@easyflow/javascript-sdk 2.1.7

package/libs/sanitizer.mjs

@@ -0,0 +1,340 @@
+import { deepClone } from './utils.mjs'
+
+/**
+ * Sanitizer class for cleaning and validating input data
+ *
+ * This class provides methods to sanitize various types of input data
+ * to prevent XSS attacks and ensure data integrity.
+ *
+ * @class Sanitizer
+ * @since 1.0.0
+ */
+export class Sanitizer {
+    /**
+     * Sanitizes HTTP headers by removing potentially dangerous headers
+     *
+     * @param {Object} [headers={}] - Headers object to sanitize
+     * @returns {Object} Sanitized headers object
+     *
+     * @example
+     * ```javascript
+     * const sanitizedHeaders = Sanitizer.sanitizeHeaders({
+     *   'Content-Type': 'application/json',
+     *   'x-forwarded-for': 'malicious-value'
+     * });
+     * // Returns: { 'Content-Type': 'application/json' }
+     * ```
+     */
+    static sanitizeHeaders(headers = {}) {
+        const sanitized = {}
+        for (const [key, value] of Object.entries(headers)) {
+            const dangerousHeaders = [
+                'x-forwarded-for',
+                'x-real-ip',
+                'x-forwarded-host',
+                'x-forwarded-proto',
+                'x-forwarded-port',
+                'x-forwarded-server',
+                'x-forwarded-uri',
+                'x-forwarded-method',
+                'x-forwarded-path',
+                'x-forwarded-query',
+                'x-forwarded-scheme',
+                'x-forwarded-ssl',
+                'x-forwarded-proto-version',
+            ]
+            if (!dangerousHeaders.includes(key.toLowerCase())) {
+                sanitized[key] = value
+            }
+        }
+        return sanitized
+    }
+
+    /**
+     * Sanitizes string input by removing potentially dangerous characters
+     *
+     * @param {*} input - Input to sanitize (only strings are processed)
+     * @returns {*} Sanitized input (returns original value if not a string)
+     *
+     * @example
+     * ```javascript
+     * const sanitized = Sanitizer.sanitizeInput('<script>alert("xss")</script>');
+     * // Returns: 'scriptalert("xss")/script'
+     * ```
+     */
+    static sanitizeInput(input) {
+        if (typeof input !== 'string' || !input) return input
+        return input
+            .replace(/[<>&]/g, '') // Remove <, >, & mas mantém aspas
+            .replace(/javascript:/gi, '')
+            .replace(/data:/gi, '')
+            .replace(/vbscript:/gi, '')
+            .trim()
+    }
+
+    /**
+     * Sanitizes credit card data by cleaning all card-related fields
+     *
+     * @param {Object} creditCard - Credit card object to sanitize
+     * @param {string} creditCard.cardNumber - Card number
+     * @param {string} creditCard.cvv - Security code
+     * @param {string} creditCard.month - Expiration month
+     * @param {string} creditCard.year - Expiration year
+     * @param {string} creditCard.holderName - Cardholder name
+     * @returns {Object} Sanitized credit card object
+     *
+     * @example
+     * ```javascript
+     * const sanitizedCard = Sanitizer.sanitizeCreditCard({
+     *   cardNumber: '4111 1111 1111 1111',
+     *   cvv: '123',
+     *   month: '12',
+     *   year: '2025',
+     *   holderName: 'John Doe'
+     * });
+     * ```
+     */
+    static sanitizeCreditCard(creditCard) {
+        return {
+            cardNumber: this.sanitizeInput(creditCard.cardNumber),
+            cvv: this.sanitizeInput(creditCard.cvv),
+            month: this.sanitizeInput(creditCard.month),
+            year: this.sanitizeInput(creditCard.year),
+            holderName: this.sanitizeInput(creditCard.holderName),
+        }
+    }
+
+    /**
+     * Recursively sanitizes all fields of an object using sanitizeInput
+     *
+     * This method traverses the entire object structure and sanitizes
+     * all string values found in any nested objects, arrays, or primitive values.
+     * It preserves the original object structure while ensuring all string data
+     * is properly sanitized.
+     *
+     * @param {*} obj - Object, array, or primitive value to sanitize
+     * @returns {*} Deep cloned and sanitized object with the same structure
+     *
+     * @example
+     * ```javascript
+     * const userData = {
+     *   name: '<script>alert("xss")</script>',
+     *   email: 'user@example.com',
+     *   profile: {
+     *     bio: 'User bio with <strong>HTML</strong>',
+     *     tags: ['tag1', '<script>malicious</script>']
+     *   },
+     *   settings: {
+     *     theme: 'dark',
+     *     notifications: true
+     *   }
+     * };
+     *
+     * const sanitized = Sanitizer.sanitizeObjectFields(userData);
+     * // Result: All string fields are sanitized, structure preserved
+     * ```
+     */
+    static sanitizeObjectFields(obj) {
+        return this._sanitizeObjectFieldsRecursive(obj, new WeakSet())
+    }
+
+    /**
+     * Internal recursive method for sanitizing object fields
+     *
+     * @private
+     * @param {*} obj - Object to sanitize
+     * @param {WeakSet} processed - Set of already processed objects to prevent circular references
+     * @returns {*} Sanitized object
+     */
+    static _sanitizeObjectFieldsRecursive(obj, processed) {
+        // Handle null and undefined
+        if (obj === null || obj === undefined) {
+            return obj
+        }
+
+        // Handle primitive types (only sanitize strings)
+        if (typeof obj !== 'object') {
+            return this.sanitizeInput(obj)
+        }
+
+        // Handle arrays
+        if (Array.isArray(obj)) {
+            return obj.map((item) =>
+                this._sanitizeObjectFieldsRecursive(item, processed)
+            )
+        }
+
+        // Check for circular references
+        if (processed.has(obj)) {
+            return obj // Return original object to prevent infinite recursion
+        }
+
+        // Mark this object as processed
+        processed.add(obj)
+
+        // Handle objects
+        const sanitized = {}
+        for (const [key, value] of Object.entries(obj)) {
+            // Recursively sanitize nested values
+            sanitized[key] = this._sanitizeObjectFieldsRecursive(
+                value,
+                processed
+            )
+        }
+
+        return sanitized
+    }
+}
+
+/**
+ * Sanitizes complete order data including buyer information, payments, and items
+ *
+ * @param {Object} order - Order object to sanitize
+ * @param {Object} [order.buyer] - Buyer information
+ * @param {Object} [order.payments] - Payment methods array
+ * @param {Object} [order.items] - Order items array
+ * @param {Object} [order.metadata] - Order metadata array
+ * @returns {Object} Deep cloned and sanitized order object
+ *
+ * @example
+ * ```javascript
+ * const sanitizedOrder = sanitizeOrderData({
+ *   buyer: {
+ *     name: '<script>alert("xss")</script>',
+ *     email: 'user@example.com'
+ *   },
+ *   payments: [{
+ *     method: 'credit-card',
+ *     creditCard: { cardNumber: '4111 1111 1111 1111' }
+ *   }]
+ * });
+ * ```
+ */
+function sanitizeOrderData(order) {
+    const sanitized = deepClone(order)
+    if (sanitized.cartId)
+        sanitized.cartId = Sanitizer.sanitizeInput(sanitized.cartId)
+    if (sanitized.buyer) {
+        sanitized.buyer.customerId = Sanitizer.sanitizeInput(
+            sanitized.buyer.customerId
+        )
+        sanitized.buyer.name = Sanitizer.sanitizeInput(sanitized.buyer.name)
+        sanitized.buyer.email = Sanitizer.sanitizeInput(sanitized.buyer.email)
+        if (sanitized.buyer.document) {
+            sanitized.buyer.document.number = Sanitizer.sanitizeInput(
+                sanitized.buyer.document.number
+            )
+            sanitized.buyer.document.type = Sanitizer.sanitizeInput(
+                sanitized.buyer.document.type
+            )
+        }
+        if (sanitized.buyer.phone) {
+            sanitized.buyer.phone.number = Sanitizer.sanitizeInput(
+                sanitized.buyer.phone.number
+            )
+            sanitized.buyer.phone.areaCode = Sanitizer.sanitizeInput(
+                sanitized.buyer.phone.areaCode
+            )
+        }
+        if (sanitized.buyer.address) {
+            sanitized.buyer.address.zipCode = Sanitizer.sanitizeInput(
+                sanitized.buyer.address.zipCode
+            )
+            sanitized.buyer.address.street = Sanitizer.sanitizeInput(
+                sanitized.buyer.address.street
+            )
+            sanitized.buyer.address.complement = Sanitizer.sanitizeInput(
+                sanitized.buyer.address.complement
+            )
+            sanitized.buyer.address.neighborhood = Sanitizer.sanitizeInput(
+                sanitized.buyer.address.neighborhood
+            )
+            sanitized.buyer.address.city = Sanitizer.sanitizeInput(
+                sanitized.buyer.address.city
+            )
+            sanitized.buyer.address.state = Sanitizer.sanitizeInput(
+                sanitized.buyer.address.state
+            )
+            sanitized.buyer.address.number = Sanitizer.sanitizeInput(
+                sanitized.buyer.address.number
+            )
+        }
+        if (sanitized.buyer.deliveryAddress) {
+            sanitized.buyer.deliveryAddress.zipCode = Sanitizer.sanitizeInput(
+                sanitized.buyer.deliveryAddress.zipCode
+            )
+            sanitized.buyer.deliveryAddress.street = Sanitizer.sanitizeInput(
+                sanitized.buyer.deliveryAddress.street
+            )
+            sanitized.buyer.deliveryAddress.complement =
+                Sanitizer.sanitizeInput(
+                    sanitized.buyer.deliveryAddress.complement
+                )
+            sanitized.buyer.deliveryAddress.neighborhood =
+                Sanitizer.sanitizeInput(
+                    sanitized.buyer.deliveryAddress.neighborhood
+                )
+            sanitized.buyer.deliveryAddress.city = Sanitizer.sanitizeInput(
+                sanitized.buyer.deliveryAddress.city
+            )
+            sanitized.buyer.deliveryAddress.state = Sanitizer.sanitizeInput(
+                sanitized.buyer.deliveryAddress.state
+            )
+            sanitized.buyer.deliveryAddress.number = Sanitizer.sanitizeInput(
+                sanitized.buyer.deliveryAddress.number
+            )
+        }
+    }
+    if (sanitized.payments && Array.isArray(sanitized.payments)) {
+        sanitized.payments = sanitized.payments.map((payment) => {
+            const sanitizedPayment = { ...payment }
+            if (sanitizedPayment.creditCard) {
+                sanitizedPayment.creditCard = {
+                    cardId: Sanitizer.sanitizeInput(
+                        sanitizedPayment.creditCard?.cardId
+                    ),
+                    cardNumber: Sanitizer.sanitizeInput(
+                        sanitizedPayment.creditCard.cardNumber
+                    ),
+                    cvv: Sanitizer.sanitizeInput(
+                        sanitizedPayment.creditCard.cvv
+                    ),
+                    month: Sanitizer.sanitizeInput(
+                        sanitizedPayment.creditCard.month
+                    ),
+                    year: Sanitizer.sanitizeInput(
+                        sanitizedPayment.creditCard.year
+                    ),
+                    holderName: Sanitizer.sanitizeInput(
+                        sanitizedPayment.creditCard.holderName
+                    ),
+                }
+            }
+            return sanitizedPayment
+        })
+    }
+    if (sanitized.items) {
+        sanitized.items = sanitized.items.map((item) => {
+            return {
+                externalReferenceId: Sanitizer.sanitizeInput(
+                    item.externalReferenceId
+                ),
+                description: Sanitizer.sanitizeInput(item.description),
+                name: Sanitizer.sanitizeInput(item.name),
+                quantity: item.quantity,
+                priceInCents: item.priceInCents,
+            }
+        })
+    }
+    if (sanitized.metadata && Array.isArray(sanitized.metadata)) {
+        sanitized.metadata = sanitized.metadata.map((metadata) => {
+            return {
+                key: Sanitizer.sanitizeInput(metadata.key),
+                value: Sanitizer.sanitizeInput(metadata.value),
+            }
+        })
+    }
+    return sanitized
+}
+
+export { sanitizeOrderData }