@easyflow/javascript-sdk 2.1.8 → 2.1.9

package/libs/sanitizer.mjs

@@ -1,340 +0,0 @@
-import { deepClone } from './utils.mjs'
-
-/**
- * Sanitizer class for cleaning and validating input data
- *
- * This class provides methods to sanitize various types of input data
- * to prevent XSS attacks and ensure data integrity.
- *
- * @class Sanitizer
- * @since 1.0.0
- */
-export class Sanitizer {
-    /**
-     * Sanitizes HTTP headers by removing potentially dangerous headers
-     *
-     * @param {Object} [headers={}] - Headers object to sanitize
-     * @returns {Object} Sanitized headers object
-     *
-     * @example
-     * ```javascript
-     * const sanitizedHeaders = Sanitizer.sanitizeHeaders({
-     *   'Content-Type': 'application/json',
-     *   'x-forwarded-for': 'malicious-value'
-     * });
-     * // Returns: { 'Content-Type': 'application/json' }
-     * ```
-     */
-    static sanitizeHeaders(headers = {}) {
-        const sanitized = {}
-        for (const [key, value] of Object.entries(headers)) {
-            const dangerousHeaders = [
-                'x-forwarded-for',
-                'x-real-ip',
-                'x-forwarded-host',
-                'x-forwarded-proto',
-                'x-forwarded-port',
-                'x-forwarded-server',
-                'x-forwarded-uri',
-                'x-forwarded-method',
-                'x-forwarded-path',
-                'x-forwarded-query',
-                'x-forwarded-scheme',
-                'x-forwarded-ssl',
-                'x-forwarded-proto-version',
-            ]
-            if (!dangerousHeaders.includes(key.toLowerCase())) {
-                sanitized[key] = value
-            }
-        }
-        return sanitized
-    }
-
-    /**
-     * Sanitizes string input by removing potentially dangerous characters
-     *
-     * @param {*} input - Input to sanitize (only strings are processed)
-     * @returns {*} Sanitized input (returns original value if not a string)
-     *
-     * @example
-     * ```javascript
-     * const sanitized = Sanitizer.sanitizeInput('<script>alert("xss")</script>');
-     * // Returns: 'scriptalert("xss")/script'
-     * ```
-     */
-    static sanitizeInput(input) {
-        if (typeof input !== 'string' || !input) return input
-        return input
-            .replace(/[<>&]/g, '') // Remove <, >, & mas mantém aspas
-            .replace(/javascript:/gi, '')
-            .replace(/data:/gi, '')
-            .replace(/vbscript:/gi, '')
-            .trim()
-    }
-
-    /**
-     * Sanitizes credit card data by cleaning all card-related fields
-     *
-     * @param {Object} creditCard - Credit card object to sanitize
-     * @param {string} creditCard.cardNumber - Card number
-     * @param {string} creditCard.cvv - Security code
-     * @param {string} creditCard.month - Expiration month
-     * @param {string} creditCard.year - Expiration year
-     * @param {string} creditCard.holderName - Cardholder name
-     * @returns {Object} Sanitized credit card object
-     *
-     * @example
-     * ```javascript
-     * const sanitizedCard = Sanitizer.sanitizeCreditCard({
-     *   cardNumber: '4111 1111 1111 1111',
-     *   cvv: '123',
-     *   month: '12',
-     *   year: '2025',
-     *   holderName: 'John Doe'
-     * });
-     * ```
-     */
-    static sanitizeCreditCard(creditCard) {
-        return {
-            cardNumber: this.sanitizeInput(creditCard.cardNumber),
-            cvv: this.sanitizeInput(creditCard.cvv),
-            month: this.sanitizeInput(creditCard.month),
-            year: this.sanitizeInput(creditCard.year),
-            holderName: this.sanitizeInput(creditCard.holderName),
-        }
-    }
-
-    /**
-     * Recursively sanitizes all fields of an object using sanitizeInput
-     *
-     * This method traverses the entire object structure and sanitizes
-     * all string values found in any nested objects, arrays, or primitive values.
-     * It preserves the original object structure while ensuring all string data
-     * is properly sanitized.
-     *
-     * @param {*} obj - Object, array, or primitive value to sanitize
-     * @returns {*} Deep cloned and sanitized object with the same structure
-     *
-     * @example
-     * ```javascript
-     * const userData = {
-     *   name: '<script>alert("xss")</script>',
-     *   email: 'user@example.com',
-     *   profile: {
-     *     bio: 'User bio with <strong>HTML</strong>',
-     *     tags: ['tag1', '<script>malicious</script>']
-     *   },
-     *   settings: {
-     *     theme: 'dark',
-     *     notifications: true
-     *   }
-     * };
-     *
-     * const sanitized = Sanitizer.sanitizeObjectFields(userData);
-     * // Result: All string fields are sanitized, structure preserved
-     * ```
-     */
-    static sanitizeObjectFields(obj) {
-        return this._sanitizeObjectFieldsRecursive(obj, new WeakSet())
-    }
-
-    /**
-     * Internal recursive method for sanitizing object fields
-     *
-     * @private
-     * @param {*} obj - Object to sanitize
-     * @param {WeakSet} processed - Set of already processed objects to prevent circular references
-     * @returns {*} Sanitized object
-     */
-    static _sanitizeObjectFieldsRecursive(obj, processed) {
-        // Handle null and undefined
-        if (obj === null || obj === undefined) {
-            return obj
-        }
-
-        // Handle primitive types (only sanitize strings)
-        if (typeof obj !== 'object') {
-            return this.sanitizeInput(obj)
-        }
-
-        // Handle arrays
-        if (Array.isArray(obj)) {
-            return obj.map((item) =>
-                this._sanitizeObjectFieldsRecursive(item, processed)
-            )
-        }
-
-        // Check for circular references
-        if (processed.has(obj)) {
-            return obj // Return original object to prevent infinite recursion
-        }
-
-        // Mark this object as processed
-        processed.add(obj)
-
-        // Handle objects
-        const sanitized = {}
-        for (const [key, value] of Object.entries(obj)) {
-            // Recursively sanitize nested values
-            sanitized[key] = this._sanitizeObjectFieldsRecursive(
-                value,
-                processed
-            )
-        }
-
-        return sanitized
-    }
-}
-
-/**
- * Sanitizes complete order data including buyer information, payments, and items
- *
- * @param {Object} order - Order object to sanitize
- * @param {Object} [order.buyer] - Buyer information
- * @param {Object} [order.payments] - Payment methods array
- * @param {Object} [order.items] - Order items array
- * @param {Object} [order.metadata] - Order metadata array
- * @returns {Object} Deep cloned and sanitized order object
- *
- * @example
- * ```javascript
- * const sanitizedOrder = sanitizeOrderData({
- *   buyer: {
- *     name: '<script>alert("xss")</script>',
- *     email: 'user@example.com'
- *   },
- *   payments: [{
- *     method: 'credit-card',
- *     creditCard: { cardNumber: '4111 1111 1111 1111' }
- *   }]
- * });
- * ```
- */
-function sanitizeOrderData(order) {
-    const sanitized = deepClone(order)
-    if (sanitized.cartId)
-        sanitized.cartId = Sanitizer.sanitizeInput(sanitized.cartId)
-    if (sanitized.buyer) {
-        sanitized.buyer.customerId = Sanitizer.sanitizeInput(
-            sanitized.buyer.customerId
-        )
-        sanitized.buyer.name = Sanitizer.sanitizeInput(sanitized.buyer.name)
-        sanitized.buyer.email = Sanitizer.sanitizeInput(sanitized.buyer.email)
-        if (sanitized.buyer.document) {
-            sanitized.buyer.document.number = Sanitizer.sanitizeInput(
-                sanitized.buyer.document.number
-            )
-            sanitized.buyer.document.type = Sanitizer.sanitizeInput(
-                sanitized.buyer.document.type
-            )
-        }
-        if (sanitized.buyer.phone) {
-            sanitized.buyer.phone.number = Sanitizer.sanitizeInput(
-                sanitized.buyer.phone.number
-            )
-            sanitized.buyer.phone.areaCode = Sanitizer.sanitizeInput(
-                sanitized.buyer.phone.areaCode
-            )
-        }
-        if (sanitized.buyer.address) {
-            sanitized.buyer.address.zipCode = Sanitizer.sanitizeInput(
-                sanitized.buyer.address.zipCode
-            )
-            sanitized.buyer.address.street = Sanitizer.sanitizeInput(
-                sanitized.buyer.address.street
-            )
-            sanitized.buyer.address.complement = Sanitizer.sanitizeInput(
-                sanitized.buyer.address.complement
-            )
-            sanitized.buyer.address.neighborhood = Sanitizer.sanitizeInput(
-                sanitized.buyer.address.neighborhood
-            )
-            sanitized.buyer.address.city = Sanitizer.sanitizeInput(
-                sanitized.buyer.address.city
-            )
-            sanitized.buyer.address.state = Sanitizer.sanitizeInput(
-                sanitized.buyer.address.state
-            )
-            sanitized.buyer.address.number = Sanitizer.sanitizeInput(
-                sanitized.buyer.address.number
-            )
-        }
-        if (sanitized.buyer.deliveryAddress) {
-            sanitized.buyer.deliveryAddress.zipCode = Sanitizer.sanitizeInput(
-                sanitized.buyer.deliveryAddress.zipCode
-            )
-            sanitized.buyer.deliveryAddress.street = Sanitizer.sanitizeInput(
-                sanitized.buyer.deliveryAddress.street
-            )
-            sanitized.buyer.deliveryAddress.complement =
-                Sanitizer.sanitizeInput(
-                    sanitized.buyer.deliveryAddress.complement
-                )
-            sanitized.buyer.deliveryAddress.neighborhood =
-                Sanitizer.sanitizeInput(
-                    sanitized.buyer.deliveryAddress.neighborhood
-                )
-            sanitized.buyer.deliveryAddress.city = Sanitizer.sanitizeInput(
-                sanitized.buyer.deliveryAddress.city
-            )
-            sanitized.buyer.deliveryAddress.state = Sanitizer.sanitizeInput(
-                sanitized.buyer.deliveryAddress.state
-            )
-            sanitized.buyer.deliveryAddress.number = Sanitizer.sanitizeInput(
-                sanitized.buyer.deliveryAddress.number
-            )
-        }
-    }
-    if (sanitized.payments && Array.isArray(sanitized.payments)) {
-        sanitized.payments = sanitized.payments.map((payment) => {
-            const sanitizedPayment = { ...payment }
-            if (sanitizedPayment.creditCard) {
-                sanitizedPayment.creditCard = {
-                    cardId: Sanitizer.sanitizeInput(
-                        sanitizedPayment.creditCard?.cardId
-                    ),
-                    cardNumber: Sanitizer.sanitizeInput(
-                        sanitizedPayment.creditCard.cardNumber
-                    ),
-                    cvv: Sanitizer.sanitizeInput(
-                        sanitizedPayment.creditCard.cvv
-                    ),
-                    month: Sanitizer.sanitizeInput(
-                        sanitizedPayment.creditCard.month
-                    ),
-                    year: Sanitizer.sanitizeInput(
-                        sanitizedPayment.creditCard.year
-                    ),
-                    holderName: Sanitizer.sanitizeInput(
-                        sanitizedPayment.creditCard.holderName
-                    ),
-                }
-            }
-            return sanitizedPayment
-        })
-    }
-    if (sanitized.items) {
-        sanitized.items = sanitized.items.map((item) => {
-            return {
-                externalReferenceId: Sanitizer.sanitizeInput(
-                    item.externalReferenceId
-                ),
-                description: Sanitizer.sanitizeInput(item.description),
-                name: Sanitizer.sanitizeInput(item.name),
-                quantity: item.quantity,
-                priceInCents: item.priceInCents,
-            }
-        })
-    }
-    if (sanitized.metadata && Array.isArray(sanitized.metadata)) {
-        sanitized.metadata = sanitized.metadata.map((metadata) => {
-            return {
-                key: Sanitizer.sanitizeInput(metadata.key),
-                value: Sanitizer.sanitizeInput(metadata.value),
-            }
-        })
-    }
-    return sanitized
-}
-
-export { sanitizeOrderData }