fix(workers): stop edge proxies from following off-origin redirects (#1576)

* fix(workers): stop edge proxies from following off-origin redirects

The viewer worker now follows redirects only while they stay under
https://geolibre.app/demo, and the tiles worker fetches allowlisted
upstreams with the same host-bound redirect policy so neither path can
be turned into an open proxy.

* style: auto-format (ruff + oxfmt) [pre-commit.ci]

* fix(workers): address review on redirects, paths, and S3 scope

Pass through 304 responses, reject encoded-slash traversal, scope S3
redirects to known dataset prefixes, harden Protomaps probes, and expand
redirect/cookie coverage.

* fix(workers): reject alternate ports and cover tiles 304

Block non-default ports on viewer redirect allowlist and lock tiles
conditional-revalidation passthrough with an ETag regression test.

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Author: Ayush7614

tests/edge-proxy-redirect.test.ts

@@ -0,0 +1,196 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import {
+  MAX_REDIRECT_HOPS,
+  isAllowedUpstreamUrl,
+  proxyViewerRequest,
+  sanitizeViewerPath,
+} from "../workers/viewer/src/proxy";
+import {
+  TILES_MAX_REDIRECT_HOPS,
+  fetchAllowlistedUpstream,
+  isAllowedTilesUpstreamUrl,
+} from "../workers/tiles/src/allowlisted-fetch";
+
+describe("viewer proxy path sanitization", () => {
+  it("accepts normal asset paths and rejects traversal", () => {
+    assert.equal(sanitizeViewerPath("/assets/index.js"), "/assets/index.js");
+    assert.equal(sanitizeViewerPath("/"), "/");
+    assert.equal(sanitizeViewerPath("/../secret"), null);
+    assert.equal(sanitizeViewerPath("/foo/../../etc/passwd"), null);
+    assert.equal(sanitizeViewerPath("/foo%2e%2e/bar"), null);
+    assert.equal(sanitizeViewerPath("/foo%2f..%2fsecret"), null);
+    assert.equal(sanitizeViewerPath("/foo%2F..%2Fsecret"), null);
+  });
+});
+
+describe("viewer upstream allowlist", () => {
+  it("keeps fetches under https://geolibre.app/demo", () => {
+    assert.equal(isAllowedUpstreamUrl("https://geolibre.app/demo"), true);
+    assert.equal(isAllowedUpstreamUrl("https://geolibre.app/demo/"), true);
+    assert.equal(isAllowedUpstreamUrl("https://geolibre.app/demo/assets/a.js"), true);
+    assert.equal(isAllowedUpstreamUrl("https://geolibre.app/"), false);
+    assert.equal(isAllowedUpstreamUrl("https://evil.example/demo"), false);
+    assert.equal(isAllowedUpstreamUrl("http://geolibre.app/demo"), false);
+    assert.equal(isAllowedUpstreamUrl("https://geolibre.app:8443/demo/assets/a.js"), false);
+  });
+});
+
+describe("viewer redirect policy", () => {
+  it("follows an in-prefix redirect, strips cookies, and refuses cross-origin", async () => {
+    const calls: string[] = [];
+    const fetchImpl: typeof fetch = async (input) => {
+      const url = String(input);
+      calls.push(url);
+      if (url.endsWith("/demo/old")) {
+        return new Response(null, {
+          status: 302,
+          headers: { location: "https://geolibre.app/demo/new" },
+        });
+      }
+      if (url.endsWith("/demo/new")) {
+        return new Response("ok", {
+          status: 200,
+          headers: {
+            "set-cookie": "session=evil",
+            "set-cookie2": "also=evil",
+            "content-type": "text/plain",
+          },
+        });
+      }
+      return new Response("unexpected", { status: 500 });
+    };
+
+    const ok = await proxyViewerRequest(new Request("https://web.geolibre.app/old"), fetchImpl);
+    assert.equal(ok.status, 200);
+    assert.equal(await ok.text(), "ok");
+    assert.equal(ok.headers.get("set-cookie"), null);
+    assert.equal(ok.headers.get("set-cookie2"), null);
+    assert.deepEqual(calls, ["https://geolibre.app/demo/old", "https://geolibre.app/demo/new"]);
+
+    const evilFetch: typeof fetch = async () =>
+      new Response(null, {
+        status: 302,
+        headers: { location: "https://evil.example/steal" },
+      });
+    const blocked = await proxyViewerRequest(new Request("https://web.geolibre.app/"), evilFetch);
+    assert.equal(blocked.status, 502);
+  });
+
+  it("passes through 304 Not Modified instead of treating it as a broken redirect", async () => {
+    const fetchImpl: typeof fetch = async () =>
+      new Response(null, {
+        status: 304,
+        headers: { etag: '"abc"' },
+      });
+    const response = await proxyViewerRequest(
+      new Request("https://web.geolibre.app/assets/app.js", {
+        headers: { "if-none-match": '"abc"' },
+      }),
+      fetchImpl,
+    );
+    assert.equal(response.status, 304);
+    assert.equal(response.headers.get("etag"), '"abc"');
+  });
+
+  it("rejects non-GET methods and caps redirect hops", async () => {
+    const method = await proxyViewerRequest(
+      new Request("https://web.geolibre.app/", { method: "POST" }),
+    );
+    assert.equal(method.status, 405);
+
+    let hops = 0;
+    const looping: typeof fetch = async (input) => {
+      hops += 1;
+      const url = String(input);
+      return new Response(null, {
+        status: 302,
+        headers: { location: `${url}?n=${hops}` },
+      });
+    };
+    const capped = await proxyViewerRequest(new Request("https://web.geolibre.app/loop"), looping);
+    assert.equal(capped.status, 502);
+    assert.equal(hops, MAX_REDIRECT_HOPS + 1);
+  });
+});
+
+describe("tiles allowlisted fetch", () => {
+  it("refuses off-host and off-prefix S3 redirects", async () => {
+    assert.equal(isAllowedTilesUpstreamUrl("https://api.openaerialmap.org/meta"), true);
+    assert.equal(isAllowedTilesUpstreamUrl("https://evil.example/meta"), false);
+    assert.equal(
+      isAllowedTilesUpstreamUrl(
+        "https://s3-eu-west-1.amazonaws.com/whereonmars.cartodb.net/mola-color/0/0/0.png",
+      ),
+      true,
+    );
+    assert.equal(
+      isAllowedTilesUpstreamUrl("https://s3-eu-west-1.amazonaws.com/other-bucket/secret"),
+      false,
+    );
+
+    const fetchImpl: typeof fetch = async () =>
+      new Response(null, {
+        status: 302,
+        headers: { location: "https://evil.example/payload" },
+      });
+
+    await assert.rejects(
+      () => fetchAllowlistedUpstream("https://api.openaerialmap.org/meta", {}, fetchImpl),
+      /non-allowlisted/,
+    );
+  });
+
+  it("follows a same-host HTTPS redirect and caps hops", async () => {
+    const fetchImpl: typeof fetch = async (input) => {
+      const url = String(input);
+      if (url.endsWith("/meta")) {
+        return new Response(null, {
+          status: 301,
+          headers: { location: "https://api.openaerialmap.org/meta/" },
+        });
+      }
+      return new Response('{"ok":true}', {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      });
+    };
+    const response = await fetchAllowlistedUpstream(
+      "https://api.openaerialmap.org/meta",
+      {},
+      fetchImpl,
+    );
+    assert.equal(response.status, 200);
+    assert.equal(await response.text(), '{"ok":true}');
+
+    let hops = 0;
+    const looping: typeof fetch = async (input) => {
+      hops += 1;
+      const url = String(input);
+      return new Response(null, {
+        status: 302,
+        headers: { location: `${url}?n=${hops}` },
+      });
+    };
+    await assert.rejects(
+      () => fetchAllowlistedUpstream("https://api.openaerialmap.org/meta", {}, looping),
+      /Too many upstream redirects/,
+    );
+    assert.equal(hops, TILES_MAX_REDIRECT_HOPS + 1);
+  });
+
+  it("passes through 304 Not Modified with its ETag", async () => {
+    const fetchImpl: typeof fetch = async () =>
+      new Response(null, {
+        status: 304,
+        headers: { etag: '"tile-abc"' },
+      });
+    const response = await fetchAllowlistedUpstream(
+      "https://api.openaerialmap.org/meta",
+      { headers: { "if-none-match": '"tile-abc"' } },
+      fetchImpl,
+    );
+    assert.equal(response.status, 304);
+    assert.equal(response.headers.get("etag"), '"tile-abc"');
+  });
+});

workers/tiles/src/allowlisted-fetch.ts

@@ -0,0 +1,84 @@
+/**
+ * Allowlisted upstream URL prefixes the tiles worker may fetch. Named proxies
+ * (OPM mosaics, USGS WMS, OAM meta, Source Cooperative, Protomaps) are never
+ * an open proxy — but a 302 from an allowlisted URL to an arbitrary Location
+ * would reintroduce that risk if `fetch` followed redirects automatically.
+ *
+ * S3 entries are scoped to the known OPM dataset path prefixes (not the whole
+ * shared `s3*.amazonaws.com` host) so a redirect cannot jump to another bucket.
+ */
+export const TILES_ALLOWED_URL_PREFIXES = [
+  "https://s3-eu-west-1.amazonaws.com/whereonmars.cartodb.net/",
+  "https://s3.us-east-2.amazonaws.com/opmmarstiles/",
+  "https://s3.amazonaws.com/opmbuilder/",
+  "https://api.openaerialmap.org/",
+  "https://source.coop/",
+  "https://build.protomaps.com/",
+  "https://planetarymaps.usgs.gov/",
+] as const;
+
+/** @deprecated Prefer {@link TILES_ALLOWED_URL_PREFIXES}; kept for tests/docs. */
+export const TILES_ALLOWED_UPSTREAM_HOSTS = new Set(
+  TILES_ALLOWED_URL_PREFIXES.map((prefix) => new URL(prefix).hostname),
+);
+
+export const TILES_MAX_REDIRECT_HOPS = 5;
+
+/** HTTP statuses that carry a Location and should be followed manually. */
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+
+/** Cloudflare outgoing fetch options (`cf` cache hints, etc.). */
+export type TilesFetchInit = RequestInit & {
+  cf?: RequestInitCfProperties;
+};
+
+type FetchLike = (input: RequestInfo | URL, init?: TilesFetchInit) => Promise<Response>;
+
+/**
+ * Whether a resolved upstream URL is HTTPS and under an allowlisted
+ * host+path prefix (not merely an allowlisted hostname).
+ */
+export function isAllowedTilesUpstreamUrl(url: string): boolean {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:") return false;
+    const candidate = `${parsed.origin}${parsed.pathname}`;
+    return TILES_ALLOWED_URL_PREFIXES.some((prefix) => candidate.startsWith(prefix));
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Fetch an allowlisted upstream URL, following redirects only while they stay
+ * under an allowlisted HTTPS prefix. Cross-prefix Locations are refused so a
+ * compromised or misconfigured origin cannot turn the worker into an open proxy.
+ */
+export async function fetchAllowlistedUpstream(
+  url: string,
+  init: TilesFetchInit = {},
+  fetchImpl: FetchLike = fetch,
+): Promise<Response> {
+  if (!isAllowedTilesUpstreamUrl(url)) {
+    throw new Error(`Refused fetch to non-allowlisted upstream: ${url}`);
+  }
+
+  let target = url;
+  for (let hop = 0; hop <= TILES_MAX_REDIRECT_HOPS; hop++) {
+    const response = await fetchImpl(target, { ...init, redirect: "manual" });
+    // Pass through non-redirect responses, including 304 Not Modified.
+    if (!REDIRECT_STATUSES.has(response.status)) {
+      return response;
+    }
+    const location = response.headers.get("location");
+    if (!location) {
+      return response;
+    }
+    const next = new URL(location, target).toString();
+    if (!isAllowedTilesUpstreamUrl(next)) {
+      throw new Error(`Refused redirect to non-allowlisted upstream: ${next}`);
+    }
+    target = next;
+  }
+  throw new Error("Too many upstream redirects");
+}

workers/tiles/src/index.ts

@@ -35,6 +35,7 @@
 // forwards them unchanged. The reprojected WMS tiles are standard XYZ.
 
 import * as UPNG from "upng-js";
+import { fetchAllowlistedUpstream } from "./allowlisted-fetch";
 import { remapRowsToMercator, tileGeoBounds, wmsBboxFor } from "./reproject";
 
 /** Allowlisted OpenPlanetaryMap tile datasets → their upstream base URL. */
@@ -275,10 +276,19 @@ async function resolveLatestBuildDate(): Promise<string> {
     // fetches next — so a later real range read could be served this 1-byte
     // body instead of its bytes. The resolved date is memoised in `latestCache`
     // already, so no edge cache is needed here.
-    const probe = await fetch(`${PMTILES_UPSTREAM}/${ymd}.pmtiles`, {
-      headers: { range: "bytes=0-0" },
-    });
-    if (probe.status === 206) {
+    const probe = await (async () => {
+      try {
+        return await fetchAllowlistedUpstream(`${PMTILES_UPSTREAM}/${ymd}.pmtiles`, {
+          headers: { range: "bytes=0-0" },
+        });
+      } catch (err) {
+        // A single day's probe must not abort the lookback — treat redirect/
+        // allowlist failures as a miss and try the previous day.
+        console.warn(`Protomaps build probe failed for ${ymd}: ${String(err)}`);
+        return null;
+      }
+    })();
+    if (probe?.status === 206) {
       latestCache = { date: ymd, at: now };
       return ymd;
     }
@@ -375,7 +385,7 @@ async function handleSourceCoop(request: Request, pathname: string): Promise<Res
   }
   let originResponse: Response;
   try {
-    originResponse = await fetch(upstream, {
+    originResponse = await fetchAllowlistedUpstream(upstream, {
       // cacheEverything is required for Cloudflare to edge-cache a URL with no
       // static file extension (cacheTtl alone does not).
       cf: { cacheEverything: true, cacheTtl: 300 },
@@ -454,7 +464,7 @@ async function handlePmtilesRange(request: Request, name: string): Promise<Respo
     // effect on Enterprise plans (silently ignored otherwise), so we don't rely
     // on it. Without cacheEverything, Cloudflare doesn't edge-cache the 206 at
     // all; the upstream still serves range requests directly.
-    originResponse = await fetch(`${PMTILES_UPSTREAM}/${target}`, {
+    originResponse = await fetchAllowlistedUpstream(`${PMTILES_UPSTREAM}/${target}`, {
       headers: { range },
     });
   } catch {
@@ -552,7 +562,7 @@ export default {
       }
       let originResponse: Response;
       try {
-        originResponse = await fetch(upstream.toString(), {
+        originResponse = await fetchAllowlistedUpstream(upstream.toString(), {
           headers: { accept: "application/json" },
           // cacheEverything is required for Cloudflare to edge-cache a URL with
           // no static file extension (cacheTtl alone does not).
@@ -662,7 +672,7 @@ export default {
     const upstream = `${base}/${z}/${x}/${y}.png`;
     let originResponse: Response;
     try {
-      originResponse = await fetch(upstream, {
+      originResponse = await fetchAllowlistedUpstream(upstream, {
         cf: { cacheEverything: true, cacheTtl: 86400 },
       });
     } catch {
@@ -740,7 +750,9 @@ async function handleWmsTile(
 
   let origin: Response;
   try {
-    origin = await fetch(wmsUrl, { cf: { cacheEverything: true, cacheTtl: 86400 } });
+    origin = await fetchAllowlistedUpstream(wmsUrl, {
+      cf: { cacheEverything: true, cacheTtl: 86400 },
+    });
   } catch {
     return new Response("Bad Gateway", { status: 502, headers: CORS_HEADERS });
   }