set, requires `x-api-key` header on all requests
 
+### Security Settings
+
+- `ALLOW_JAVASCRIPT` - set to "true" to enable JS execution in HTML (default: disabled)
+- `ALLOW_EXTERNAL_REQUESTS` - set to "true" to allow network requests from rendered pages (default: blocked)
+- `MAX_DIMENSION` - maximum width/height in pixels (default: 4096)
+- `PAGE_TIMEOUT_MS` - page rendering timeout in milliseconds (default: 30000)
+
 ## CI/CD
 
 Docker images are automatically built and pushed to DockerHub (`maximiliana/lucientes`) on pushes to master via `.github/workflows/docker-publish.yml`.

Dockerfile

@@ -1,15 +1,24 @@
-FROM node:20-slim AS builder
+FROM node:22-slim AS builder
 WORKDIR /usr/src/app
 ENV PUPPETEER_SKIP_CHROME_DOWNLOAD=true
 COPY ./web-service/package*.json ./
 RUN npm ci --only=production
 COPY ./web-service .
 
 
-FROM node:20-slim
+FROM node:22-slim
 WORKDIR /usr/src/app
-RUN apt-get update && apt-get install chromium -y --no-install-recommends
+
+RUN apt-get update && apt-get install chromium -y --no-install-recommends \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd -r pptruser && useradd -r -g pptruser -G audio,video pptruser \
+    && mkdir -p /home/pptruser/Downloads \
+    && chown -R pptruser:pptruser /home/pptruser \
+    && chown -R pptruser:pptruser /usr/src/app
+
 ENV PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium
 EXPOSE 3000
-COPY --from=builder /usr/src/app .
+COPY --from=builder --chown=pptruser:pptruser /usr/src/app .
+
+USER pptruser
 CMD ["npm", "start"]

README.md

@@ -17,7 +17,12 @@ Lucientes is developed by the Spanish startup Maximiliana to support the "Atenta
 - Simple and intuitive API.
 - Built with Node.js, Express, and Puppeteer.
 
-## 🚀 Getting Started
+## ⚠️ Security warning
+
+This service renders arbitrary HTML in a headless browser. **This is inherently risky.**
+Lucientes includes some security layers to mitigate these risks, but no defense is perfect. **Use with caution and always require API key authentication in production.**
+
+## 🚀 Getting started
 
 ### Prerequisites
 
@@ -33,14 +38,21 @@ Make sure you have Docker installed on your system.
 
 2. **Run the Docker container**:
    ```sh
-   docker run -p 8080:3000 --env PORT=3000 maximiliana/lucientes
+   docker run -p 8080:3000 maximiliana/lucientes
+   ```
+
+3. **Run with API Key protection (recommended for production)**:
+   ```sh
+   docker run -p 8080:3000 \
+     -e API_KEY=MY_SECRET_KEY \
+     maximiliana/lucientes
    ```
 
-3. **Run with API Key protection**:
+4. **Run with JavaScript enabled**:
    ```sh
    docker run -p 8080:3000 \
-     -e PORT=3000 \
      -e API_KEY=MY_SECRET_KEY \
+     -e ALLOW_JAVASCRIPT=true \
      maximiliana/lucientes
    ```
 
@@ -146,8 +158,29 @@ Parameters (multipart form fields):
 
 ### Environment Variables
 
-- `PORT`: The port on which the server will run (default 3000).
-- `API_KEY`: If set, enables authentication; each request must include `x-api-key` header.
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `PORT` | `3000` | Server port |
+| `API_KEY` | (none) | If set, requires `x-api-key` header on all requests |
+| `ALLOW_JAVASCRIPT` | `false` | Set to `true` to enable JavaScript execution in HTML |
+| `ALLOW_EXTERNAL_REQUESTS` | `false` | Set to `true` to allow network requests from rendered pages |
+| `MAX_DIMENSION` | `4096` | Maximum width/height in pixels |
+| `PAGE_TIMEOUT_MS` | `30000` | Page rendering timeout in milliseconds |
+
+### Security measures
+
+Lucientes implements several layers of security:
+
+| Protection | Description |
+|------------|-------------|
+| **Non-root user** | The container runs as an unprivileged user (`pptruser`). |
+| **JavaScript disabled** | JS execution is off by default. Enable only if needed with `ALLOW_JAVASCRIPT=true`. |
+| **Network requests blocked** | External requests (fetch, images, iframes) are blocked by default. Enable with `ALLOW_EXTERNAL_REQUESTS=true`. |
+| **Dimension limits** | Prevents memory exhaustion from extremely large images. |
+| **Timeouts** | Prevents infinite loops and resource exhaustion. |
+| **Timing-safe API key comparison** | Prevents timing attacks on API key validation. |
+
+> **Note:** Chrome sandbox is disabled (`--no-sandbox`) for compatibility with containerized environments like Cloud Run. The other security measures compensate for this.
 
 ## 🖼️ Trivia
 

web-service/index.js

@@ -3,6 +3,7 @@ import puppeteer from "puppeteer";
 import multer from "multer";
 import fs from "fs";
 import path from "path";
+import crypto from "crypto";
 import { fileURLToPath } from "url";
 import { dirname } from "path";
 
@@ -12,6 +13,10 @@ const __dirname = dirname(__filename);
 const app = express();
 const PORT = process.env.PORT || 3000;
 const API_KEY = process.env.API_KEY;
+const ALLOW_JAVASCRIPT = process.env.ALLOW_JAVASCRIPT === "true";
+const ALLOW_EXTERNAL_REQUESTS = process.env.ALLOW_EXTERNAL_REQUESTS === "true";
+const MAX_DIMENSION = parseInt(process.env.MAX_DIMENSION, 10) || 4096;
+const PAGE_TIMEOUT_MS = parseInt(process.env.PAGE_TIMEOUT_MS, 10) || 30000;
 
 const log = (severity, message, data = {}) => {
   const entry = {
@@ -26,6 +31,15 @@ const log = (severity, message, data = {}) => {
   }
 };
 
+const secureCompare = (a, b) => {
+  if (!a || !b) return false;
+  try {
+    return crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));
+  } catch {
+    return false;
+  }
+};
+
 const upload = multer({ dest: "uploads/" });
 
 app.use(express.json());
@@ -34,7 +48,7 @@ app.use(express.urlencoded({ extended: true }));
 app.use((req, res, next) => {
   if (!API_KEY) return next();
   const provided = req.header("x-api-key");
-  if (provided !== API_KEY) {
+  if (!secureCompare(provided, API_KEY)) {
     log("WARNING", "Unauthorized request (invalid or missing API Key)", {
       path: req.path,
       method: req.method,
@@ -53,6 +67,45 @@ const validFormats = ["png", "jpeg", "webp"];
 // https://github.com/puppeteer/puppeteer/issues/3357
 const PDF_DPI_CORRECTION_FACTOR = 96 / 72;
 
+const BROWSER_ARGS = [
+  "--no-sandbox",
+  "--disable-setuid-sandbox",
+  "--disable-dev-shm-usage",
+  "--disable-accelerated-2d-canvas",
+  "--disable-gpu",
+  "--disable-background-networking",
+  "--disable-default-apps",
+  "--disable-extensions",
+  "--disable-sync",
+  "--disable-translate",
+  "--hide-scrollbars",
+  "--metrics-recording-only",
+  "--mute-audio",
+  "--no-first-run",
+  "--safebrowsing-disable-auto-update",
+];
+
+const setupPageSecurity = async (page) => {
+  page.setDefaultTimeout(PAGE_TIMEOUT_MS);
+
+  if (!ALLOW_JAVASCRIPT) {
+    await page.setJavaScriptEnabled(false);
+  }
+
+  if (!ALLOW_EXTERNAL_REQUESTS) {
+    await page.setRequestInterception(true);
+    page.on("request", (request) => {
+      const url = request.url();
+      if (url.startsWith("data:") || url === "about:blank") {
+        request.continue();
+      } else {
+        log("WARNING", "Blocked external request", { url });
+        request.abort("blockedbyclient");
+      }
+    });
+  }
+};
+
 const parseBoolean = (value) => {
   if (value === undefined) return false;
   if (typeof value === "boolean") return value;
@@ -74,6 +127,12 @@ const validateRequest = (req) => {
   if (height && (isNaN(height) || parseInt(height, 10) <= 0)) {
     return { isValid: false, message: "Height must be a positive number" };
   }
+  if (width && parseInt(width, 10) > MAX_DIMENSION) {
+    return { isValid: false, message: `Width exceeds maximum of ${MAX_DIMENSION}px` };
+  }
+  if (height && parseInt(height, 10) > MAX_DIMENSION) {
+    return { isValid: false, message: `Height exceeds maximum of ${MAX_DIMENSION}px` };
+  }
   if (scaleFactor && (isNaN(scaleFactor) || parseFloat(scaleFactor) <= 0)) {
     return {
       isValid: false,
@@ -110,6 +169,12 @@ const validatePdfRequest = (req) => {
   if (height && (isNaN(height) || parseInt(height, 10) <= 0)) {
     return { isValid: false, message: "Height must be a positive number" };
   }
+  if (width && parseInt(width, 10) > MAX_DIMENSION) {
+    return { isValid: false, message: `Width exceeds maximum of ${MAX_DIMENSION}px` };
+  }
+  if (height && parseInt(height, 10) > MAX_DIMENSION) {
+    return { isValid: false, message: `Height exceeds maximum of ${MAX_DIMENSION}px` };
+  }
   return { isValid: true };
 };
 
@@ -131,10 +196,9 @@ app.post("/html-to-image", upload.single("file"), async (req, res) => {
   const transparentRequested = validation.transparentRequested;
 
   try {
-    const browser = await puppeteer.launch({
-      args: ["--no-sandbox", "--disable-setuid-sandbox"],
-    });
+    const browser = await puppeteer.launch({ args: BROWSER_ARGS });
     const page = await browser.newPage();
+    await setupPageSecurity(page);
 
     const viewportWidth = width ? parseInt(width, 10) : 1920;
     const viewportHeight = height ? parseInt(height, 10) : 1080;
@@ -147,7 +211,9 @@ app.post("/html-to-image", upload.single("file"), async (req, res) => {
     });
 
     const htmlContent = fs.readFileSync(htmlFilePath, "utf8");
-    await page.setContent(htmlContent);
+    await page.setContent(htmlContent, {
+      waitUntil: ALLOW_JAVASCRIPT ? "load" : "domcontentloaded"
+    });
 
     const screenshot = await page.screenshot({
       type: imageFormat,
@@ -157,7 +223,6 @@ app.post("/html-to-image", upload.single("file"), async (req, res) => {
     });
 
     await browser.close();
-    fs.unlinkSync(htmlFilePath);
 
     log("INFO", "Image generated successfully", {
       width: viewportWidth,
@@ -178,6 +243,8 @@ app.post("/html-to-image", upload.single("file"), async (req, res) => {
       ip: req.ip,
     });
     res.status(500).send("Internal Server Error");
+  } finally {
+    fs.unlink(htmlFilePath, () => {});
   }
 });
 
@@ -202,18 +269,19 @@ app.post("/html-to-pdf", upload.single("file"), async (req, res) => {
   const printBg = printBackground === undefined ? true : parseBoolean(printBackground);
 
   try {
-    const browser = await puppeteer.launch({
-      args: ["--no-sandbox", "--disable-setuid-sandbox"],
-    });
+    const browser = await puppeteer.launch({ args: BROWSER_ARGS });
     const page = await browser.newPage();
+    await setupPageSecurity(page);
 
     await page.setViewport({
       width: viewportWidth,
       height: viewportHeight,
     });
 
     const htmlContent = fs.readFileSync(htmlFilePath, "utf8");
-    await page.setContent(htmlContent);
+    await page.setContent(htmlContent, {
+      waitUntil: ALLOW_JAVASCRIPT ? "load" : "domcontentloaded"
+    });
 
     const pdfWidth = Math.round(viewportWidth * PDF_DPI_CORRECTION_FACTOR);
     const pdfHeight = Math.round(viewportHeight * PDF_DPI_CORRECTION_FACTOR);
@@ -226,7 +294,6 @@ app.post("/html-to-pdf", upload.single("file"), async (req, res) => {
     });
 
     await browser.close();
-    fs.unlinkSync(htmlFilePath);
 
     log("INFO", "PDF generated successfully", {
       width: viewportWidth,
@@ -246,15 +313,24 @@ app.post("/html-to-pdf", upload.single("file"), async (req, res) => {
       ip: req.ip,
     });
     res.status(500).send("Internal Server Error");
+  } finally {
+    fs.unlink(htmlFilePath, () => {});
   }
 });
 
 app.listen(PORT, "0.0.0.0", () => {
   log("INFO", "Server started", {
     url: `http://0.0.0.0:${PORT}`,
     apiKeyProtection: Boolean(API_KEY),
+    javascriptEnabled: ALLOW_JAVASCRIPT,
+    externalRequestsEnabled: ALLOW_EXTERNAL_REQUESTS,
+    maxDimension: MAX_DIMENSION,
+    pageTimeoutMs: PAGE_TIMEOUT_MS,
   });
-  if (API_KEY) {
-    log("NOTICE", "API Key protection enabled (header only)");
+  if (!ALLOW_JAVASCRIPT) {
+    log("NOTICE", "JavaScript execution is DISABLED (set ALLOW_JAVASCRIPT=true to enable)");
+  }
+  if (!ALLOW_EXTERNAL_REQUESTS) {
+    log("NOTICE", "External requests are BLOCKED (set ALLOW_EXTERNAL_REQUESTS=true to enable)");
   }
 });