@chidchanun/bcp 0.1.0

package/packages/server/src/security.ts

@@ -0,0 +1,451 @@
+import type * as http from "node:http";
+
+export const DEFAULT_BODY_LIMIT =
+    1024 * 1024;
+
+export class PayloadTooLargeError
+    extends Error {
+    readonly limit: number;
+
+    constructor(
+        limit: number
+    ) {
+        super(
+            `Request body exceeded the configured limit of ${limit} bytes.`
+        );
+        this.name =
+            "PayloadTooLargeError";
+        this.limit =
+            limit;
+    }
+}
+
+export interface SecurityHeaderValues {
+    poweredByHeader: boolean;
+    contentSecurityPolicy: string | null;
+    frameOptions: "DENY" | "SAMEORIGIN" | null;
+    referrerPolicy: string;
+    permissionsPolicy: string | null;
+}
+
+export function getSecurityHeaderValues(
+    environment: NodeJS.ProcessEnv = process.env
+): SecurityHeaderValues {
+    return {
+        poweredByHeader:
+            readBoolean(
+                environment.BCP_POWERED_BY_HEADER,
+                false
+            ),
+        contentSecurityPolicy:
+            readOptionalHeader(
+                environment.BCP_SECURITY_CSP
+            ),
+        frameOptions:
+            readFrameOptions(
+                environment.BCP_SECURITY_FRAME_OPTIONS
+            ),
+        referrerPolicy:
+            readRequiredHeader(
+                environment.BCP_SECURITY_REFERRER_POLICY,
+                "strict-origin-when-cross-origin"
+            ),
+        permissionsPolicy:
+            readOptionalHeader(
+                environment.BCP_SECURITY_PERMISSIONS_POLICY,
+                "camera=(), microphone=(), geolocation=()"
+            ),
+    };
+}
+
+export function applySecurityHeaders(
+    res: http.ServerResponse,
+    environment: NodeJS.ProcessEnv = process.env
+): void {
+    const values =
+        getSecurityHeaderValues(
+            environment
+        );
+
+    setIfMissing(
+        res,
+        "X-Content-Type-Options",
+        "nosniff"
+    );
+    setIfMissing(
+        res,
+        "Referrer-Policy",
+        values.referrerPolicy
+    );
+
+    if (
+        values.frameOptions
+    ) {
+        setIfMissing(
+            res,
+            "X-Frame-Options",
+            values.frameOptions
+        );
+    }
+
+    if (
+        values.permissionsPolicy
+    ) {
+        setIfMissing(
+            res,
+            "Permissions-Policy",
+            values.permissionsPolicy
+        );
+    }
+
+    if (
+        values.contentSecurityPolicy
+    ) {
+        setIfMissing(
+            res,
+            "Content-Security-Policy",
+            values.contentSecurityPolicy
+        );
+    }
+
+    if (
+        values.poweredByHeader
+    ) {
+        setIfMissing(
+            res,
+            "X-Powered-By",
+            "BCP Framework"
+        );
+    } else if (
+        res.hasHeader(
+            "X-Powered-By"
+        )
+    ) {
+        res.removeHeader(
+            "X-Powered-By"
+        );
+    }
+}
+
+export function getConfiguredBodyLimit(
+    environment: NodeJS.ProcessEnv = process.env
+): number {
+    const value =
+        environment.BCP_BODY_LIMIT;
+
+    if (
+        value === undefined ||
+        value.trim() === ""
+    ) {
+        return DEFAULT_BODY_LIMIT;
+    }
+
+    const parsed =
+        Number(
+            value
+        );
+
+    if (
+        !Number.isInteger(parsed) ||
+        parsed < 1
+    ) {
+        throw new Error(
+            "BCP Framework: BCP_BODY_LIMIT must be a positive integer number of bytes."
+        );
+    }
+
+    return parsed;
+}
+
+export async function readRequestBodyWithLimit(
+    req: http.IncomingMessage,
+    limit = getConfiguredBodyLimit()
+): Promise<Buffer> {
+    const contentLength =
+        readContentLength(
+            req.headers[
+                "content-length"
+            ]
+        );
+
+    if (
+        contentLength !== null &&
+        contentLength > limit
+    ) {
+        req.resume();
+        throw new PayloadTooLargeError(
+            limit
+        );
+    }
+
+    const chunks:
+        Buffer[] = [];
+    let total = 0;
+
+    for await (
+        const chunk
+        of req
+    ) {
+        const buffer =
+            Buffer.isBuffer(
+                chunk
+            )
+                ? chunk
+                : Buffer.from(
+                    chunk
+                );
+
+        total +=
+            buffer.length;
+
+        if (
+            total > limit
+        ) {
+            req.resume();
+            throw new PayloadTooLargeError(
+                limit
+            );
+        }
+
+        chunks.push(
+            buffer
+        );
+    }
+
+    return Buffer.concat(
+        chunks,
+        total
+    );
+}
+
+export function isPayloadTooLargeError(
+    error: unknown
+): error is PayloadTooLargeError {
+    return (
+        error instanceof
+            PayloadTooLargeError ||
+        (
+            error instanceof Error &&
+            error.name ===
+                "PayloadTooLargeError"
+        )
+    );
+}
+
+export function assertSafeMiddlewareTarget(
+    target: URL,
+    originalUrl: URL,
+    kind: "redirect" | "rewrite"
+): void {
+    if (
+        target.protocol !== "http:" &&
+        target.protocol !== "https:"
+    ) {
+        throw new Error(
+            `BCP Framework: middleware ${kind} only supports http: and https: URLs.`
+        );
+    }
+
+    if (
+        target.username ||
+        target.password
+    ) {
+        throw new Error(
+            `BCP Framework: middleware ${kind} URLs must not contain credentials.`
+        );
+    }
+
+    if (
+        kind === "rewrite" &&
+        target.origin !==
+            originalUrl.origin
+    ) {
+        throw new Error(
+            "BCP Framework: middleware rewrites must stay on the same origin."
+        );
+    }
+}
+
+function readContentLength(
+    value:
+        | string
+        | string[]
+        | undefined
+): number | null {
+    const raw =
+        Array.isArray(
+            value
+        )
+            ? value[0]
+            : value;
+
+    if (!raw) {
+        return null;
+    }
+
+    const parsed =
+        Number(
+            raw
+        );
+
+    if (
+        !Number.isInteger(parsed) ||
+        parsed < 0
+    ) {
+        return null;
+    }
+
+    return parsed;
+}
+
+function readBoolean(
+    value: string | undefined,
+    fallback: boolean
+): boolean {
+    if (
+        value === undefined ||
+        value.trim() === ""
+    ) {
+        return fallback;
+    }
+
+    const normalized =
+        value
+            .trim()
+            .toLowerCase();
+
+    if (
+        normalized === "1" ||
+        normalized === "true" ||
+        normalized === "yes" ||
+        normalized === "on"
+    ) {
+        return true;
+    }
+
+    if (
+        normalized === "0" ||
+        normalized === "false" ||
+        normalized === "no" ||
+        normalized === "off"
+    ) {
+        return false;
+    }
+
+    return fallback;
+}
+
+function readFrameOptions(
+    value: string | undefined
+): "DENY" | "SAMEORIGIN" | null {
+    if (
+        value === undefined ||
+        value.trim() === ""
+    ) {
+        return "SAMEORIGIN";
+    }
+
+    const normalized =
+        value
+            .trim()
+            .toUpperCase();
+
+    if (
+        normalized === "0" ||
+        normalized === "FALSE" ||
+        normalized === "OFF"
+    ) {
+        return null;
+    }
+
+    if (
+        normalized === "DENY" ||
+        normalized === "SAMEORIGIN"
+    ) {
+        return normalized;
+    }
+
+    return "SAMEORIGIN";
+}
+
+function readRequiredHeader(
+    value: string | undefined,
+    fallback: string
+): string {
+    const result =
+        value?.trim() ||
+        fallback;
+
+    assertHeaderValue(
+        result
+    );
+
+    return result;
+}
+
+function readOptionalHeader(
+    value: string | undefined,
+    fallback: string | null = null
+): string | null {
+    if (
+        value !== undefined
+    ) {
+        const normalized =
+            value.trim();
+
+        if (
+            normalized === "" ||
+            normalized === "0" ||
+            normalized.toLowerCase() ===
+                "false" ||
+            normalized.toLowerCase() ===
+                "off"
+        ) {
+            return null;
+        }
+
+        assertHeaderValue(
+            normalized
+        );
+        return normalized;
+    }
+
+    if (fallback) {
+        assertHeaderValue(
+            fallback
+        );
+    }
+
+    return fallback;
+}
+
+function assertHeaderValue(
+    value: string
+): void {
+    if (
+        value.includes("\r") ||
+        value.includes("\n") ||
+        value.includes("\0")
+    ) {
+        throw new Error(
+            "BCP Framework: security header values must not contain control characters."
+        );
+    }
+}
+
+function setIfMissing(
+    res: http.ServerResponse,
+    name: string,
+    value: string
+): void {
+    if (
+        !res.hasHeader(
+            name
+        )
+    ) {
+        res.setHeader(
+            name,
+            value
+        );
+    }
+}