openhands
3c8abb6fbf
CI / check (push) Successful in 39s
CI / tests-imaging-browsers (push) Successful in 2m9s
CI / tests-integration (push) Successful in 2m47s
CI / tests-unit (push) Failing after 3m22s
CI / tests-ui (push) Failing after 4m14s
CI / preflight (push) Skipped
CI / deploy (push) Skipped
Bundle the remaining imaging hardening and the host/CI fixes from the
"Doe alles" pass into one release.
Furniture:
- Resolve the local bundle extension from FURNI_BUNDLE_EXT (".hab" default,
".nitro" for a stock Nitro client). The configured extension is written by
imports/repairs and preferred on lookup; the other stays a legacy fallback.
Imaging:
- Avatar proxy sends s-maxage=86400 + stale-while-revalidate (300/3600 for the
fallback path) so the edge can hold a render a day.
- Cloudflare cache rule now covers /api/imaging/ (verified MISS->HIT live).
- Document that bare /imaging is shadowed by the edge proxy to the renderer.
Ops/CI:
- docker-update.sh skips a CI-managed host (exit 0) instead of failing cron.
- ci-deploy.sh runs the cross-browser imaging gate (chromium+firefox+webkit)
against the candidate before cutover; DEPLOY_SKIP_CROSS_BROWSER=1 as escape.
- scripts/imager-health-alert.sh alerts (Discord) on imager up/down transitions;
runs from cron every 5 minutes.
Tests:
- Furniture bundle-ext resolver + FURNI_BUNDLE_EXT wiring.
- Imaging performance budget (bytes + warm latency).
- classifyDdos: /api/imaging/* stays in the api bucket.
63 lines
1.8 KiB
TypeScript
63 lines
1.8 KiB
TypeScript
export type DdosCategory = "pages" | "api" | "auth";
|
|
|
|
/**
|
|
* Bucket a request path for rate limiting. Everything under `/api/` that is not
|
|
* an auth route counts as `api` — including `/api/imaging/*` (avatars, badges).
|
|
* That is intentional: imaging is a deliberate high-volume, cacheable surface,
|
|
* so it gets the wider api budget rather than the page budget. The bare
|
|
* `/imaging` renderer path never reaches this gate (it is excluded by the proxy
|
|
* matcher and, in production, fronted by the edge proxy directly).
|
|
*/
|
|
export function classifyDdos(pathname: string): DdosCategory {
|
|
if (
|
|
pathname === "/api/auth" ||
|
|
pathname.startsWith("/api/auth/") ||
|
|
pathname === "/login" ||
|
|
pathname.startsWith("/login/") ||
|
|
pathname === "/register" ||
|
|
pathname.startsWith("/register/") ||
|
|
pathname === "/admin" ||
|
|
pathname.startsWith("/admin/")
|
|
) {
|
|
return "auth";
|
|
}
|
|
if (pathname.startsWith("/api/")) return "api";
|
|
return "pages";
|
|
}
|
|
|
|
const HOSTILE_PATH_SEGMENTS = new Set([
|
|
"wp-admin",
|
|
"wp-login.php",
|
|
"wp-includes",
|
|
"phpmyadmin",
|
|
"pma",
|
|
"adminer",
|
|
"server-status",
|
|
".env",
|
|
".git",
|
|
]);
|
|
|
|
const HOSTILE_PATH_EXTENSIONS = [".php", ".asp", ".aspx", ".jsp", ".cgi"];
|
|
|
|
/**
|
|
* Cheap scanner/exploit triage. These paths are never routes in this app, so a
|
|
* hit is almost certainly an automated attack sweep; dropping it here costs no
|
|
* Redis work and never affects genuine traffic.
|
|
*/
|
|
export function isSuspiciousPath(pathname: string): boolean {
|
|
const lower = pathname.toLowerCase();
|
|
for (const segment of lower.split("/")) {
|
|
if (HOSTILE_PATH_SEGMENTS.has(segment)) return true;
|
|
}
|
|
for (const extension of HOSTILE_PATH_EXTENSIONS) {
|
|
if (
|
|
lower.endsWith(extension) ||
|
|
lower.includes(`${extension}/`) ||
|
|
lower.includes(`${extension}?`)
|
|
) {
|
|
return true;
|
|
}
|
|
}
|
|
return false;
|
|
}
|