From ac8cc6db819ec3ef68a8340c21d9240fb92eab7d Mon Sep 17 00:00:00 2001 From: posimai Date: Sun, 5 Apr 2026 03:01:06 +0900 Subject: [PATCH] fix: security hardening round 2 - CORS: origin=null now rejected (was: allowed as same-origin) - CORS: regex tightened to [\w-]+ to prevent subdomain bypass - CORS: add *.posimai.soar-enrich.com and posimai.soar-enrich.com explicitly - Stripe webhook: fix regex capture groups + add uppercase hex support Co-Authored-By: Claude Sonnet 4.6 --- server.js | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/server.js b/server.js index 63b680ee..67e062cf 100644 --- a/server.js +++ b/server.js @@ -116,9 +116,11 @@ const extraOrigins = (process.env.ALLOWED_ORIGINS || '') .split(',').map(o => o.trim()).filter(Boolean); function isAllowedOrigin(origin) { - if (!origin) return true; // 同一オリジン + if (!origin) return false; // origin なしは拒否（CSRF 対策） if (process.env.NODE_ENV !== 'production' && /^http:\/\/localhost(:\d+)?$/.test(origin)) return true; // localhost 開発のみ - if (/^https:\/\/posimai-[^.]+\.vercel\.app$/.test(origin)) return true; // 全 Posimai アプリ + if (/^https:\/\/posimai-[\w-]+\.vercel\.app$/.test(origin)) return true; // 全 Posimai アプリ（英数字・ハイフンのみ） + if (/^https:\/\/[\w-]+\.posimai\.soar-enrich\.com$/.test(origin)) return true; // 独自ドメイン配下 + if (origin === 'https://posimai.soar-enrich.com') return true; // Dashboard if (extraOrigins.includes(origin)) return true; // 追加許可 return false; } @@ -2726,8 +2728,9 @@ async function handleStripeWebhook(req, res) { try { const crypto = require('crypto'); const rawBody = req.body; // Buffer - const [, tsStr, , v1Sig] = sig.match(/t=(\d+),.*v1=([a-f0-9]+)/) || []; - if (!tsStr || !v1Sig) throw new Error('Invalid signature format'); + const match = sig.match(/t=(\d+).*?,.*?v1=([a-fA-F0-9]+)/); + if (!match || match.length < 3) throw new Error('Invalid signature format'); + const [, tsStr, v1Sig] = match; const tolerance = 300; // 5分 if (Math.abs(Date.now() / 1000 - parseInt(tsStr)) > tolerance) { throw new Error('Timestamp too old');