@reldens/server-utils 0.16.0 → 0.18.0

package/lib/app-server-factory.js

@@ -51,6 +51,23 @@ class AppServerFactory
         this.tooManyRequestsMessage = 'Too many requests, please try again later.';
         this.error = {};
         this.processErrorResponse = false;
+        this.port = 3000;
+        this.autoListen = false;
+        this.domains = [];
+        this.useVirtualHosts = false;
+        this.defaultDomain = '';
+        this.maxRequestSize = '10mb';
+        this.sanitizeOptions = {allowedTags: [], allowedAttributes: {}};
+        this.staticOptions = {
+            maxAge: '1d',
+            etag: true,
+            lastModified: true,
+            index: false,
+            setHeaders: function(res){
+                res.set('X-Content-Type-Options', 'nosniff');
+                res.set('X-Frame-Options', 'DENY');
+            }
+        };
     }
 
     createAppServer(appServerConfig)
@@ -61,6 +78,9 @@ class AppServerFactory
         if(this.useHelmet){
             this.app.use(this.helmetConfig ? helmet(this.helmetConfig) : helmet());
         }
+        if(this.useVirtualHosts){
+            this.setupVirtualHosts();
+        }
         if(this.useCors){
             let corsOptions = {
                 origin: this.corsOrigin,
@@ -89,12 +109,8 @@ class AppServerFactory
                 if(!req.body){
                     return next();
                 }
-                if(typeof req.body === 'object'){
-                    for(let key in req.body){
-                        if(typeof req.body[key] === 'string'){
-                            req.body[key] = sanitizeHtml(req.body[key]);
-                        }
-                    }
+                if('object' === typeof req.body){
+                    this.sanitizeRequestBody(req.body);
                 }
                 next();
             });
@@ -102,7 +118,7 @@ class AppServerFactory
         if(this.useExpressJson){
             this.app.use(this.applicationFramework.json({
                 limit: this.jsonLimit,
-                verify: this.verifyContentTypeJson
+                verify: this.verifyContentTypeJson.bind(this)
             }));
         }
         if(this.useUrlencoded){
@@ -115,20 +131,90 @@ class AppServerFactory
             this.app.enable('trust proxy', this.trustedProxy);
         }
         this.appServer = this.createServer();
+        if(!this.appServer){
+            this.error = {message: 'Failed to create app server'};
+            return false;
+        }
+        if(this.autoListen){
+            this.listen();
+        }
         return {app: this.app, appServer: this.appServer};
     }
 
+    sanitizeRequestBody(body)
+    {
+        let bodyKeys = Object.keys(body);
+        for(let i = 0; i < bodyKeys.length; i++){
+            let key = bodyKeys[i];
+            if('string' === typeof body[key]){
+                body[key] = sanitizeHtml(body[key], this.sanitizeOptions);
+                continue;
+            }
+            if('object' === typeof body[key] && null !== body[key]){
+                this.sanitizeRequestBody(body[key]);
+            }
+        }
+    }
+
     verifyContentTypeJson(req, res, buf)
     {
         let contentType = req.headers['content-type'] || '';
         if(
-            req.method === 'POST'
+            'POST' === req.method
             && 0 < buf.length
             && !contentType.includes('application/json')
             && !contentType.includes('multipart/form-data')
         ){
-            throw new Error('Invalid content-type');
+            this.error = {message: 'Invalid content-type for JSON request'};
+            return false;
+        }
+    }
+
+    setupVirtualHosts()
+    {
+        if(0 === this.domains.length){
+            return;
+        }
+        this.app.use((req, res, next) => {
+            let hostname = req.get('host');
+            if(!hostname){
+                if(this.defaultDomain){
+                    req.domain = this.defaultDomain;
+                    return next();
+                }
+                this.error = {message: 'No hostname provided and no default domain configured'};
+                return res.status(400).send('Bad Request');
+            }
+            let domain = this.findDomainConfig(hostname);
+            if(!domain){
+                if(this.defaultDomain){
+                    req.domain = this.defaultDomain;
+                    return next();
+                }
+                this.error = {message: 'Unknown domain: ' + hostname};
+                return res.status(404).send('Domain not found');
+            }
+            req.domain = domain;
+            next();
+        });
+    }
+
+    findDomainConfig(hostname)
+    {
+        if(!hostname || 'string' !== typeof hostname){
+            return false;
+        }
+        let cleanHostname = hostname.toLowerCase().trim();
+        for(let i = 0; i < this.domains.length; i++){
+            let domain = this.domains[i];
+            if(domain.hostname === cleanHostname){
+                return domain;
+            }
+            if(domain.aliases && domain.aliases.includes(cleanHostname)){
+                return domain;
+            }
         }
+        return false;
     }
 
     createServer()
@@ -136,19 +222,25 @@ class AppServerFactory
         if(!this.useHttps){
             return http.createServer(this.app);
         }
+        if(this.useVirtualHosts && 0 < this.domains.length){
+            return this.createHttpsServerWithSNI();
+        }
+        return this.createSingleHttpsServer();
+    }
+
+    createSingleHttpsServer()
+    {
         let key = FileHandler.readFile(this.keyPath, 'Key');
         if(!key){
+            this.error = {message: 'Could not read SSL key file: ' + this.keyPath};
             return false;
         }
         let cert = FileHandler.readFile(this.certPath, 'Cert');
         if(!cert){
+            this.error = {message: 'Could not read SSL certificate file: ' + this.certPath};
             return false;
         }
-        let credentials = {
-            key: key.toString(),
-            cert: cert.toString(),
-            passphrase: this.passphrase
-        };
+        let credentials = {key, cert, passphrase: this.passphrase};
         if('' !== this.httpsChain){
             let ca = FileHandler.readFile(this.httpsChain, 'Certificate Authority');
             if(ca){
@@ -158,6 +250,60 @@ class AppServerFactory
         return https.createServer(credentials, this.app);
     }
 
+    createHttpsServerWithSNI()
+    {
+        let defaultCredentials = this.loadDefaultCredentials();
+        if(!defaultCredentials){
+            return false;
+        }
+        let httpsOptions = Object.assign({}, defaultCredentials);
+        httpsOptions.SNICallback = (hostname, callback) => {
+            let domain = this.findDomainConfig(hostname);
+            if(!domain || !domain.keyPath || !domain.certPath){
+                return callback(null, null);
+            }
+            let key = FileHandler.readFile(domain.keyPath, 'Domain Key');
+            if(!key){
+                this.error = {message: 'Could not read domain SSL key: '+domain.keyPath};
+                return callback(null, null);
+            }
+            let cert = FileHandler.readFile(domain.certPath, 'Domain Cert');
+            if(!cert){
+                this.error = {message: 'Could not read domain SSL certificate: '+domain.certPath};
+                return callback(null, null);
+            }
+            let ctx = require('tls').createSecureContext({key, cert});
+            callback(null, ctx);
+        };
+        return https.createServer(httpsOptions, this.app);
+    }
+
+    loadDefaultCredentials()
+    {
+        let key = FileHandler.readFile(this.keyPath, 'Default Key');
+        if(!key){
+            this.error = {message: 'Could not read default SSL key file: '+this.keyPath};
+            return false;
+        }
+        let cert = FileHandler.readFile(this.certPath, 'Default Cert');
+        if(!cert){
+            this.error = {message: 'Could not read default SSL certificate file: '+this.certPath};
+            return false;
+        }
+        return {key, cert, passphrase: this.passphrase};
+    }
+
+    listen(port)
+    {
+        let listenPort = port || this.port;
+        if(!this.appServer){
+            this.error = {message: 'Cannot listen: app server not created'};
+            return false;
+        }
+        this.appServer.listen(listenPort);
+        return true;
+    }
+
     async enableServeHome(app, homePageLoadCallback)
     {
         let limiterParams = {
@@ -189,16 +335,16 @@ class AppServerFactory
                     }
                     return res.status(500).send(errorMessage);
                 }
-                try {
-                    return res.send(await homePageLoadCallback(req));
-                } catch(error){
-                    let message = 'Error loading homepage.';
-                    this.error = {message, error};
+                let homepageContent = await homePageLoadCallback(req);
+                if(!homepageContent){
+                    let message = 'Error loading homepage content';
+                    this.error = {message};
                     if('function' === typeof this.processErrorResponse){
                         return this.processErrorResponse(500, message, req, res);
                     }
                     return res.status(500).send(message);
                 }
+                return res.send(homepageContent);
             }
             next();
         });
@@ -206,38 +352,84 @@ class AppServerFactory
 
     async serveStatics(app, statics)
     {
-        if(!FileHandler.isValidPath(statics)){
-            this.error = {message: 'Invalid statics path.'};
-            return;
-        }
-        let staticOptions = {
-            maxAge: '1d',
-            etag: true,
-            lastModified: true,
-            index: false,
-            setHeaders: function(res){
-                res.set('X-Content-Type-Options', 'nosniff');
-            }
-        };
-        app.use(this.applicationFramework.static(statics, staticOptions));
+        app.use(this.applicationFramework.static(statics, this.staticOptions));
+        return true;
     }
 
     async serveStaticsPath(app, staticsPath, statics)
     {
-        if(!FileHandler.isValidPath(staticsPath) || !FileHandler.isValidPath(statics)){
-            this.error = {message: 'Invalid statics path to be served.'};
-            return;
+        app.use(staticsPath, this.applicationFramework.static(statics, this.staticOptions));
+        return true;
+    }
+
+    addDomain(domainConfig)
+    {
+        if(!domainConfig || !domainConfig.hostname){
+            this.error = {message: 'Domain configuration missing hostname'};
+            return false;
         }
-        let staticOptions = {
-            maxAge: '1d',
-            etag: true,
-            lastModified: true,
-            index: false,
-            setHeaders: function(res){
-                res.set('X-Content-Type-Options', 'nosniff');
+        if('string' !== typeof domainConfig.hostname){
+            this.error = {message: 'Domain hostname must be a string'};
+            return false;
+        }
+        this.domains.push(domainConfig);
+        return true;
+    }
+
+    async close()
+    {
+        if(!this.appServer){
+            return true;
+        }
+        return this.appServer.close();
+    }
+
+    enableCSP(cspOptions)
+    {
+        let defaults = {
+            'default-src': ["'self'"],
+            'script-src': ["'self'"],
+            'style-src': ["'self'", "'unsafe-inline'"],
+            'img-src': ["'self'", "data:", "https:"],
+            'font-src': ["'self'"],
+            'connect-src': ["'self'"],
+            'frame-ancestors': ["'none'"],
+            'base-uri': ["'self'"],
+            'form-action': ["'self'"]
+        };
+        let csp = Object.assign({}, defaults, cspOptions);
+        let policyString = '';
+        let keys = Object.keys(csp);
+        for(let i = 0; i < keys.length; i++){
+            let directive = keys[i];
+            let sources = csp[directive];
+            if(0 < i){
+                policyString += '; ';
             }
+            policyString += directive + ' ' + sources.join(' ');
+        }
+        this.app.use((req, res, next) => {
+            res.setHeader('Content-Security-Policy', policyString);
+            next();
+        });
+        return true;
+    }
+
+    validateInput(input, type)
+    {
+        if('string' !== typeof input){
+            return false;
+        }
+        let patterns = {
+            email: /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/,
+            username: /^[a-zA-Z0-9_-]{3,30}$/,
+            strongPassword: /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$/,
+            alphanumeric: /^[a-zA-Z0-9]+$/,
+            numeric: /^\d+$/,
+            hexColor: /^#([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$/,
+            ipv4: /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/
         };
-        app.use(staticsPath, this.applicationFramework.static(statics, staticOptions));
+        return patterns[type] ? patterns[type].test(input) : false;
     }
 
 }

package/lib/encryptor.js

@@ -4,37 +4,44 @@
  *
  */
 
-let crypto = require('crypto');
+const crypto = require('crypto');
 
 class Encryptor
 {
 
     constructor()
     {
-        // recommended minimum for PBKDF2 with SHA-512
-        this.iterations = 60000;
+        this.iterations = 100000;
         this.keylen = 64;
         this.digest = 'sha512';
+        this.saltLength = 32;
+        this.algorithm = 'aes-256-gcm';
+        this.ivLength = 16;
     }
 
     encryptPassword(password)
     {
-        // generate the password hash:
-        let salt = crypto.randomBytes(16).toString('hex');
-        let hash = crypto.pbkdf2Sync(password, salt, this.iterations, this.keylen, this.digest ).toString('hex');
-        return salt + ':' + hash;
+        if(!password || 'string' !== typeof password){
+            return false;
+        }
+        let salt = crypto.randomBytes(this.saltLength);
+        let hash = crypto.pbkdf2Sync(password, salt, this.iterations, this.keylen, this.digest);
+        return salt.toString('hex') + ':' + hash.toString('hex');
     }
 
     validatePassword(password, storedPassword)
     {
+        if(!password || !storedPassword || 'string' !== typeof password || 'string' !== typeof storedPassword){
+            return false;
+        }
         let parts = storedPassword.split(':');
         if(2 !== parts.length){
             return false;
         }
-        let salt = parts[0];
+        let salt = Buffer.from(parts[0], 'hex');
         let storedHash = parts[1];
-        let hash = crypto.pbkdf2Sync(password, salt, this.iterations, this.keylen, this.digest).toString('hex');
-        return storedHash === hash;
+        let hash = crypto.pbkdf2Sync(password, salt, this.iterations, this.keylen, this.digest);
+        return hash.toString('hex') === storedHash;
     }
 
     generateSecretKey()
@@ -42,6 +49,114 @@ class Encryptor
         return crypto.randomBytes(32).toString('hex');
     }
 
+    encryptData(data, key)
+    {
+        if(!data || !key){
+            return false;
+        }
+        let iv = crypto.randomBytes(this.ivLength);
+        let cipher = crypto.createCipher(this.algorithm, key, iv);
+        let encrypted = cipher.update(data, 'utf8', 'hex');
+        encrypted += cipher.final('hex');
+        let authTag = cipher.getAuthTag();
+        return iv.toString('hex') + ':' + authTag.toString('hex') + ':' + encrypted;
+    }
+
+    decryptData(encryptedData, key)
+    {
+        if(!encryptedData || !key || 'string' !== typeof encryptedData){
+            return false;
+        }
+        let parts = encryptedData.split(':');
+        if(3 !== parts.length){
+            return false;
+        }
+        try {
+            let iv = Buffer.from(parts[0], 'hex');
+            let authTag = Buffer.from(parts[1], 'hex');
+            let encrypted = parts[2];
+            let decipher = crypto.createDecipher(this.algorithm, key, iv);
+            decipher.setAuthTag(authTag);
+            let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+            decrypted += decipher.final('utf8');
+            return decrypted;
+        } catch (error) {
+            return false;
+        }
+    }
+
+    generateSecureToken(length = 32)
+    {
+        if(0 >= length || 256 < length){
+            return false;
+        }
+        return crypto.randomBytes(length).toString('base64url');
+    }
+
+    generateTOTP(secret, timeStep = 30)
+    {
+        if(!secret || 'string' !== typeof secret){
+            return false;
+        }
+        let time = Math.floor(Date.now() / 1000 / timeStep);
+        let timeBuffer = Buffer.allocUnsafe(8);
+        timeBuffer.writeUInt32BE(0, 0);
+        timeBuffer.writeUInt32BE(time, 4);
+        let hmac = crypto.createHmac('sha1', Buffer.from(secret, 'base32'));
+        hmac.update(timeBuffer);
+        let digest = hmac.digest();
+        let offset = digest[digest.length - 1] & 0x0f;
+        let code = (digest.readUInt32BE(offset) & 0x7fffffff) % 1000000;
+        return code.toString().padStart(6, '0');
+    }
+
+    hashData(data, algorithm = 'sha256')
+    {
+        if(!data){
+            return false;
+        }
+        let validAlgorithms = ['sha256', 'sha512', 'md5'];
+        if(-1 === validAlgorithms.indexOf(algorithm)){
+            return false;
+        }
+        return crypto.createHash(algorithm).update(data).digest('hex');
+    }
+
+    generateHMAC(data, secret, algorithm = 'sha256')
+    {
+        if(!data || !secret){
+            return false;
+        }
+        let validAlgorithms = ['sha256', 'sha512'];
+        if(-1 === validAlgorithms.indexOf(algorithm)){
+            return false;
+        }
+        return crypto.createHmac(algorithm, secret).update(data).digest('hex');
+    }
+
+    verifyHMAC(data, secret, signature, algorithm = 'sha256')
+    {
+        if(!data || !secret || !signature){
+            return false;
+        }
+        let expectedSignature = this.generateHMAC(data, secret, algorithm);
+        if(!expectedSignature){
+            return false;
+        }
+        return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature));
+    }
+
+    constantTimeCompare(a, b)
+    {
+        if(!a || !b || 'string' !== typeof a || 'string' !== typeof b){
+            return false;
+        }
+        if(b.length !== a.length){
+            return false;
+        }
+        return crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));
+    }
+
 }
 
 module.exports.Encryptor = new Encryptor();

package/lib/file-handler.js

@@ -15,6 +15,13 @@ class FileHandler
         this.encoding = (process.env.RELDENS_DEFAULT_ENCODING || 'utf8');
         this.sep = path.sep;
         this.error = {message: ''};
+        this.maxPathLength = 2048;
+        this.dangerousPatterns = [
+            '../', '..\\', './', '.\\',
+            '/etc/', '/proc/', '/sys/',
+            'C:\\Windows\\', 'C:\\System32\\',
+            '%2e%2e%2f', '%2e%2e%5c'
+        ];
     }
 
     joinPaths(...args)
@@ -37,7 +44,16 @@ class FileHandler
             return false;
         }
         let pathStr = String(filePath);
-        return !(pathStr.includes('../') || pathStr.includes('..\\'));
+        if(this.maxPathLength < pathStr.length){
+            return false;
+        }
+        let normalized = pathStr.replace(/\\/g, '/');
+        for(let pattern of this.dangerousPatterns){
+            if(normalized.toLowerCase().includes(pattern.toLowerCase())){
+                return false;
+            }
+        }
+        return true;
     }
 
     sanitizePath(filePath)
@@ -48,7 +64,7 @@ class FileHandler
         return String(filePath)
             .replace(/\.\./g, '')
             .replace(/[:*?"<>|]/g, '')
-            .substring(0, 255);
+            .substring(0, this.maxPathLength);
     }
 
     generateSecureFilename(originalName)
@@ -65,52 +81,49 @@ class FileHandler
 
     remove(fullPath)
     {
+        let deletePath = Array.isArray(fullPath) ? this.joinPaths(...fullPath) : fullPath;
+        if(!this.exists(deletePath)){
+            return true;
+        }
         try {
-            if(!this.isValidPath(fullPath)){
-                this.error = {message: 'Invalid path for removal.', fullPath};
-                return false;
-            }
-            let deletePath = Array.isArray(fullPath) ? this.joinPaths(...fullPath) : fullPath;
-            if(fs.existsSync(deletePath)){
-                fs.rmSync(deletePath, {recursive: true, force: true});
-                return true;
-            }
+            fs.rmSync(deletePath, {recursive: true, force: true});
+            return true;
         } catch (error) {
             this.error = {message: 'Failed to remove folder.', error, fullPath};
+            return false;
         }
-        return false;
     }
 
     createFolder(folderPath)
     {
+        if(!this.isValidPath(folderPath)){
+            this.error = {message: 'Invalid folder path.', folderPath};
+            return false;
+        }
+        if(this.exists(folderPath)){
+            return true;
+        }
         try {
-            if(!this.isValidPath(folderPath)){
-                this.error = {message: 'Invalid folder path.', folderPath};
-                return false;
-            }
-            if(fs.existsSync(folderPath)){
-                return true;
-            }
             fs.mkdirSync(folderPath, {recursive: true});
             return true;
         } catch (error) {
             this.error = {message: 'Failed to create folder.', error, folderPath};
+            return false;
         }
-        return false;
     }
 
     copyFolderSync(from, to)
     {
+        if(!this.isValidPath(from) || !this.isValidPath(to)){
+            this.error = {message: 'Invalid path for folder copy.', from, to};
+            return false;
+        }
         try {
-            if(!this.isValidPath(from) || !this.isValidPath(to)){
-                this.error = {message: 'Invalid path for folder copy.', from, to};
-                return false;
-            }
             fs.mkdirSync(to, {recursive: true});
             let folders = fs.readdirSync(from);
             for(let element of folders){
                 let elementPath = path.join(from, element);
-                if(!fs.existsSync(elementPath)){
+                if(!this.exists(elementPath)){
                     continue;
                 }
                 if(fs.lstatSync(elementPath).isFile()){
@@ -122,8 +135,8 @@ class FileHandler
             return true;
         } catch (error) {
             this.error = {message: 'Failed to copy folder.', error, from, to};
+            return false;
         }
-        return false;
     }
 
     copyFileSyncIfDoesNotExist(from, to)
@@ -132,9 +145,16 @@ class FileHandler
             this.error = {message: 'Invalid path for file copy.', from, to};
             return false;
         }
-        if(!fs.existsSync(to)){
-            return fs.copyFileSync(from, to);
+        if(!this.exists(to)){
+            try {
+                fs.copyFileSync(from, to);
+                return true;
+            } catch (error) {
+                this.error = {message: 'Failed to copy file.', error, from, to};
+                return false;
+            }
         }
+        return true;
     }
 
     copyFile(from, to)
@@ -154,8 +174,8 @@ class FileHandler
             return true;
         } catch (error) {
             this.error = {message: 'Failed to copy file.', error, from, to, origin, dest};
+            return false;
         }
-        return false;
     }
 
     extension(filePath)
@@ -199,8 +219,55 @@ class FileHandler
             return fs.lstatSync(filePath).isFile();
         } catch (error) {
             this.error = {message: 'Can not check file.', error, filePath};
+            return false;
         }
-        return false;
+    }
+
+    isFolder(dirPath)
+    {
+        if(!this.isValidPath(dirPath)){
+            this.error = {message: 'Invalid folder path.', dirPath};
+            return false;
+        }
+        if(!this.exists(dirPath)){
+            return false;
+        }
+        try {
+            return fs.lstatSync(dirPath).isDirectory();
+        } catch (error) {
+            this.error = {message: 'Can not check folder.', error, dirPath};
+            return false;
+        }
+    }
+
+    getFilesInFolder(dirPath, extensions = [])
+    {
+        if(!this.isValidPath(dirPath)){
+            this.error = {message: 'Invalid folder path.', dirPath};
+            return [];
+        }
+        let files = this.readFolder(dirPath);
+        if(0 === files.length){
+            return [];
+        }
+        let result = [];
+        for(let file of files){
+            let filePath = path.join(dirPath, file);
+            if(!this.isFile(filePath)){
+                continue;
+            }
+            if(0 === extensions.length){
+                result.push(file);
+                continue;
+            }
+            for(let ext of extensions){
+                if(file.endsWith(ext)){
+                    result.push(file);
+                    break;
+                }
+            }
+        }
+        return result;
     }
 
     permissionsCheck(systemPath)
@@ -249,17 +316,12 @@ class FileHandler
             this.error = {message: 'File check failed to fetch file contents.', filePath};
             return false;
         }
-        try {
-            let fileContent = this.readFile(filePath);
-            if(!fileContent){
-                this.error = {message: 'Can not read data or empty file.', filePath};
-                return false;
-            }
-            return fileContent;
-        } catch(error){
-            this.error = {message: 'Error reading file.', filePath, error};
+        let fileContent = this.readFile(filePath);
+        if(!fileContent){
+            this.error = {message: 'Can not read data or empty file.', filePath};
             return false;
         }
+        return fileContent;
     }
 
     readFile(filePath)
@@ -287,7 +349,8 @@ class FileHandler
             return false;
         }
         try {
-            return fs.writeFileSync(fs.openSync(filePath, 'w+'), contents);
+            fs.writeFileSync(fs.openSync(filePath, 'w+'), contents);
+            return true;
         } catch(error){
             this.error = {message: 'Error updating file.', filePath, error};
             return false;
@@ -305,8 +368,8 @@ class FileHandler
             return true;
         } catch (error) {
             this.error = {message: 'Error saving the file.', fileName, error};
+            return false;
         }
-        return false;
     }
 
     validateFileType(filePath, allowedType, allowedFileTypes, maxFileSize)
@@ -369,6 +432,54 @@ class FileHandler
         }
     }
 
+    detectFileType(filePath)
+    {
+        let buffer = this.getFirstFileBytes(filePath, 16);
+        if(!buffer){
+            return false;
+        }
+        let signatures = {
+            'image/jpeg': [0xFF, 0xD8, 0xFF],
+            'image/png': [0x89, 0x50, 0x4E, 0x47],
+            'image/gif': [0x47, 0x49, 0x46, 0x38],
+            'application/pdf': [0x25, 0x50, 0x44, 0x46],
+            'application/zip': [0x50, 0x4B, 0x03, 0x04]
+        };
+        for(let mimeType of Object.keys(signatures)){
+            let signature = signatures[mimeType];
+            let matches = true;
+            for(let i = 0; i < signature.length; i++){
+                if(buffer[i] !== signature[i]){
+                    matches = false;
+                    break;
+                }
+            }
+            if(matches){
+                return mimeType;
+            }
+        }
+        return 'application/octet-stream';
+    }
+
+    quarantineFile(filePath, reason = 'security')
+    {
+        let quarantineDir = this.joinPaths(process.cwd(), 'quarantine');
+        this.createFolder(quarantineDir);
+        let timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+        let quarantinePath = this.joinPaths(
+            quarantineDir,
+            timestamp + '-' + reason + '-' + path.basename(filePath)
+        );
+        return this.copyFile(filePath, quarantinePath);
+    }
+
+    createTempFile(prefix = 'temp', extension = '.tmp')
+    {
+        let tempDir = require('os').tmpdir();
+        let fileName = prefix + '-' + this.generateSecureFilename('file' + extension);
+        return this.joinPaths(tempDir, fileName);
+    }
+
 }
 
 module.exports.FileHandler = new FileHandler();

package/lib/uploader-factory.js

@@ -19,12 +19,17 @@ class UploaderFactory
         this.allowedExtensions = props.allowedExtensions;
         this.applySecureFileNames = props.applySecureFileNames;
         this.processErrorResponse = props.processErrorResponse || false;
+        this.dangerousExtensions = props.dangerousExtensions !== undefined
+            ? props.dangerousExtensions
+            : ['.exe', '.bat', '.cmd', '.com', '.scr', '.pif', '.vbs', '.js'];
+        this.maxFilenameLength = props.maxFilenameLength || 255;
     }
 
     createUploader(fields, buckets, allowedFileTypes)
     {
         if(!this.validateInputs(fields, buckets, allowedFileTypes)){
-            throw new Error('Invalid uploader configuration: ' + this.error.message);
+            this.error = {message: 'Invalid uploader configuration: ' + this.error.message};
+            return false;
         }
         let diskStorageConfiguration = {
             destination: (req, file, cb) => {
@@ -36,7 +41,10 @@ class UploaderFactory
                 cb(null, dest);
             }
         };
-        diskStorageConfiguration['filename'] = (req, file, cb) => {
+        diskStorageConfiguration.filename = (req, file, cb) => {
+            if(!this.validateFilenameSecurity(file.originalname)){
+                return cb(new Error('Invalid filename'));
+            }
             if(!this.applySecureFileNames) {
                 cb(null, file.originalname);
                 return;
@@ -53,7 +61,7 @@ class UploaderFactory
             fileSize: this.maxFileSize
         };
         if(0 < this.fileLimit){
-            limits['files'] = this.fileLimit;
+            limits.files = this.fileLimit;
         }
         let upload = multer({
             storage,
@@ -95,60 +103,84 @@ class UploaderFactory
                 if(!req.files){
                     return next();
                 }
-                try {
-                    for(let fieldName in req.files){
-                        for(let file of req.files[fieldName]){
-                            if(!await this.validateFileContents(file, allowedFileTypes[fieldName])){
-                                if(FileHandler.exists(file.path)){
-                                    FileHandler.remove(file.path);
-                                }
-                                let messageContents = 'File contents do not match declared type.';
-                                if('function' === typeof this.processErrorResponse){
-                                    return this.processErrorResponse(415, messageContents, req, res);
-                                }
-                                return res.status(415).send(messageContents);
-                            }
-                        }
-                    }
-                    next();
-                } catch(error){
-                    let messageProcessing = 'Error processing uploaded files.';
-                    this.error = {message: messageProcessing, error};
+                let validationResult = await this.validateAllUploadedFiles(req, allowedFileTypes);
+                if(!validationResult){
                     this.cleanupFiles(req.files);
+                    let messageContents = 'File validation failed.';
                     if('function' === typeof this.processErrorResponse){
-                        return this.processErrorResponse(500, messageProcessing, req, res);
+                        return this.processErrorResponse(415, messageContents, req, res);
                     }
-                    return res.status(500).send(messageProcessing);
+                    return res.status(415).send(messageContents);
                 }
+                next();
             });
         };
     }
 
+    async validateAllUploadedFiles(req, allowedFileTypes)
+    {
+        try {
+            for(let fieldName in req.files){
+                for(let file of req.files[fieldName]){
+                    if(!await this.validateFileContents(file, allowedFileTypes[fieldName])){
+                        FileHandler.remove(file.path);
+                        return false;
+                    }
+                }
+            }
+            return true;
+        } catch(error){
+            this.error = {message: 'Error processing uploaded files.', error};
+            return false;
+        }
+    }
+
+    validateFilenameSecurity(filename)
+    {
+        if(!filename || 'string' !== typeof filename){
+            return false;
+        }
+        if(this.maxFilenameLength < filename.length){
+            return false;
+        }
+        let ext = filename.toLowerCase().substring(filename.lastIndexOf('.'));
+        if(-1 !== this.dangerousExtensions.indexOf(ext)){
+            return false;
+        }
+        let dangerous = ['../', '..\\', '/', '\\', '<', '>', ':', '*', '?', '"', '|'];
+        for(let char of dangerous){
+            if(-1 !== filename.indexOf(char)){
+                return false;
+            }
+        }
+        return true;
+    }
+
     validateInputs(fields, buckets, allowedFileTypes)
     {
         if(!Array.isArray(fields)){
             this.error = {message: 'Fields must be an array'};
             return false;
         }
-        if(!buckets || typeof buckets !== 'object'){
+        if(!buckets || 'object' !== typeof buckets){
             this.error = {message: 'Buckets must be an object'};
             return false;
         }
-        if(!allowedFileTypes || typeof allowedFileTypes !== 'object'){
+        if(!allowedFileTypes || 'object' !== typeof allowedFileTypes){
             this.error = {message: 'AllowedFileTypes must be an object'};
             return false;
         }
         for(let field of fields){
-            if(!field.name || typeof field.name !== 'string'){
+            if(!field.name || 'string' !== typeof field.name){
                 this.error = {message: 'Field name is invalid'};
                 return false;
             }
             if(!buckets[field.name]){
-                this.error = {message: `Missing bucket for field: ${field.name}`};
+                this.error = {message: 'Missing bucket for field: ' + field.name};
                 return false;
             }
             if(!allowedFileTypes[field.name]){
-                this.error = {message: `Missing allowedFileType for field: ${field.name}`};
+                this.error = {message: 'Missing allowedFileType for field: ' + field.name};
                 return false;
             }
         }
@@ -158,39 +190,49 @@ class UploaderFactory
     validateFile(file, allowedFileType, cb)
     {
         if(!allowedFileType){
-            return cb(null, true);
+            return cb();
+        }
+        if(!this.validateFilenameSecurity(file.originalname)){
+            this.error = {message: 'Insecure filename: ' + file.originalname};
+            return cb(new Error('Insecure filename: ' + file.originalname));
         }
         let fileExtension = FileHandler.extension(file.originalname).toLowerCase();
         let allowedExtensions = this.allowedExtensions[allowedFileType];
         if(allowedExtensions && !allowedExtensions.includes(fileExtension)){
-            this.error = {message: `Invalid file extension: ${fileExtension}`};
-            return cb(null, false);
+            this.error = {message: 'Invalid file extension: ' + fileExtension};
+            return cb(new Error('Invalid file extension: ' + fileExtension));
         }
         let allowedFileTypeRegex = this.convertToRegex(allowedFileType);
         if(!allowedFileTypeRegex){
             this.error = {message: 'File type could not be converted to regex.', allowedFileType};
-            return cb(null, false);
+            return cb(new Error('File type could not be converted to regex'));
         }
         let mimeTypeValid = allowedFileTypeRegex.test(file.mimetype);
         if(!mimeTypeValid){
-            this.error = {message: `Invalid MIME type: ${file.mimetype}`};
-            return cb(null, false);
+            this.error = {message: 'Invalid MIME type: ' + file.mimetype};
+            return cb(new Error('Invalid MIME type: ' + file.mimetype));
         }
-        return cb(null, true);
+        return cb();
     }
 
     async validateFileContents(file, allowedFileType)
     {
-        try {
-            if(!FileHandler.isFile(file.path)){
-                this.error = {message: 'File path must be provided.', file};
+        if(!FileHandler.isFile(file.path)){
+            this.error = {message: 'File path must be provided.', file};
+            return false;
+        }
+        let detectedType = FileHandler.detectFileType(file.path);
+        if(detectedType && 'application/octet-stream' !== detectedType){
+            let expectedMimeTypes = this.mimeTypes[allowedFileType] || [];
+            if(0 < expectedMimeTypes.length && -1 === expectedMimeTypes.indexOf(detectedType)){
+                this.error = {
+                    message: 'File content type mismatch.',
+                    detected: detectedType, expected: expectedMimeTypes
+                };
                 return false;
             }
-            return FileHandler.validateFileType(file.path, allowedFileType, this.allowedExtensions, this.maxFileSize);
-        } catch(error){
-            this.error = {message: 'Error validating file contents.', error};
-            return false;
         }
+        return FileHandler.validateFileType(file.path, allowedFileType, this.allowedExtensions, this.maxFileSize);
     }
 
     convertToRegex(key)
@@ -211,13 +253,7 @@ class UploaderFactory
         }
         for(let fieldName in files){
             for(let file of files[fieldName]){
-                try {
-                    if(FileHandler.exists(file.path)){
-                        FileHandler.remove(file.path);
-                    }
-                } catch(error){
-                    this.error = {message: 'Error cleaning up file.', error};
-                }
+                FileHandler.remove(file.path);
             }
         }
     }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@reldens/server-utils",
     "scope": "@reldens",
-    "version": "0.16.0",
+    "version": "0.18.0",
     "description": "Reldens - Server Utils",
     "author": "Damian A. Pastorini",
     "license": "MIT",
@@ -41,7 +41,7 @@
         "express-rate-limit": "7.5.0",
         "express-session": "1.18.1",
         "helmet": "8.1.0",
-        "multer": "^1.4.5-lts.2",
-        "sanitize-html": "^2.16.0"
+        "multer": "2.0.0",
+        "sanitize-html": "^2.17.0"
     }
 }