@olane/o-server 0.8.0 → 0.8.2

package/dist/test/input-validation.spec.js

@@ -0,0 +1,487 @@
+/**
+ * Input Validation & Sanitization Tests
+ *
+ * Comprehensive test suite covering:
+ * - Address validation (path traversal, format, control chars)
+ * - Method validation (private methods, prototype pollution)
+ * - Parameter sanitization (recursive dangerous property removal)
+ * - Request schema validation (Zod-based)
+ * - Integration tests (SQL injection, NoSQL injection, XSS, prototype pollution)
+ *
+ * Part of Phase 1 Security - Wave 2 (Input Validation)
+ */
+import { expect } from 'aegir/chai';
+import { validateAddress, validateMethod, sanitizeParams, validateRequest, useRequestSchema, streamRequestSchema, ValidationError, } from '../src/validation/index.js';
+describe('Input Validation & Sanitization', () => {
+    // ========================================================================
+    // ADDRESS VALIDATION TESTS
+    // ========================================================================
+    describe('Address Validation', () => {
+        it('should accept valid o:// address', () => {
+            expect(() => validateAddress('o://my-tool')).to.not.throw();
+            expect(() => validateAddress('o://my-tool/resource')).to.not.throw();
+            expect(() => validateAddress('o://my-tool/resource/nested')).to.not.throw();
+        });
+        it('should block path traversal with ../', () => {
+            expect(() => validateAddress('o://my-tool/../../../etc/passwd'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_ADDRESS');
+        });
+        it('should block path traversal with ..\\', () => {
+            expect(() => validateAddress('o://my-tool\\..\\..\\windows\\system32'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_ADDRESS');
+        });
+        it('should block URL-encoded path traversal (%2e%2e)', () => {
+            expect(() => validateAddress('o://my-tool/%2e%2e/%2e%2e/etc/passwd'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_ADDRESS');
+        });
+        it('should block URL-encoded path traversal (uppercase %2E%2E)', () => {
+            expect(() => validateAddress('o://my-tool/%2E%2E/%2E%2E/etc/passwd'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_ADDRESS');
+        });
+        it('should reject address without o:// protocol', () => {
+            expect(() => validateAddress('my-tool'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_ADDRESS');
+            expect(() => validateAddress('http://my-tool'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_ADDRESS');
+        });
+        it('should block control characters (null byte)', () => {
+            expect(() => validateAddress('o://my-tool\x00/resource'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_ADDRESS');
+        });
+        it('should block control characters (newline)', () => {
+            expect(() => validateAddress('o://my-tool\n/resource'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_ADDRESS');
+        });
+        it('should block backslashes in address', () => {
+            expect(() => validateAddress('o://my-tool\\resource'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_ADDRESS');
+        });
+        it('should accept valid nested address', () => {
+            expect(() => validateAddress('o://parent/child/grandchild')).to.not.throw();
+        });
+        it('should reject empty address', () => {
+            expect(() => validateAddress(''))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_ADDRESS');
+        });
+        it('should reject non-string address', () => {
+            expect(() => validateAddress(null))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_ADDRESS');
+            expect(() => validateAddress(123))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_ADDRESS');
+        });
+    });
+    // ========================================================================
+    // METHOD VALIDATION TESTS
+    // ========================================================================
+    describe('Method Validation', () => {
+        it('should accept valid method name', () => {
+            expect(() => validateMethod('getUserData')).to.not.throw();
+            expect(() => validateMethod('processPayment')).to.not.throw();
+            expect(() => validateMethod('list')).to.not.throw();
+        });
+        it('should block private method starting with underscore', () => {
+            expect(() => validateMethod('_internalMethod'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_METHOD');
+            expect(() => validateMethod('__privateHelper'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_METHOD');
+        });
+        it('should block __proto__ method', () => {
+            expect(() => validateMethod('__proto__'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_METHOD');
+        });
+        it('should block constructor method', () => {
+            expect(() => validateMethod('constructor'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_METHOD');
+        });
+        it('should block prototype method', () => {
+            expect(() => validateMethod('prototype'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_METHOD');
+        });
+        it('should block __proto__ case-insensitively', () => {
+            expect(() => validateMethod('__PROTO__'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_METHOD');
+            expect(() => validateMethod('__ProTo__'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_METHOD');
+        });
+        it('should block constructor case-insensitively', () => {
+            expect(() => validateMethod('CONSTRUCTOR'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_METHOD');
+            expect(() => validateMethod('Constructor'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_METHOD');
+        });
+        it('should block prototype case-insensitively', () => {
+            expect(() => validateMethod('PROTOTYPE'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_METHOD');
+            expect(() => validateMethod('ProtoType'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_METHOD');
+        });
+        it('should block control characters in method name', () => {
+            expect(() => validateMethod('method\x00Name'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_METHOD');
+            expect(() => validateMethod('method\nName'))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_METHOD');
+        });
+        it('should reject empty method name', () => {
+            expect(() => validateMethod(''))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_METHOD');
+        });
+        it('should reject non-string method', () => {
+            expect(() => validateMethod(null))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_METHOD');
+        });
+    });
+    // ========================================================================
+    // PARAMS SANITIZATION TESTS
+    // ========================================================================
+    describe('Params Sanitization', () => {
+        it('should pass through safe params unchanged', () => {
+            const params = { username: 'alice', age: 30, active: true };
+            const sanitized = sanitizeParams(params);
+            expect(sanitized).to.deep.equal(params);
+        });
+        it('should remove __proto__ from object', () => {
+            const params = { username: 'alice' };
+            params['__proto__'] = { isAdmin: true };
+            const sanitized = sanitizeParams(params);
+            expect(sanitized).to.deep.equal({ username: 'alice' });
+            expect(Object.keys(sanitized)).to.not.include('__proto__');
+        });
+        it('should remove constructor from object', () => {
+            const params = { username: 'alice' };
+            params['constructor'] = { isAdmin: true };
+            const sanitized = sanitizeParams(params);
+            expect(sanitized).to.deep.equal({ username: 'alice' });
+            expect(Object.keys(sanitized)).to.not.include('constructor');
+        });
+        it('should remove prototype from object', () => {
+            const params = { username: 'alice' };
+            params['prototype'] = { isAdmin: true };
+            const sanitized = sanitizeParams(params);
+            expect(sanitized).to.deep.equal({ username: 'alice' });
+            expect(Object.keys(sanitized)).to.not.include('prototype');
+        });
+        it('should sanitize nested objects recursively', () => {
+            const params = {
+                user: {
+                    name: 'alice',
+                    profile: {
+                        bio: 'test',
+                    },
+                },
+            };
+            params.user['__proto__'] = { isAdmin: true };
+            params.user.profile['constructor'] = { evil: true };
+            const sanitized = sanitizeParams(params);
+            expect(sanitized).to.deep.equal({
+                user: {
+                    name: 'alice',
+                    profile: {
+                        bio: 'test',
+                    },
+                },
+            });
+            expect(Object.keys(sanitized.user)).to.not.include('__proto__');
+            expect(Object.keys(sanitized.user.profile)).to.not.include('constructor');
+        });
+        it('should sanitize arrays recursively', () => {
+            const params = {
+                users: [
+                    { name: 'alice', '__proto__': { isAdmin: true } },
+                    { name: 'bob', 'constructor': { evil: true } },
+                ],
+            };
+            const sanitized = sanitizeParams(params);
+            expect(sanitized).to.deep.equal({
+                users: [
+                    { name: 'alice' },
+                    { name: 'bob' },
+                ],
+            });
+        });
+        it('should handle null and undefined', () => {
+            expect(sanitizeParams(null)).to.equal(null);
+            expect(sanitizeParams(undefined)).to.equal(undefined);
+        });
+        it('should handle primitives', () => {
+            expect(sanitizeParams('string')).to.equal('string');
+            expect(sanitizeParams(123)).to.equal(123);
+            expect(sanitizeParams(true)).to.equal(true);
+        });
+        it('should handle arrays of primitives', () => {
+            const params = [1, 2, 3, 'test'];
+            const sanitized = sanitizeParams(params);
+            expect(sanitized).to.deep.equal(params);
+        });
+        it('should handle deeply nested structures', () => {
+            const params = {
+                level1: {
+                    level2: {
+                        level3: {
+                            data: 'safe',
+                        },
+                    },
+                },
+            };
+            params.level1.level2.level3['__proto__'] = { evil: true };
+            const sanitized = sanitizeParams(params);
+            expect(sanitized).to.deep.equal({
+                level1: {
+                    level2: {
+                        level3: {
+                            data: 'safe',
+                        },
+                    },
+                },
+            });
+            expect(Object.keys(sanitized.level1.level2.level3)).to.not.include('__proto__');
+        });
+        it('should remove dangerous keys case-insensitively', () => {
+            const params = { username: 'alice' };
+            params['__PROTO__'] = { evil: true };
+            params['CONSTRUCTOR'] = { bad: true };
+            params['ProtoType'] = { wrong: true };
+            const sanitized = sanitizeParams(params);
+            expect(sanitized).to.deep.equal({ username: 'alice' });
+            expect(Object.keys(sanitized)).to.deep.equal(['username']);
+        });
+    });
+    // ========================================================================
+    // REQUEST SCHEMA VALIDATION TESTS
+    // ========================================================================
+    describe('Request Schema Validation', () => {
+        it('should validate valid POST /use request', () => {
+            const request = {
+                address: 'o://my-tool',
+                method: 'getData',
+                params: { id: 123 },
+                id: 'req-123',
+            };
+            const validated = validateRequest(request, useRequestSchema);
+            expect(validated).to.deep.equal(request);
+        });
+        it('should accept minimal POST /use request (address and method)', () => {
+            const request = { address: 'o://my-tool', method: 'getData' };
+            const validated = validateRequest(request, useRequestSchema);
+            expect(validated).to.deep.equal(request);
+        });
+        it('should reject POST /use request with missing address', () => {
+            const request = { method: 'getData', params: {} };
+            expect(() => validateRequest(request, useRequestSchema))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_PARAMS');
+        });
+        it('should reject POST /use request with missing method', () => {
+            const request = { address: 'o://my-tool' };
+            expect(() => validateRequest(request, useRequestSchema))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_PARAMS');
+        });
+        it('should reject POST /use request with empty address', () => {
+            const request = { address: '' };
+            expect(() => validateRequest(request, useRequestSchema))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_PARAMS');
+        });
+        it('should reject POST /use request with invalid type', () => {
+            const request = { address: 123 };
+            expect(() => validateRequest(request, useRequestSchema))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_PARAMS');
+        });
+        it('should validate valid POST /use/stream request', () => {
+            const request = {
+                address: 'o://my-tool',
+                method: 'streamData',
+                params: { filter: 'active' },
+            };
+            const validated = validateRequest(request, streamRequestSchema);
+            expect(validated).to.deep.equal(request);
+        });
+        it('should reject POST /stream request with missing address', () => {
+            const request = { method: 'streamData' };
+            expect(() => validateRequest(request, streamRequestSchema))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_PARAMS');
+        });
+        it('should provide readable error messages', () => {
+            const request = { wrongField: 'test' };
+            try {
+                validateRequest(request, useRequestSchema);
+                expect.fail('Should have thrown');
+            }
+            catch (error) {
+                expect(error).to.be.instanceOf(ValidationError);
+                expect(error.message).to.include('address');
+                expect(error.message.toLowerCase()).to.include('required');
+            }
+        });
+    });
+    // ========================================================================
+    // INTEGRATION TESTS - ATTACK PREVENTION
+    // ========================================================================
+    describe('Integration Tests - Attack Prevention', () => {
+        it('should handle SQL injection attempts appropriately', () => {
+            // SQL injection strings in params are allowed through sanitization
+            // because our validation focuses on structural attacks (prototype pollution)
+            // SQL injection prevention is the responsibility of the database layer
+            const maliciousParams = {
+                username: "admin' OR '1'='1",
+                password: "' OR '1'='1' --",
+            };
+            const sanitized = sanitizeParams(maliciousParams);
+            expect(sanitized).to.deep.equal(maliciousParams);
+            // However, addresses with path traversal or control chars are blocked
+            expect(() => validateAddress("o://users/../../../etc/passwd"))
+                .to.throw(ValidationError)
+                .with.property('code', 'INVALID_ADDRESS');
+        });
+        it('should block NoSQL injection attempt via prototype pollution', () => {
+            const maliciousParams = { username: 'admin' };
+            maliciousParams['__proto__'] = { isAdmin: true };
+            maliciousParams['constructor'] = { name: 'Object' };
+            const sanitized = sanitizeParams(maliciousParams);
+            expect(sanitized).to.deep.equal({ username: 'admin' });
+            expect(Object.keys(sanitized)).to.deep.equal(['username']);
+        });
+        it('should block XSS attempt in address', () => {
+            const xssAddresses = [
+                'o://tool/<script>alert(1)</script>',
+                'o://tool/"><script>alert(1)</script>',
+                "o://tool/';alert(1);//",
+            ];
+            // These would be caught by the o:// validation or by having invalid characters
+            xssAddresses.forEach((addr) => {
+                // XSS payloads typically contain characters that would be caught by validation
+                // The main protection is proper output encoding on the client side
+                // But we ensure no control characters pass through
+                if (/[\x00-\x1F\x7F]/.test(addr)) {
+                    expect(() => validateAddress(addr))
+                        .to.throw(ValidationError);
+                }
+            });
+        });
+        it('should block comprehensive prototype pollution attempt', () => {
+            const maliciousParams = {
+                user: {
+                    name: 'attacker',
+                },
+                settings: {},
+                data: [
+                    {
+                        value: 'test',
+                    },
+                ],
+            };
+            maliciousParams.user['__proto__'] = {
+                isAdmin: true,
+                role: 'admin',
+            };
+            maliciousParams.settings['constructor'] = {
+                prototype: {
+                    isAdmin: true,
+                },
+            };
+            maliciousParams.data[0]['__proto__'] = { polluted: true };
+            const sanitized = sanitizeParams(maliciousParams);
+            // All dangerous properties should be removed
+            expect(sanitized).to.deep.equal({
+                user: {
+                    name: 'attacker',
+                },
+                settings: {},
+                data: [
+                    {
+                        value: 'test',
+                    },
+                ],
+            });
+            // Verify prototype is not polluted
+            const testObj = {};
+            expect(testObj.isAdmin).to.be.undefined;
+            expect(testObj.polluted).to.be.undefined;
+        });
+        it('should block path traversal in nested address components', () => {
+            const traversalAddresses = [
+                'o://tool/../../etc/passwd',
+                'o://tool/../../../root/.ssh/id_rsa',
+                'o://tool/subpath/../../../../../../etc/shadow',
+            ];
+            traversalAddresses.forEach((addr) => {
+                expect(() => validateAddress(addr))
+                    .to.throw(ValidationError)
+                    .with.property('code', 'INVALID_ADDRESS');
+            });
+        });
+        it('should block method-based attacks', () => {
+            const dangerousMethods = [
+                '_privateMethod',
+                '__proto__',
+                'constructor',
+                'prototype',
+                '__defineGetter__',
+                '__defineSetter__',
+                '__lookupGetter__',
+                '__lookupSetter__',
+            ];
+            dangerousMethods.forEach((method) => {
+                expect(() => validateMethod(method))
+                    .to.throw(ValidationError)
+                    .with.property('code', 'INVALID_METHOD');
+            });
+        });
+        it('should handle combined attack vectors', () => {
+            // Address with path traversal
+            expect(() => validateAddress('o://tool/../../../etc'))
+                .to.throw(ValidationError);
+            // Method with private access
+            expect(() => validateMethod('_internal'))
+                .to.throw(ValidationError);
+            // Params with prototype pollution
+            const params = { data: 'test' };
+            params['__proto__'] = { isAdmin: true };
+            params['constructor'] = { evil: true };
+            const sanitized = sanitizeParams(params);
+            expect(sanitized).to.deep.equal({ data: 'test' });
+            expect(Object.keys(sanitized)).to.deep.equal(['data']);
+        });
+        it('should prevent null byte injection', () => {
+            expect(() => validateAddress('o://tool\x00/resource'))
+                .to.throw(ValidationError);
+            expect(() => validateMethod('method\x00Name'))
+                .to.throw(ValidationError);
+        });
+        it('should prevent CRLF injection', () => {
+            expect(() => validateAddress('o://tool\r\n/resource'))
+                .to.throw(ValidationError);
+            expect(() => validateMethod('method\r\nName'))
+                .to.throw(ValidationError);
+        });
+    });
+});

package/dist/test/jwt-auth.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=jwt-auth.spec.d.ts.map

package/dist/test/jwt-auth.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.spec.d.ts","sourceRoot":"","sources":["../../test/jwt-auth.spec.ts"],"names":[],"mappings":""}