@opengis/fastify-table 1.1.45 → 1.1.46

package/Changelog.md

@@ -1,6 +1,6 @@
 # fastify-table
 
-## 1.1.45 - 22.10.2024
+## 1.1.46 - 22.10.2024
 
 - addHook params refactor
 - add handlebars to utils

package/crud/controllers/utils/checkXSS.js

@@ -16,15 +16,16 @@ function checkXSS({ body, schema = {} }) {
   // escape arrows on non-RTE
   Object.keys(body)
     .filter((key) => ['<', '>'].find((el) => body[key]?.includes?.(el))
-  && !['Summernote', 'Tiny', 'Ace'].includes(schema[key]?.type))
+  && !['Summernote', 'Tiny', 'Ace'].includes(schema?.[key]?.type))
     ?.forEach((key) => {
       Object.assign(body, { [key]: body[key].replace(/</g, '&lt;').replace(/>/g, '&gt;') });
     });
+
   // try { } catch (err) { return { error: err.toString() }; }
 
   if (!stopWords.length) return { body };
 
-  const disabledCheckFields = Object.keys(schema)?.filter((el) => schema[el]?.xssCheck === false); // exclude specific columns
+  const disabledCheckFields = Object.keys(schema || {})?.filter((el) => schema?.[el]?.xssCheck === false); // exclude specific columns
 
   // check RTE
   /* const richTextFields = Object.keys(schema).filter((el) => ['Summernote', 'Tiny', 'Ace'].includes(schema[el]?.type));

package/crud/funcs/getAccess.js

@@ -23,17 +23,16 @@ export default async function getAccess({ table, id, user }) {
   const { client: pg } = pgClients || {};
   const { uid, user_type: userType } = user || {};
 
-  if (!uid || !table) return null;
-
-  if (!pg.pk?.['admin.access']) return null;
+  if (!table || !pg.pk?.['admin.access']) return null;
 
   const body = await getTemplate('table', table) || {};
-  if (!body?.table) return null;
 
   if (config.auth?.disable || user?.user_type?.includes('admin') || body?.public) {
     return { actions: ['get', 'edit', 'del'], my: true, query: '1=1' };
   }
 
+  if (!uid || !body?.table) return null;
+
   const { scope = 'my', actions = [] } = await pg.query(q, [table, uid]).then((res) => res.rows?.[0] || {});
 
   const { columns = [] } = await getMeta({ table: body?.table });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/fastify-table",
-  "version": "1.1.45",
+  "version": "1.1.46",
   "type": "module",
   "description": "core-plugins",
   "main": "index.js",

package/test/api/crud.xss.test.js

@@ -4,7 +4,22 @@ import assert from 'node:assert';
 import build from '../../helper.js';
 
 import setToken from '../../crud/funcs/setToken.js';
+import getToken from '../../crud/funcs/getToken.js';
+import addHook from '../../hook/funcs/addHook.js';
 import config from '../config.js';
+import pgClients from '../../pg/pgClients.js';
+
+addHook('preInsert', async ({ table }) => getToken({
+  mode: 'a', token: table, uid: '1', json: 1,
+}));
+
+addHook('preUpdate', async ({ table }) => getToken({
+  mode: 'w', token: table, uid: '1', json: 1,
+}));
+
+addHook('preDelete', async ({ table }) => getToken({
+  mode: 'w', token: table, uid: '1', json: 1,
+}));
 
 test('api crud xss', async (t) => {
   const app = await build(t);
@@ -13,52 +28,53 @@ test('api crud xss', async (t) => {
     req.session = session;
     req.user = session.passport.user;
   });
-  // app.decorateRequest('session', session);
 
+  const id = 'test';
   const prefix = config.prefix || '/api';
 
-  let addTokens;
-  let editTokens;
-
-  // before
-  t.test('setToken', async () => {
-    addTokens = setToken({
-      ids: [JSON.stringify({ table: 'gis.dataset', form: 'test.dataset.form' })],
+  await t.test('POST /insert', async () => {
+    const addTokens = setToken({
+      ids: [JSON.stringify({ table: 'test.rest_zone.table', form: 'rest_zone.form' })],
       mode: 'a',
       uid: 1,
       array: 1,
     });
-    editTokens = setToken({
-      ids: [JSON.stringify({ id: '5400000', table: 'gis.dataset', form: 'test.dataset.form' })],
-      mode: 'w',
-      uid: 1,
-      array: 1,
-    });
-    assert.ok(addTokens.length === 1 && editTokens.length === 1, 'invalid token');
-  });
-
-  await t.test('POST /insert', async () => {
+    assert.ok(addTokens.length, 'invalid token');
     const res = await app.inject({
       method: 'POST',
       url: `${prefix}/table/${addTokens[0]}`,
-      body: { dataset_name: '<a onClick="alert("XSS Injection")">xss injection</a>', dataset_id: '5400000' },
+      body: { rz_id: 'test', composition: '<a onClick="alert("XSS Injection")">xss injection</a>' },
     });
     assert.equal(res?.json()?.status || res?.statusCode, 409);
   });
 
+  const editTokens = setToken({
+    ids: [JSON.stringify({ id, table: 'test.rest_zone.table', form: 'rest_zone.form' })],
+    mode: 'w',
+    uid: 1,
+    array: 1,
+  });
+
   await t.test('PUT /update', async () => {
     const res = await app.inject({
       method: 'PUT',
-      url: `${prefix}/table/${editTokens[0]}/${editTokens[0]}`,
-      body: { editor_id: '11', dataset_name: '<a onClick="alert("XSS Injection")">xss injection</a>' },
+      url: `${prefix}/table/${editTokens[0]}`,
+      body: { editor_id: '11', composition: '<a onClick="alert("XSS Injection")">xss injection</a>' },
     });
     assert.equal(res.json()?.status || res?.statusCode, 409);
   });
   await t.test('DELETE /delete', async () => {
     const res = await app.inject({
       method: 'DELETE',
-      url: `${prefix}/table/gis.dataset/5400000`,
+      url: `${prefix}/table/${editTokens[0]}`,
     });
     assert.equal(res?.json()?.status || res?.statusCode, 200);
   });
+
+  // after
+  await t.test('clean up', async () => {
+    const { rowCount } = await pgClients.client.query('delete from itree.rest_zones where composition::text ilike \'%xss injection%\'');
+    const { rowCount: testRows } = await pgClients.client.query('delete from itree.rest_zones where rz_id=\'test\'');
+    console.log('clean up', rowCount, testRows);
+  });
 });