@galadrim/galadmin 0.1.236 → 0.2.7

package/src/api.ts

@@ -8,7 +8,7 @@ import * as mime from "mime";
 import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 import { Storage } from "@google-cloud/storage";
-import sizeOf from "image-size";
+import { getImageDimensions } from "./utils/imageDimensions";
 import * as serializeJs from "serialize-javascript";
 import * as SftpClient from "ssh2-sftp-client";
 
@@ -20,12 +20,187 @@ import { v4 as uuidv4 } from "uuid";
 
 import { quoteIdentifier } from "./utils/dbManager";
 
-function generateUniqueIdForObject(obj) {
+export function generateUniqueIdForObject(obj) {
   const str = JSON.stringify(obj);
   const hash = crypto.createHash("sha256").update(str).digest("hex");
   return hash;
 }
 
+// ---------------------------------------------------------------------------
+// SECURITY: server-side authorization.
+//
+// The config-filtering middleware below only decides which views the *client*
+// is shown, and sets canEdit/canCreate/canDelete flags on that served config.
+// Nothing enforced those decisions server-side, so a session with the lowest
+// role could POST directly to /updateRecord, /deleteRecord, /customQuery, …
+// and act on any view — including read-only ones — as the DB user (root).
+// This block re-checks every sensitive route against the view's declared roles.
+// ---------------------------------------------------------------------------
+export const ROOT_ROLE = "root";
+export const roleOf = (req) =>
+  req.session && req.session.user && req.session.user.role;
+// Write access = the view's `roles` (root always allowed).
+export const canWriteView = (view, role) =>
+  role === ROOT_ROLE || !view || !view.roles || view.roles.includes(role);
+
+export const viewFromRequest = (req) => {
+  const idx =
+    req.body && req.body.viewIndex !== undefined
+      ? req.body.viewIndex
+      : req.query && req.query.viewIndex !== undefined
+        ? req.query.viewIndex
+        : undefined;
+  if (idx === undefined || !req.config || !req.config.views) return undefined;
+  return req.config.views[idx];
+};
+
+// Routes that mutate data and reference their target view via viewIndex
+// (body for POST bodies, query for /uploadFile). Import routes carry the
+// viewIndex inside a multipart body and are guarded inline in their handlers.
+export const MUTATING_VIEW_ROUTES = new Set([
+  "/updateRecord",
+  "/createRecord",
+  "/deleteRecord",
+  "/deleteRecords",
+  "/deleteRecordFromPanel",
+  "/customAction",
+  "/uploadFile",
+]);
+// /duplicateRecord references its table via req.body.table (not a viewIndex),
+// so it is guarded inline in its handler instead of by the generic middleware.
+
+// Column names are interpolated into INSERT/UPDATE statements; only accept plain
+// SQL identifiers so a crafted key cannot break out of the column list.
+export const areSafeColumnNames = (data) =>
+  !data || Object.keys(data).every((k) => /^[A-Za-z0-9_]+$/.test(k));
+
+// Tables the current role is allowed to write, gathered from its writable views
+// and their creatable panels — used to bound /duplicateRecord's target table.
+export const writableTables = (req) => {
+  const role = roleOf(req);
+  const tables = new Set<string>();
+  for (const view of req.config?.views || []) {
+    if (!canWriteView(view, role)) continue;
+    if (view.tableName) tables.add(view.tableName);
+    for (const panel of view.recordViewPanels || []) {
+      if (panel.tableName) tables.add(panel.tableName);
+      if (panel.createConfig?.tableName)
+        tables.add(panel.createConfig.tableName);
+    }
+  }
+  return tables;
+};
+
+// Reject client-supplied SQL fragments (the `filters` array is concatenated
+// raw into the WHERE clause). With multipleStatements off this already blocks
+// stacked writes; the pattern also blocks UNION/comment/file exfil breakouts.
+export const looksLikeSqlBreakout = (frag) =>
+  typeof frag === "string" &&
+  /(;|--|\/\*|\bunion\b|\binto\s+(out|dump)file\b|\bsleep\s*\(|\bbenchmark\s*\(|\bload_file\s*\()/i.test(
+    frag,
+  );
+
+export function sqlAnd(conditions) {
+  const existingConditions = [];
+  for (const condition of conditions) {
+    if (condition && condition.length > 0) {
+      existingConditions.push(condition);
+    }
+  }
+  if (existingConditions.length <= 1) {
+    return existingConditions[0] || null;
+  } else {
+    let result = "";
+    for (let i = 0; i < existingConditions.length; i++) {
+      if (i > 0) {
+        result += " AND ";
+      }
+      result += "(" + existingConditions[i] + ")";
+    }
+    return result;
+  }
+}
+
+export async function getFormattedValue(column, record) {
+  let value;
+  try {
+    record.options = column.options;
+    if (column.formatValueForExport) {
+      value = await column.formatValueForExport(record);
+    } else if (column.formattedValue) {
+      value = evalExpression(column.formattedValue, record);
+    } else if (column.formatValue) {
+      value = await column.formatValue(record);
+    } else if (column.dataType == "tinyint") {
+      value = record[column.name] == 1 ? "Oui" : "Non";
+    } else {
+      value = record[column.name];
+    }
+    return value === null || typeof value == "undefined" ? "" : value;
+  } catch (err) {
+    return value || "";
+  }
+}
+
+export function evalExpression(expression, data) {
+  let varString = "";
+  let statement = "";
+
+  try {
+    for (let key in data) {
+      statement =
+        "var " +
+        key +
+        " = " +
+        (typeof data[key] === "string"
+          ? "'" +
+            data[key]
+              .replace(/'/g, "\\'")
+              .replace(/\n/g, "")
+              .replace(/\r/g, "") +
+            "'"
+          : typeof data[key] === "object"
+            ? JSON.stringify(data[key])
+            : data[key]) +
+        ";";
+      varString += statement;
+    }
+    const result = eval(varString + expression);
+    return result;
+  } catch (e) {
+    console.log("Problème d'évaluation de l'expression", statement);
+    console.error(e);
+    return "Error";
+  }
+}
+
+export function formatValueForInsertion(value: any, dbType: string) {
+  if (value !== 0 && !value) {
+    return "NULL";
+  }
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  if (typeof value === "string") {
+    if (dbType === "POSTGRESQL") {
+      return "'" + value.replace(/'/g, "''") + "'";
+    } else {
+      return "'" + value.replace(/'/g, "\\'") + "'";
+    }
+  }
+  if (typeof value === "object") {
+    return "'" + JSON.stringify(value).replace(/'/g, "\\'") + "'";
+  }
+  if (typeof value === "boolean") {
+    return value ? "TRUE" : "FALSE";
+  }
+  if (typeof value === "number") {
+    return value;
+  }
+
+  return value;
+}
+
 declare global {
   namespace Express {
     interface Request {
@@ -93,78 +268,10 @@ export default (db, config) => {
   });
 
   // ---------------------------------------------------------------------------
-  // SECURITY: server-side authorization.
-  //
-  // The config-filtering middleware above only decides which views the *client*
-  // is shown, and sets canEdit/canCreate/canDelete flags on that served config.
-  // Nothing enforced those decisions server-side, so a session with the lowest
-  // role could POST directly to /updateRecord, /deleteRecord, /customQuery, …
-  // and act on any view — including read-only ones — as the DB user (root).
-  // This block re-checks every sensitive route against the view's declared roles.
+  // SECURITY: server-side authorization — see the helpers above (exported at
+  // module scope for testability): roleOf, canWriteView, viewFromRequest,
+  // MUTATING_VIEW_ROUTES, areSafeColumnNames, writableTables, looksLikeSqlBreakout.
   // ---------------------------------------------------------------------------
-  const ROOT_ROLE = "root";
-  const roleOf = (req) =>
-    req.session && req.session.user && req.session.user.role;
-  // Write access = the view's `roles` (root always allowed).
-  const canWriteView = (view, role) =>
-    role === ROOT_ROLE || !view || !view.roles || view.roles.includes(role);
-
-  const viewFromRequest = (req) => {
-    const idx =
-      req.body && req.body.viewIndex !== undefined
-        ? req.body.viewIndex
-        : req.query && req.query.viewIndex !== undefined
-          ? req.query.viewIndex
-          : undefined;
-    if (idx === undefined || !req.config || !req.config.views) return undefined;
-    return req.config.views[idx];
-  };
-
-  // Routes that mutate data and reference their target view via viewIndex
-  // (body for POST bodies, query for /uploadFile). Import routes carry the
-  // viewIndex inside a multipart body and are guarded inline in their handlers.
-  const MUTATING_VIEW_ROUTES = new Set([
-    "/updateRecord",
-    "/createRecord",
-    "/deleteRecord",
-    "/deleteRecords",
-    "/deleteRecordFromPanel",
-    "/customAction",
-    "/uploadFile",
-  ]);
-  // /duplicateRecord references its table via req.body.table (not a viewIndex),
-  // so it is guarded inline in its handler instead of by the generic middleware.
-
-  // Column names are interpolated into INSERT/UPDATE statements; only accept plain
-  // SQL identifiers so a crafted key cannot break out of the column list.
-  const areSafeColumnNames = (data) =>
-    !data || Object.keys(data).every((k) => /^[A-Za-z0-9_]+$/.test(k));
-
-  // Tables the current role is allowed to write, gathered from its writable views
-  // and their creatable panels — used to bound /duplicateRecord's target table.
-  const writableTables = (req) => {
-    const role = roleOf(req);
-    const tables = new Set<string>();
-    for (const view of req.config?.views || []) {
-      if (!canWriteView(view, role)) continue;
-      if (view.tableName) tables.add(view.tableName);
-      for (const panel of view.recordViewPanels || []) {
-        if (panel.tableName) tables.add(panel.tableName);
-        if (panel.createConfig?.tableName)
-          tables.add(panel.createConfig.tableName);
-      }
-    }
-    return tables;
-  };
-
-  // Reject client-supplied SQL fragments (the `filters` array is concatenated
-  // raw into the WHERE clause). With multipleStatements off this already blocks
-  // stacked writes; the pattern also blocks UNION/comment/file exfil breakouts.
-  const looksLikeSqlBreakout = (frag) =>
-    typeof frag === "string" &&
-    /(;|--|\/\*|\bunion\b|\binto\s+(out|dump)file\b|\bsleep\s*\(|\bbenchmark\s*\(|\bload_file\s*\()/i.test(
-      frag,
-    );
 
   app.use((req, res, next) => {
     const role = roleOf(req);
@@ -217,7 +324,14 @@ export default (db, config) => {
               .map((x) => quoteIdentifier(x, db.dbType))
               .join(".");
           }
-          queryString += " LIKE '%" + params.query.replace(/'/g, "\\'") + "%'";
+          // SECURITY: escape the user query per dialect — PostgreSQL does not
+          // treat backslashes as escapes inside standard strings, so a `\'`
+          // would terminate the literal early.
+          const searchEscaped =
+            db.dbType === "POSTGRESQL"
+              ? params.query.replace(/'/g, "''")
+              : params.query.replace(/'/g, "\\'");
+          queryString += " LIKE '%" + searchEscaped + "%'";
           isNewCondition = false;
         }
       }
@@ -319,6 +433,7 @@ export default (db, config) => {
       res.send(output[0].code);
     } catch (err) {
       console.error(err);
+      res.sendStatus(500);
     }
   });
 
@@ -333,27 +448,6 @@ export default (db, config) => {
     });
   });
 
-  const sqlAnd = (conditions) => {
-    const existingConditions = [];
-    for (const condition of conditions) {
-      if (condition && condition.length > 0) {
-        existingConditions.push(condition);
-      }
-    }
-    if (existingConditions.length <= 1) {
-      return existingConditions[0] || null;
-    } else {
-      let result = "";
-      for (let i = 0; i < existingConditions.length; i++) {
-        if (i > 0) {
-          result += " AND ";
-        }
-        result += "(" + existingConditions[i] + ")";
-      }
-      return result;
-    }
-  };
-
   app.post("/foreignSelectRecords", async (req, res, next) => {
     const view = req.config.views[req.body.viewIndex];
     const column = [
@@ -479,86 +573,6 @@ export default (db, config) => {
 
   const formattedValueToFunction = {};
 
-  async function getFormattedValue(column, record) {
-    let value;
-    try {
-      record.options = column.options;
-      if (column.formatValueForExport) {
-        value = await column.formatValueForExport(record);
-      } else if (column.formattedValue) {
-        value = evalExpression(column.formattedValue, record);
-      } else if (column.formatValue) {
-        value = await column.formatValue(record);
-      } else if (column.dataType == "tinyint") {
-        value = record[column.name] == 1 ? "Oui" : "Non";
-      } else {
-        value = record[column.name];
-      }
-      return value === null || typeof value == "undefined" ? "" : value;
-    } catch (err) {
-      return value || "";
-    }
-  }
-
-  function evalExpression(expression, data) {
-    let varString = "";
-    let statement = "";
-
-    try {
-      for (let key in data) {
-        statement =
-          "var " +
-          key +
-          " = " +
-          (typeof data[key] === "string"
-            ? "'" +
-              data[key]
-                .replace(/'/g, "\\'")
-                .replace(/\n/g, "")
-                .replace(/\r/g, "") +
-              "'"
-            : typeof data[key] === "object"
-              ? JSON.stringify(data[key])
-              : data[key]) +
-          ";";
-        varString += statement;
-      }
-      const result = eval(varString + expression);
-      return result;
-    } catch (e) {
-      console.log("Problème d'évaluation de l'expression", statement);
-      console.error(e);
-      return "Error";
-    }
-  }
-
-  function formatValueForInsertion(value: any, dbType: string) {
-    if (value !== 0 && !value) {
-      return "NULL";
-    }
-    if (value instanceof Date) {
-      return value.toISOString();
-    }
-    if (typeof value === "string") {
-      if (dbType === "POSTGRESQL") {
-        return "'" + value.replace(/'/g, "''") + "'";
-      } else {
-        return "'" + value.replace(/'/g, "\\'") + "'";
-      }
-    }
-    if (typeof value === "object") {
-      return "'" + JSON.stringify(value).replace(/'/g, "\\'") + "'";
-    }
-    if (typeof value === "boolean") {
-      return value ? "TRUE" : "FALSE";
-    }
-    if (typeof value === "number") {
-      return value;
-    }
-
-    return value;
-  }
-
   app.post("/recordsExport", async function (req, res) {
     const view = req.config.views[req.body.viewIndex];
     const orderBy = req.body.orderBy || view.orderBy;
@@ -571,7 +585,19 @@ export default (db, config) => {
       table: view.tableName,
       page: 1,
       allRecords: true,
-      filters: sqlAnd([view.filters, subview?.filters, req.body.filters]),
+      filters: sqlAnd([
+        view.filters,
+        subview?.filters,
+        req.body.filters,
+        // SECURITY: scope the export exactly like the list view, otherwise a
+        // user could download rows their filtersFromUser clause hides.
+        view.filtersFromUser
+          ? view.filtersFromUser(
+              req.session.user.userId,
+              req.session.user.role,
+            )
+          : null,
+      ]),
       having: subview?.having,
       customQuery: view.customQuery,
       join: view.join,
@@ -623,6 +649,11 @@ export default (db, config) => {
       }
       // Get viewIndex in fields
       const view = req.config.views[fields.viewIndex[0]];
+      // SECURITY: the generic write-guard cannot see a viewIndex buried in a
+      // multipart body, so imports enforce the view's write roles here.
+      if (!view || !canWriteView(view, roleOf(req))) {
+        return res.sendStatus(403);
+      }
       if (typeof view.parseImportFile !== "function") {
         return res
           .status(500)
@@ -714,7 +745,19 @@ export default (db, config) => {
       }
       // Get viewIndex and panelIndex in fields
       const view = req.config.views[fields.viewIndex[0]];
-      const panel = view.recordViewPanels[fields.panelIndex[0]];
+      const panel = view
+        ? view.recordViewPanels[fields.panelIndex[0]]
+        : undefined;
+      // SECURITY: same write-guard as /recordsImport, plus the panel's own
+      // roles when it declares any.
+      if (
+        !view ||
+        !canWriteView(view, roleOf(req)) ||
+        !panel ||
+        !canWriteView(panel, roleOf(req))
+      ) {
+        return res.sendStatus(403);
+      }
       if (typeof panel.parseImportFile !== "function") {
         return res
           .status(500)
@@ -999,9 +1042,12 @@ export default (db, config) => {
 
   app.post("/deleteRecords", async function (req, res, next) {
     const view = req.config.views[req.body.viewIndex];
+    // SECURITY: bind the primary values as parameters instead of interpolating
+    // them into the IN() list (quote-bearing values could break out).
+    const placeholders = req.body.primaryValues.map(() => "?").join(", ");
     const { err } = await db.query(
-      `DELETE FROM ?? WHERE ?? IN(${req.body.primaryValues.map((x) => "'" + x + "'").join(",")})`,
-      [view.tableName, view.primaryId],
+      `DELETE FROM ?? WHERE ?? IN(${placeholders})`,
+      [view.tableName, view.primaryId, ...req.body.primaryValues],
     );
     if (err) {
       return res.status(500).send(err);
@@ -1099,9 +1145,11 @@ export default (db, config) => {
 
   app.post("/createRecord", async function (req, res, next) {
     const view = req.config.views[req.body.viewIndex];
-    const panel = req.body.panelIndex
-      ? view.recordViewPanels[req.body.panelIndex]
-      : null;
+    // panelIndex arrives as a string from the front-end but a numeric caller
+    // may send 0 — only null/undefined mean "no panel".
+    const hasPanel =
+      req.body.panelIndex !== undefined && req.body.panelIndex !== null;
+    const panel = hasPanel ? view.recordViewPanels[req.body.panelIndex] : null;
     try {
       for (let key in req.body.data) {
         if (
@@ -1165,12 +1213,19 @@ export default (db, config) => {
         } catch (e) {}
       }
       if (panel ? panel.createCallbackFunction : view.createCallbackFunction) {
-        await (
-          panel ? panel.createCallbackFunction : view.createCallbackFunction
-        )({
-          id: r.insertId,
-          data: req.body.data,
-        });
+        // The insert is already committed: a failing callback must not turn
+        // into a 500 that invites a client retry (which would duplicate the
+        // row). Log and answer 200.
+        try {
+          await (
+            panel ? panel.createCallbackFunction : view.createCallbackFunction
+          )({
+            id: r.insertId,
+            data: req.body.data,
+          });
+        } catch (callbackErr) {
+          console.error(callbackErr);
+        }
       }
       res.send({
         id: r.insertId,
@@ -1184,30 +1239,6 @@ export default (db, config) => {
     }
   });
 
-  // Collect every SQL template declared anywhere in the (role-filtered) config:
-  // panel `query`, `autocompleteListQuery`, etc. customQuery may only run a
-  // template that already exists in the config the caller is allowed to see —
-  // so it can never be turned into an arbitrary read/write primitive.
-  function collectAllowedQueries(node, acc = new Set<string>()) {
-    if (!node || typeof node !== "object") return acc;
-    if (Array.isArray(node)) {
-      for (const item of node) collectAllowedQueries(item, acc);
-      return acc;
-    }
-    for (const key of Object.keys(node)) {
-      const value = node[key];
-      if (
-        typeof value === "string" &&
-        (key === "query" || /Query$/.test(key))
-      ) {
-        acc.add(value.trim());
-      } else if (value && typeof value === "object") {
-        collectAllowedQueries(value, acc);
-      }
-    }
-    return acc;
-  }
-
   // Attack-surface reduction: only expose /customQuery at all when the config
   // actually declares SQL templates (panels, autocomplete lists, …). If nothing
   // uses it, the route is replaced by an explicit "disabled" stub so the raw-SQL
@@ -1257,7 +1288,7 @@ export default (db, config) => {
   function uploadFile(column, fileParamName, req, res) {
     if (column.s3Config || column.gcpConfig) {
       const form = new multiparty.Form();
-      form.parse(req, function (err, fields, files) {
+      form.parse(req, async function (err, fields, files) {
         if (err) {
           return res.status(500).send(err);
         }
@@ -1268,8 +1299,16 @@ export default (db, config) => {
         const extension = originalFilename.match(/(?:\.([^.]+))?$/)[1];
         let aspectRatio = null;
         if (["png", "jpeg", "jpg", "gif"].includes(extension)) {
-          const dimensions = sizeOf(files[fileParamName][0].path);
-          aspectRatio = dimensions.height / dimensions.width;
+          try {
+            const dimensions = await getImageDimensions(
+              files[fileParamName][0].path,
+            );
+            if (dimensions) {
+              aspectRatio = dimensions.height / dimensions.width;
+            }
+          } catch {
+            // malformed image data: leave aspectRatio null rather than crash
+          }
         }
         const originalFilenameWithoutExtension = originalFilename.replace(
           "." + extension,
@@ -1442,6 +1481,13 @@ export default (db, config) => {
   app.post(
     "/uploadFileFromBetterRichTextInput",
     async function (req, res, next) {
+      // SECURITY: the upload target comes entirely from the client header and
+      // this route carries no viewIndex, so gate it on the caller being able
+      // to write at least one view (read-only roles are rejected outright).
+      const role = roleOf(req);
+      if (!req.config.views.some((view) => canWriteView(view, role))) {
+        return res.sendStatus(403);
+      }
       const fileUploadProperties = JSON.parse(
         req.headers["file-upload-properties"] as string,
       );
@@ -1498,7 +1544,28 @@ export default (db, config) => {
   return app;
 };
 
-async function enrichConfig(config, db) {
+// Collect every SQL template declared anywhere in the (role-filtered) config:
+// panel `query`, `autocompleteListQuery`, etc. customQuery may only run a
+// template that already exists in the config the caller is allowed to see —
+// so it can never be turned into an arbitrary read/write primitive.
+export function collectAllowedQueries(node, acc = new Set<string>()) {
+  if (!node || typeof node !== "object") return acc;
+  if (Array.isArray(node)) {
+    for (const item of node) collectAllowedQueries(item, acc);
+    return acc;
+  }
+  for (const key of Object.keys(node)) {
+    const value = node[key];
+    if (typeof value === "string" && (key === "query" || /Query$/.test(key))) {
+      acc.add(value.trim());
+    } else if (value && typeof value === "object") {
+      collectAllowedQueries(value, acc);
+    }
+  }
+  return acc;
+}
+
+export async function enrichConfig(config, db) {
   const { rows: info, err } = await db.query(
     "SELECT * FROM information_schema.columns WHERE table_schema = ?",
     [config.mysql?.database || config.postgresql?.database],
@@ -1545,7 +1612,7 @@ async function enrichConfig(config, db) {
   config.enriched = true;
 }
 
-function enrichColumn(column, tableName, info) {
+export function enrichColumn(column, tableName, info) {
   if (!column.__id__) {
     column.__id__ = generateUniqueIdForObject(column);
   }

package/src/front/src/App.test.js

@@ -0,0 +1,28 @@
+import { render } from "@testing-library/react";
+import axios from "axios";
+import App from "./App";
+
+jest.mock("axios", () => ({
+  __esModule: true,
+  default: { defaults: {}, get: jest.fn(), post: jest.fn() },
+}));
+
+// RichTextInput patches window.Quill at module load; Quill only exists in
+// the real app via a CDN script tag.
+jest.mock("./components/inputs/RichTextInput", () => ({
+  __esModule: true,
+  default: () => null,
+}));
+
+// CRA's jest config resets mocks between tests, so behavior must be
+// (re)declared here rather than in the mock factory.
+beforeEach(() => {
+  axios.get.mockResolvedValue({ data: { isAuthenticated: false } });
+});
+
+describe("App", () => {
+  it("renders the login panel when the session is not authenticated", async () => {
+    const { findByText } = render(<App />);
+    expect(await findByText("Se connecter")).toBeTruthy();
+  });
+});