@opengis/fastify-table 1.0.71 → 1.0.72
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.eslintrc.cjs +42 -42
- package/Changelog.md +229 -229
- package/README.md +26 -26
- package/cron/controllers/cronApi.js +22 -22
- package/cron/controllers/utils/cronList.js +1 -1
- package/cron/funcs/addCron.js +131 -131
- package/cron/index.js +10 -10
- package/crud/controllers/utils/checkXSS.js +45 -45
- package/crud/controllers/utils/xssInjection.js +72 -72
- package/crud/funcs/isFileExists.js +13 -13
- package/crud/funcs/setToken.js +53 -53
- package/index.js +97 -89
- package/migration/exec.migrations.js +75 -75
- package/notification/controllers/testEmail.js +49 -49
- package/notification/funcs/utils/sendEmail.js +39 -39
- package/notification/index.js +31 -31
- package/package.json +27 -25
- package/pg/funcs/getPG.js +29 -29
- package/redis/funcs/getRedis.js +23 -23
- package/server/migrations/crm.sql +150 -150
- package/server/migrations/log.sql +43 -43
- package/server.js +14 -14
- package/table/controllers/filter.js +37 -37
- package/table/controllers/search.js +72 -72
- package/table/controllers/utils/getTemplate.js +28 -28
- package/table/controllers/utils/getTemplates.js +18 -18
- package/table/funcs/getFilterSQL/util/getTableSql.js +34 -34
- package/test/api/notification.test.js +37 -37
- package/test/api/table.test.js +57 -57
- package/test/api/widget.test.js +114 -114
- package/test/config.example +18 -18
- package/test/funcs/crud.test.js +76 -76
- package/test/funcs/notification.test.js +31 -31
- package/test/funcs/pg.test.js +34 -34
- package/test/funcs/redis.test.js +19 -19
- package/test/templates/cls/test.json +9 -9
- package/test/templates/form/cp_building.form.json +32 -32
- package/test/templates/select/account_id.json +3 -3
- package/test/templates/select/storage.data.json +2 -2
- package/test/templates/table/gis.dataset.table.json +20 -20
- package/util/controllers/next.id.js +4 -4
- package/util/index.js +13 -13
package/cron/funcs/addCron.js
CHANGED
|
@@ -1,131 +1,131 @@
|
|
|
1
|
-
import { createHash } from 'crypto';
|
|
2
|
-
|
|
3
|
-
import cronList from '../controllers/utils/cronList.js';
|
|
4
|
-
import getRedis from '../../redis/funcs/getRedis.js';
|
|
5
|
-
import getPG from '../../pg/funcs/getPG.js';
|
|
6
|
-
|
|
7
|
-
const md5 = (string) => createHash('md5').update(string).digest('hex');
|
|
8
|
-
|
|
9
|
-
async function verifyUnique(name, config, rclient) {
|
|
10
|
-
const cronId = config.port || 3000 + md5(name);
|
|
11
|
-
// one per node check
|
|
12
|
-
const key = `cron:unique:${cronId}`;
|
|
13
|
-
const unique = await rclient.setnx(key, 1);
|
|
14
|
-
const ttl = await rclient.ttl(key);
|
|
15
|
-
if (!unique && ttl !== -1) {
|
|
16
|
-
return false;
|
|
17
|
-
}
|
|
18
|
-
await rclient.expire(key, 20);
|
|
19
|
-
return true;
|
|
20
|
-
}
|
|
21
|
-
|
|
22
|
-
const intervalStringMs = {
|
|
23
|
-
everyMin: 1000 * 60,
|
|
24
|
-
tenMin: 1000 * 60 * 10,
|
|
25
|
-
everyHour: 1000 * 60 * 60,
|
|
26
|
-
isHalfday: 1000 * 60 * 60 * 12,
|
|
27
|
-
dailyHour: 1000 * 60 * 60 * 24,
|
|
28
|
-
};
|
|
29
|
-
|
|
30
|
-
const interval2ms = {
|
|
31
|
-
string: (interval) => {
|
|
32
|
-
const date = new Date();
|
|
33
|
-
const intervarSplit = interval.match(/^(\*{2}|(\*)?(\d{1,2})):(\*(\d)|(\d{2}))/);
|
|
34
|
-
if (!intervarSplit) {
|
|
35
|
-
throw new Error(`interval ${interval} not suported`);
|
|
36
|
-
}
|
|
37
|
-
const [, , isHalfday, dailyHour, , tenMin, HourlyMin] = intervarSplit;
|
|
38
|
-
const intervalMs = (isHalfday && intervalStringMs.isHalfday)
|
|
39
|
-
|| (dailyHour && intervalStringMs.dailyHour)
|
|
40
|
-
|| (tenMin && intervalStringMs.tenMin)
|
|
41
|
-
|| intervalStringMs.everyHour;
|
|
42
|
-
const offsetDay = ((+dailyHour || 0) * 60 + (+tenMin || +HourlyMin)) * 60 * 1000;
|
|
43
|
-
const offsetCur = (date - date.getTimezoneOffset() * 1000 * 60) % intervalMs;
|
|
44
|
-
const waitMs = (offsetDay - offsetCur + intervalMs) % intervalMs;
|
|
45
|
-
return [waitMs, intervalMs];
|
|
46
|
-
},
|
|
47
|
-
number: (interval) => {
|
|
48
|
-
const date = new Date();
|
|
49
|
-
const intervalMs = interval * 1000;
|
|
50
|
-
const dateWithTZ = date - date.getTimezoneOffset() * 1000 * 60;
|
|
51
|
-
const offsetCur = dateWithTZ % intervalMs;
|
|
52
|
-
// start every cron within 1 hour
|
|
53
|
-
const sixtyMinutesStartMs = 3600000;
|
|
54
|
-
const waitMs = (intervalMs - offsetCur) % sixtyMinutesStartMs;
|
|
55
|
-
return [waitMs, intervalMs];
|
|
56
|
-
},
|
|
57
|
-
};
|
|
58
|
-
|
|
59
|
-
async function runCron({
|
|
60
|
-
pg, funcs, func, name, rclient, log,
|
|
61
|
-
}) {
|
|
62
|
-
const unique = await verifyUnique(name, funcs.config, rclient);
|
|
63
|
-
|
|
64
|
-
if (!unique) return;
|
|
65
|
-
const db = pg.options.database;
|
|
66
|
-
log.debug(`cron.${name}`, 1, db);
|
|
67
|
-
try {
|
|
68
|
-
const data = await func({ pg, funcs, log });
|
|
69
|
-
log.debug('cron', { db, name, result: data });
|
|
70
|
-
log.info('cron', { db, name, result: data });
|
|
71
|
-
}
|
|
72
|
-
catch (err) {
|
|
73
|
-
log.debug('cron', { db, name, error: err.toString() });
|
|
74
|
-
log.error('cron', { db, name, error: err.toString() });
|
|
75
|
-
}
|
|
76
|
-
}
|
|
77
|
-
|
|
78
|
-
/**
|
|
79
|
-
* interval:
|
|
80
|
-
* - 02:54 - every day
|
|
81
|
-
* - 2:03 - every day
|
|
82
|
-
* - *1:43 - 2 times a day
|
|
83
|
-
* - *12:03 - 2 times a day
|
|
84
|
-
* - **:54 - every hour
|
|
85
|
-
* - **:*3 - every 10 minutes
|
|
86
|
-
* - 60 - every minute
|
|
87
|
-
* - 10 * 60 - every 10 minutes
|
|
88
|
-
*/
|
|
89
|
-
|
|
90
|
-
export default async function addCron(func, interval, fastify) {
|
|
91
|
-
if (!fastify) {
|
|
92
|
-
throw new Error('not enough params: fastify');
|
|
93
|
-
}
|
|
94
|
-
|
|
95
|
-
const { config = {}, log } = fastify;
|
|
96
|
-
const { time = {}, disabled = [] } = config.cron || {};
|
|
97
|
-
const pg = getPG();
|
|
98
|
-
const rclient = getRedis();
|
|
99
|
-
|
|
100
|
-
const name = func.name || func.toString().split('/').at(-1).split('\'')[0];
|
|
101
|
-
|
|
102
|
-
// if (!config.isServer) return;
|
|
103
|
-
|
|
104
|
-
if (disabled.includes(name)) {
|
|
105
|
-
log.debug('cron', { name, message: 'cron disabled' });
|
|
106
|
-
return;
|
|
107
|
-
}
|
|
108
|
-
|
|
109
|
-
cronList[name] = func;
|
|
110
|
-
|
|
111
|
-
const userInterval = time[name] || interval;
|
|
112
|
-
const [waitMs, intervalMs] = interval2ms[typeof interval](userInterval);
|
|
113
|
-
|
|
114
|
-
if (intervalMs < 1000) {
|
|
115
|
-
log.warn('cron', { name, error: `interval ${interval} to small` });
|
|
116
|
-
return;
|
|
117
|
-
}
|
|
118
|
-
|
|
119
|
-
// setTimeout to w8 for the time to start
|
|
120
|
-
setTimeout(() => {
|
|
121
|
-
runCron({
|
|
122
|
-
pg, funcs: fastify, func, name, rclient, log,
|
|
123
|
-
});
|
|
124
|
-
// interval
|
|
125
|
-
setInterval(() => {
|
|
126
|
-
runCron({
|
|
127
|
-
pg, funcs: fastify, func, name, rclient, log,
|
|
128
|
-
});
|
|
129
|
-
}, intervalMs);
|
|
130
|
-
}, waitMs);
|
|
131
|
-
}
|
|
1
|
+
import { createHash } from 'crypto';
|
|
2
|
+
|
|
3
|
+
import cronList from '../controllers/utils/cronList.js';
|
|
4
|
+
import getRedis from '../../redis/funcs/getRedis.js';
|
|
5
|
+
import getPG from '../../pg/funcs/getPG.js';
|
|
6
|
+
|
|
7
|
+
const md5 = (string) => createHash('md5').update(string).digest('hex');
|
|
8
|
+
|
|
9
|
+
async function verifyUnique(name, config, rclient) {
|
|
10
|
+
const cronId = config.port || 3000 + md5(name);
|
|
11
|
+
// one per node check
|
|
12
|
+
const key = `cron:unique:${cronId}`;
|
|
13
|
+
const unique = await rclient.setnx(key, 1);
|
|
14
|
+
const ttl = await rclient.ttl(key);
|
|
15
|
+
if (!unique && ttl !== -1) {
|
|
16
|
+
return false;
|
|
17
|
+
}
|
|
18
|
+
await rclient.expire(key, 20);
|
|
19
|
+
return true;
|
|
20
|
+
}
|
|
21
|
+
|
|
22
|
+
const intervalStringMs = {
|
|
23
|
+
everyMin: 1000 * 60,
|
|
24
|
+
tenMin: 1000 * 60 * 10,
|
|
25
|
+
everyHour: 1000 * 60 * 60,
|
|
26
|
+
isHalfday: 1000 * 60 * 60 * 12,
|
|
27
|
+
dailyHour: 1000 * 60 * 60 * 24,
|
|
28
|
+
};
|
|
29
|
+
|
|
30
|
+
const interval2ms = {
|
|
31
|
+
string: (interval) => {
|
|
32
|
+
const date = new Date();
|
|
33
|
+
const intervarSplit = interval.match(/^(\*{2}|(\*)?(\d{1,2})):(\*(\d)|(\d{2}))/);
|
|
34
|
+
if (!intervarSplit) {
|
|
35
|
+
throw new Error(`interval ${interval} not suported`);
|
|
36
|
+
}
|
|
37
|
+
const [, , isHalfday, dailyHour, , tenMin, HourlyMin] = intervarSplit;
|
|
38
|
+
const intervalMs = (isHalfday && intervalStringMs.isHalfday)
|
|
39
|
+
|| (dailyHour && intervalStringMs.dailyHour)
|
|
40
|
+
|| (tenMin && intervalStringMs.tenMin)
|
|
41
|
+
|| intervalStringMs.everyHour;
|
|
42
|
+
const offsetDay = ((+dailyHour || 0) * 60 + (+tenMin || +HourlyMin)) * 60 * 1000;
|
|
43
|
+
const offsetCur = (date - date.getTimezoneOffset() * 1000 * 60) % intervalMs;
|
|
44
|
+
const waitMs = (offsetDay - offsetCur + intervalMs) % intervalMs;
|
|
45
|
+
return [waitMs, intervalMs];
|
|
46
|
+
},
|
|
47
|
+
number: (interval) => {
|
|
48
|
+
const date = new Date();
|
|
49
|
+
const intervalMs = interval * 1000;
|
|
50
|
+
const dateWithTZ = date - date.getTimezoneOffset() * 1000 * 60;
|
|
51
|
+
const offsetCur = dateWithTZ % intervalMs;
|
|
52
|
+
// start every cron within 1 hour
|
|
53
|
+
const sixtyMinutesStartMs = 3600000;
|
|
54
|
+
const waitMs = (intervalMs - offsetCur) % sixtyMinutesStartMs;
|
|
55
|
+
return [waitMs, intervalMs];
|
|
56
|
+
},
|
|
57
|
+
};
|
|
58
|
+
|
|
59
|
+
async function runCron({
|
|
60
|
+
pg, funcs, func, name, rclient, log,
|
|
61
|
+
}) {
|
|
62
|
+
const unique = await verifyUnique(name, funcs.config, rclient);
|
|
63
|
+
|
|
64
|
+
if (!unique) return;
|
|
65
|
+
const db = pg.options.database;
|
|
66
|
+
log.debug(`cron.${name}`, 1, db);
|
|
67
|
+
try {
|
|
68
|
+
const data = await func({ pg, funcs, log });
|
|
69
|
+
log.debug('cron', { db, name, result: data });
|
|
70
|
+
log.info('cron', { db, name, result: data });
|
|
71
|
+
}
|
|
72
|
+
catch (err) {
|
|
73
|
+
log.debug('cron', { db, name, error: err.toString() });
|
|
74
|
+
log.error('cron', { db, name, error: err.toString() });
|
|
75
|
+
}
|
|
76
|
+
}
|
|
77
|
+
|
|
78
|
+
/**
|
|
79
|
+
* interval:
|
|
80
|
+
* - 02:54 - every day
|
|
81
|
+
* - 2:03 - every day
|
|
82
|
+
* - *1:43 - 2 times a day
|
|
83
|
+
* - *12:03 - 2 times a day
|
|
84
|
+
* - **:54 - every hour
|
|
85
|
+
* - **:*3 - every 10 minutes
|
|
86
|
+
* - 60 - every minute
|
|
87
|
+
* - 10 * 60 - every 10 minutes
|
|
88
|
+
*/
|
|
89
|
+
|
|
90
|
+
export default async function addCron(func, interval, fastify) {
|
|
91
|
+
if (!fastify) {
|
|
92
|
+
throw new Error('not enough params: fastify');
|
|
93
|
+
}
|
|
94
|
+
|
|
95
|
+
const { config = {}, log } = fastify;
|
|
96
|
+
const { time = {}, disabled = [] } = config.cron || {};
|
|
97
|
+
const pg = getPG();
|
|
98
|
+
const rclient = getRedis();
|
|
99
|
+
|
|
100
|
+
const name = func.name || func.toString().split('/').at(-1).split('\'')[0];
|
|
101
|
+
|
|
102
|
+
// if (!config.isServer) return;
|
|
103
|
+
|
|
104
|
+
if (disabled.includes(name)) {
|
|
105
|
+
log.debug('cron', { name, message: 'cron disabled' });
|
|
106
|
+
return;
|
|
107
|
+
}
|
|
108
|
+
|
|
109
|
+
cronList[name] = func;
|
|
110
|
+
|
|
111
|
+
const userInterval = time[name] || interval;
|
|
112
|
+
const [waitMs, intervalMs] = interval2ms[typeof interval](userInterval);
|
|
113
|
+
|
|
114
|
+
if (intervalMs < 1000) {
|
|
115
|
+
log.warn('cron', { name, error: `interval ${interval} to small` });
|
|
116
|
+
return;
|
|
117
|
+
}
|
|
118
|
+
|
|
119
|
+
// setTimeout to w8 for the time to start
|
|
120
|
+
setTimeout(() => {
|
|
121
|
+
runCron({
|
|
122
|
+
pg, funcs: fastify, func, name, rclient, log,
|
|
123
|
+
});
|
|
124
|
+
// interval
|
|
125
|
+
setInterval(() => {
|
|
126
|
+
runCron({
|
|
127
|
+
pg, funcs: fastify, func, name, rclient, log,
|
|
128
|
+
});
|
|
129
|
+
}, intervalMs);
|
|
130
|
+
}, waitMs);
|
|
131
|
+
}
|
package/cron/index.js
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
|
-
import cronApi from './controllers/cronApi.js';
|
|
2
|
-
import addCron from './funcs/addCron.js';
|
|
3
|
-
|
|
4
|
-
async function plugin(fastify, config = {}) {
|
|
5
|
-
const prefix = config.prefix || '/api';
|
|
6
|
-
fastify.decorate('addCron', addCron);
|
|
7
|
-
fastify.get(`${prefix}/cron/:name`, {}, cronApi);
|
|
8
|
-
}
|
|
9
|
-
|
|
10
|
-
export default plugin;
|
|
1
|
+
import cronApi from './controllers/cronApi.js';
|
|
2
|
+
import addCron from './funcs/addCron.js';
|
|
3
|
+
|
|
4
|
+
async function plugin(fastify, config = {}) {
|
|
5
|
+
const prefix = config.prefix || '/api';
|
|
6
|
+
fastify.decorate('addCron', addCron);
|
|
7
|
+
fastify.get(`${prefix}/cron/:name`, {}, cronApi);
|
|
8
|
+
}
|
|
9
|
+
|
|
10
|
+
export default plugin;
|
|
@@ -1,45 +1,45 @@
|
|
|
1
|
-
/* import sqlInjection from '../../../policy/funcs/sqlInjection.js'; */
|
|
2
|
-
import xssInjection from './xssInjection.js';
|
|
3
|
-
|
|
4
|
-
/* const checkList = xssInjection.concat(sqlInjection); */
|
|
5
|
-
|
|
6
|
-
// RTE - rich text editor
|
|
7
|
-
|
|
8
|
-
function checkXSS({ body, schema = {} }) {
|
|
9
|
-
const data = typeof body === 'string' ? body : JSON.stringify(body);
|
|
10
|
-
const stopWords = xssInjection.filter((el) => data.toLowerCase().includes(el));
|
|
11
|
-
|
|
12
|
-
// check sql injection
|
|
13
|
-
const stopSpecialSymbols = data.match(/\p{S}OR\p{S}|\p{P}OR\p{P}| OR |\+OR\+/gi);
|
|
14
|
-
if (stopSpecialSymbols?.length) stopSpecialSymbols?.forEach((el) => stopWords.push(el));
|
|
15
|
-
|
|
16
|
-
// escape arrows on non-RTE
|
|
17
|
-
Object.keys(body)
|
|
18
|
-
.filter((key) => ['<', '>'].find((el) => body[key]?.includes?.(el))
|
|
19
|
-
&& !['Summernote', 'Tiny', 'Ace'].includes(schema[key]?.type))
|
|
20
|
-
?.forEach((key) => {
|
|
21
|
-
Object.assign(body, { [key]: body[key].replace(/</g, '<').replace(/>/g, '>') });
|
|
22
|
-
});
|
|
23
|
-
// try { } catch (err) { return { error: err.toString() }; }
|
|
24
|
-
|
|
25
|
-
if (!stopWords.length) return { body };
|
|
26
|
-
|
|
27
|
-
const disabledCheckFields = Object.keys(schema)?.filter((el) => schema[el]?.xssCheck === false); // exclude specific columns
|
|
28
|
-
|
|
29
|
-
// check RTE
|
|
30
|
-
/* const richTextFields = Object.keys(schema).filter((el) => ['Summernote', 'Tiny', 'Ace'].includes(schema[el]?.type));
|
|
31
|
-
richTextFields.filter((key) => !checkList.find((el) => body[key].includes(el)))?.forEach((key) => {
|
|
32
|
-
disabledCheckFields.push(key);
|
|
33
|
-
}); */
|
|
34
|
-
|
|
35
|
-
const field = Object.keys(body)
|
|
36
|
-
?.find((key) => body[key]
|
|
37
|
-
&& !disabledCheckFields.includes(key)
|
|
38
|
-
&& body[key].toLowerCase().includes(stopWords[0]));
|
|
39
|
-
if (field) {
|
|
40
|
-
return { error: `rule: ${stopWords[0]} | attr: ${field} | val: ${body[field]}`, body };
|
|
41
|
-
}
|
|
42
|
-
return { body };
|
|
43
|
-
}
|
|
44
|
-
|
|
45
|
-
export default checkXSS;
|
|
1
|
+
/* import sqlInjection from '../../../policy/funcs/sqlInjection.js'; */
|
|
2
|
+
import xssInjection from './xssInjection.js';
|
|
3
|
+
|
|
4
|
+
/* const checkList = xssInjection.concat(sqlInjection); */
|
|
5
|
+
|
|
6
|
+
// RTE - rich text editor
|
|
7
|
+
|
|
8
|
+
function checkXSS({ body, schema = {} }) {
|
|
9
|
+
const data = typeof body === 'string' ? body : JSON.stringify(body);
|
|
10
|
+
const stopWords = xssInjection.filter((el) => data.toLowerCase().includes(el));
|
|
11
|
+
|
|
12
|
+
// check sql injection
|
|
13
|
+
const stopSpecialSymbols = data.match(/\p{S}OR\p{S}|\p{P}OR\p{P}| OR |\+OR\+/gi);
|
|
14
|
+
if (stopSpecialSymbols?.length) stopSpecialSymbols?.forEach((el) => stopWords.push(el));
|
|
15
|
+
|
|
16
|
+
// escape arrows on non-RTE
|
|
17
|
+
Object.keys(body)
|
|
18
|
+
.filter((key) => ['<', '>'].find((el) => body[key]?.includes?.(el))
|
|
19
|
+
&& !['Summernote', 'Tiny', 'Ace'].includes(schema[key]?.type))
|
|
20
|
+
?.forEach((key) => {
|
|
21
|
+
Object.assign(body, { [key]: body[key].replace(/</g, '<').replace(/>/g, '>') });
|
|
22
|
+
});
|
|
23
|
+
// try { } catch (err) { return { error: err.toString() }; }
|
|
24
|
+
|
|
25
|
+
if (!stopWords.length) return { body };
|
|
26
|
+
|
|
27
|
+
const disabledCheckFields = Object.keys(schema)?.filter((el) => schema[el]?.xssCheck === false); // exclude specific columns
|
|
28
|
+
|
|
29
|
+
// check RTE
|
|
30
|
+
/* const richTextFields = Object.keys(schema).filter((el) => ['Summernote', 'Tiny', 'Ace'].includes(schema[el]?.type));
|
|
31
|
+
richTextFields.filter((key) => !checkList.find((el) => body[key].includes(el)))?.forEach((key) => {
|
|
32
|
+
disabledCheckFields.push(key);
|
|
33
|
+
}); */
|
|
34
|
+
|
|
35
|
+
const field = Object.keys(body)
|
|
36
|
+
?.find((key) => body[key]
|
|
37
|
+
&& !disabledCheckFields.includes(key)
|
|
38
|
+
&& body[key].toLowerCase().includes(stopWords[0]));
|
|
39
|
+
if (field) {
|
|
40
|
+
return { error: `rule: ${stopWords[0]} | attr: ${field} | val: ${body[field]}`, body };
|
|
41
|
+
}
|
|
42
|
+
return { body };
|
|
43
|
+
}
|
|
44
|
+
|
|
45
|
+
export default checkXSS;
|
|
@@ -1,72 +1,72 @@
|
|
|
1
|
-
const xssInjection = [
|
|
2
|
-
'onkeypress=',
|
|
3
|
-
'onkeyup=',
|
|
4
|
-
'ondblclick=',
|
|
5
|
-
'onerror=',
|
|
6
|
-
'onmouseover=',
|
|
7
|
-
'<meta',
|
|
8
|
-
'<script',
|
|
9
|
-
'vascript:',
|
|
10
|
-
'onkeydown=',
|
|
11
|
-
'onmousedown=',
|
|
12
|
-
'onmouseenter=',
|
|
13
|
-
'onmouseleave=',
|
|
14
|
-
'onmousemove=',
|
|
15
|
-
'onmouseout=',
|
|
16
|
-
'onmouseup=',
|
|
17
|
-
'onmousewheel=',
|
|
18
|
-
'onpaste=',
|
|
19
|
-
'onscroll=',
|
|
20
|
-
'onwheel=',
|
|
21
|
-
'javascript:',
|
|
22
|
-
'\\x',
|
|
23
|
-
'eval(',
|
|
24
|
-
'onmouseover=',
|
|
25
|
-
'action=',
|
|
26
|
-
'xlink:',
|
|
27
|
-
'allowscriptaccess',
|
|
28
|
-
'href=',
|
|
29
|
-
'behavior:',
|
|
30
|
-
'onreadystatechange=',
|
|
31
|
-
'onstart=',
|
|
32
|
-
'offline=',
|
|
33
|
-
'onabort=',
|
|
34
|
-
'onafterprint=',
|
|
35
|
-
'onbeforeonload=',
|
|
36
|
-
'onbeforeprint=',
|
|
37
|
-
'onblur=',
|
|
38
|
-
'oncanplay=',
|
|
39
|
-
'oncanplaythrough=',
|
|
40
|
-
'onchange=',
|
|
41
|
-
'onclick=',
|
|
42
|
-
'oncontextmenu=',
|
|
43
|
-
'ondblclick=',
|
|
44
|
-
'ondrag=',
|
|
45
|
-
'ondragend=',
|
|
46
|
-
'ondragenter=',
|
|
47
|
-
'ondragleave=',
|
|
48
|
-
'ondragover=',
|
|
49
|
-
'ondragstart=',
|
|
50
|
-
'ondrop=',
|
|
51
|
-
'ondurationchange=',
|
|
52
|
-
'onemptied=',
|
|
53
|
-
'onended=',
|
|
54
|
-
'onerror=',
|
|
55
|
-
'onfocus=',
|
|
56
|
-
'onformchange=',
|
|
57
|
-
'onforminput=',
|
|
58
|
-
'onhaschange=',
|
|
59
|
-
'oninput=',
|
|
60
|
-
'oninvalid=',
|
|
61
|
-
'onkeydown=',
|
|
62
|
-
'onkeypress=',
|
|
63
|
-
'onkeyup=',
|
|
64
|
-
'onload=',
|
|
65
|
-
'onloadeddata=',
|
|
66
|
-
'onloadedmetadata=',
|
|
67
|
-
'onloadstart=',
|
|
68
|
-
'alert(',
|
|
69
|
-
'script:',
|
|
70
|
-
];
|
|
71
|
-
|
|
72
|
-
export default xssInjection;
|
|
1
|
+
const xssInjection = [
|
|
2
|
+
'onkeypress=',
|
|
3
|
+
'onkeyup=',
|
|
4
|
+
'ondblclick=',
|
|
5
|
+
'onerror=',
|
|
6
|
+
'onmouseover=',
|
|
7
|
+
'<meta',
|
|
8
|
+
'<script',
|
|
9
|
+
'vascript:',
|
|
10
|
+
'onkeydown=',
|
|
11
|
+
'onmousedown=',
|
|
12
|
+
'onmouseenter=',
|
|
13
|
+
'onmouseleave=',
|
|
14
|
+
'onmousemove=',
|
|
15
|
+
'onmouseout=',
|
|
16
|
+
'onmouseup=',
|
|
17
|
+
'onmousewheel=',
|
|
18
|
+
'onpaste=',
|
|
19
|
+
'onscroll=',
|
|
20
|
+
'onwheel=',
|
|
21
|
+
'javascript:',
|
|
22
|
+
'\\x',
|
|
23
|
+
'eval(',
|
|
24
|
+
'onmouseover=',
|
|
25
|
+
'action=',
|
|
26
|
+
'xlink:',
|
|
27
|
+
'allowscriptaccess',
|
|
28
|
+
'href=',
|
|
29
|
+
'behavior:',
|
|
30
|
+
'onreadystatechange=',
|
|
31
|
+
'onstart=',
|
|
32
|
+
'offline=',
|
|
33
|
+
'onabort=',
|
|
34
|
+
'onafterprint=',
|
|
35
|
+
'onbeforeonload=',
|
|
36
|
+
'onbeforeprint=',
|
|
37
|
+
'onblur=',
|
|
38
|
+
'oncanplay=',
|
|
39
|
+
'oncanplaythrough=',
|
|
40
|
+
'onchange=',
|
|
41
|
+
'onclick=',
|
|
42
|
+
'oncontextmenu=',
|
|
43
|
+
'ondblclick=',
|
|
44
|
+
'ondrag=',
|
|
45
|
+
'ondragend=',
|
|
46
|
+
'ondragenter=',
|
|
47
|
+
'ondragleave=',
|
|
48
|
+
'ondragover=',
|
|
49
|
+
'ondragstart=',
|
|
50
|
+
'ondrop=',
|
|
51
|
+
'ondurationchange=',
|
|
52
|
+
'onemptied=',
|
|
53
|
+
'onended=',
|
|
54
|
+
'onerror=',
|
|
55
|
+
'onfocus=',
|
|
56
|
+
'onformchange=',
|
|
57
|
+
'onforminput=',
|
|
58
|
+
'onhaschange=',
|
|
59
|
+
'oninput=',
|
|
60
|
+
'oninvalid=',
|
|
61
|
+
'onkeydown=',
|
|
62
|
+
'onkeypress=',
|
|
63
|
+
'onkeyup=',
|
|
64
|
+
'onload=',
|
|
65
|
+
'onloadeddata=',
|
|
66
|
+
'onloadedmetadata=',
|
|
67
|
+
'onloadstart=',
|
|
68
|
+
'alert(',
|
|
69
|
+
'script:',
|
|
70
|
+
];
|
|
71
|
+
|
|
72
|
+
export default xssInjection;
|
|
@@ -1,13 +1,13 @@
|
|
|
1
|
-
import { access } from 'fs/promises';
|
|
2
|
-
|
|
3
|
-
const isFileExists = async (filepath) => {
|
|
4
|
-
try {
|
|
5
|
-
await access(filepath);
|
|
6
|
-
return true;
|
|
7
|
-
}
|
|
8
|
-
catch (err) {
|
|
9
|
-
return false;
|
|
10
|
-
}
|
|
11
|
-
};
|
|
12
|
-
|
|
13
|
-
export default isFileExists;
|
|
1
|
+
import { access } from 'fs/promises';
|
|
2
|
+
|
|
3
|
+
const isFileExists = async (filepath) => {
|
|
4
|
+
try {
|
|
5
|
+
await access(filepath);
|
|
6
|
+
return true;
|
|
7
|
+
}
|
|
8
|
+
catch (err) {
|
|
9
|
+
return false;
|
|
10
|
+
}
|
|
11
|
+
};
|
|
12
|
+
|
|
13
|
+
export default isFileExists;
|
package/crud/funcs/setToken.js
CHANGED
|
@@ -1,53 +1,53 @@
|
|
|
1
|
-
import { createHash, randomUUID } from 'crypto';
|
|
2
|
-
|
|
3
|
-
import config from '../../config.js';
|
|
4
|
-
import getRedis from '../../redis/funcs/getRedis.js';
|
|
5
|
-
|
|
6
|
-
const generateCodes = (ids, userToken) => {
|
|
7
|
-
const token = userToken || randomUUID();
|
|
8
|
-
const notNullIds = ids.filter((el) => el);
|
|
9
|
-
const obj = {};
|
|
10
|
-
const codes = notNullIds.reduce((acc, id) => {
|
|
11
|
-
const newToken = createHash('sha1').update(token + id).digest('base64url').replace(/-/g, '');
|
|
12
|
-
acc[newToken] = id; obj[id] = newToken;
|
|
13
|
-
return acc;
|
|
14
|
-
}, {});
|
|
15
|
-
return { codes, obj };
|
|
16
|
-
};
|
|
17
|
-
|
|
18
|
-
function setToken({
|
|
19
|
-
ids: idsOrigin, mode = 'r', uid, referer, array,
|
|
20
|
-
}) {
|
|
21
|
-
const rclient2 = getRedis({ db: 0 });
|
|
22
|
-
// const rclient5 = getRedis({ db: 0, funcs });
|
|
23
|
-
|
|
24
|
-
if (!uid) return { user: 'empty' };
|
|
25
|
-
if (!Object.keys(idsOrigin).length) return { ids: 'empty' };
|
|
26
|
-
|
|
27
|
-
const ids = idsOrigin.map((el) => (typeof el === 'object' ? JSON.stringify(el) : el));
|
|
28
|
-
// update/delete
|
|
29
|
-
|
|
30
|
-
if (mode === 'r') return null;
|
|
31
|
-
|
|
32
|
-
// TODO generate salt
|
|
33
|
-
const { codes, obj } = generateCodes(ids, uid);
|
|
34
|
-
|
|
35
|
-
if (!Object.keys(codes).length) return { ids: 'empty' };
|
|
36
|
-
|
|
37
|
-
rclient2.hmset(`${config.pg.database}:token:${{
|
|
38
|
-
e: 'exec', r: 'view', w: 'edit', a: 'add',
|
|
39
|
-
}[mode]}:${uid}`, codes);
|
|
40
|
-
|
|
41
|
-
// log token for debug. add extra data - uid, mode, date
|
|
42
|
-
/* const dt = new Date().toISOString();
|
|
43
|
-
const codesLog = Object.keys(codes).reduce((acc, key) => {
|
|
44
|
-
acc[key] = `{"referer": "${referer}" ,"uid":"${uid}","mode":"${mode}","date":"${dt}",${codes[key].substr(1)}`;
|
|
45
|
-
return acc;
|
|
46
|
-
}, {});
|
|
47
|
-
rclient5.hmset(`${config.pg.database}:token:edit`, codesLog); // 'EX', 64800 */
|
|
48
|
-
|
|
49
|
-
// TODO дополнительно писать в hset token -> uid
|
|
50
|
-
return array ? Object.values(obj) : obj;
|
|
51
|
-
}
|
|
52
|
-
|
|
53
|
-
export default setToken;
|
|
1
|
+
import { createHash, randomUUID } from 'crypto';
|
|
2
|
+
|
|
3
|
+
import config from '../../config.js';
|
|
4
|
+
import getRedis from '../../redis/funcs/getRedis.js';
|
|
5
|
+
|
|
6
|
+
const generateCodes = (ids, userToken) => {
|
|
7
|
+
const token = userToken || randomUUID();
|
|
8
|
+
const notNullIds = ids.filter((el) => el);
|
|
9
|
+
const obj = {};
|
|
10
|
+
const codes = notNullIds.reduce((acc, id) => {
|
|
11
|
+
const newToken = createHash('sha1').update(token + id).digest('base64url').replace(/-/g, '');
|
|
12
|
+
acc[newToken] = id; obj[id] = newToken;
|
|
13
|
+
return acc;
|
|
14
|
+
}, {});
|
|
15
|
+
return { codes, obj };
|
|
16
|
+
};
|
|
17
|
+
|
|
18
|
+
function setToken({
|
|
19
|
+
ids: idsOrigin, mode = 'r', uid, referer, array,
|
|
20
|
+
}) {
|
|
21
|
+
const rclient2 = getRedis({ db: 0 });
|
|
22
|
+
// const rclient5 = getRedis({ db: 0, funcs });
|
|
23
|
+
|
|
24
|
+
if (!uid) return { user: 'empty' };
|
|
25
|
+
if (!Object.keys(idsOrigin).length) return { ids: 'empty' };
|
|
26
|
+
|
|
27
|
+
const ids = idsOrigin.map((el) => (typeof el === 'object' ? JSON.stringify(el) : el));
|
|
28
|
+
// update/delete
|
|
29
|
+
|
|
30
|
+
if (mode === 'r') return null;
|
|
31
|
+
|
|
32
|
+
// TODO generate salt
|
|
33
|
+
const { codes, obj } = generateCodes(ids, uid);
|
|
34
|
+
|
|
35
|
+
if (!Object.keys(codes).length) return { ids: 'empty' };
|
|
36
|
+
|
|
37
|
+
rclient2.hmset(`${config.pg.database}:token:${{
|
|
38
|
+
e: 'exec', r: 'view', w: 'edit', a: 'add',
|
|
39
|
+
}[mode]}:${uid}`, codes);
|
|
40
|
+
|
|
41
|
+
// log token for debug. add extra data - uid, mode, date
|
|
42
|
+
/* const dt = new Date().toISOString();
|
|
43
|
+
const codesLog = Object.keys(codes).reduce((acc, key) => {
|
|
44
|
+
acc[key] = `{"referer": "${referer}" ,"uid":"${uid}","mode":"${mode}","date":"${dt}",${codes[key].substr(1)}`;
|
|
45
|
+
return acc;
|
|
46
|
+
}, {});
|
|
47
|
+
rclient5.hmset(`${config.pg.database}:token:edit`, codesLog); // 'EX', 64800 */
|
|
48
|
+
|
|
49
|
+
// TODO дополнительно писать в hset token -> uid
|
|
50
|
+
return array ? Object.values(obj) : obj;
|
|
51
|
+
}
|
|
52
|
+
|
|
53
|
+
export default setToken;
|