@reldens/server-utils 0.24.0 → 0.26.0

package/README.md

@@ -40,7 +40,7 @@ A Node.js server toolkit providing secure application server creation, file hand
 - Password hashing using PBKDF2 with configurable iterations
 - Password validation against stored hashes
 - AES-256-GCM data encryption and decryption
-- Secure token generation with customizable length
+- Secure token generation with a customizable length
 - TOTP (Time-based One-Time Password) generation
 - Data hashing with multiple algorithms (SHA-256, SHA-512, MD5)
 - HMAC generation and verification
@@ -245,8 +245,9 @@ let serverResult = appServerFactory.createAppServer({
 ### FileHandler Methods
 
 - `exists(path)` - Checks if file or folder exists
-- `createFolder(path)` - Creates folder with recursive option
+- `createFolder(path)` - Creates folder with a recursive option
 - `remove(path)` - Removes file or folder recursively
+- `removeMultiple(filePaths)` - Removes multiple files from an array of paths
 - `copyFile(source, destination)` - Copies file to destination
 - `copyFolderSync(source, destination)` - Copies folder recursively
 - `readFile(path)` - Reads file contents as string
@@ -254,14 +255,14 @@ let serverResult = appServerFactory.createAppServer({
 - `fetchFileJson(path)` - Reads and parses JSON file
 - `fetchFileContents(path)` - Reads file with validation
 - `updateFileContents(path, content)` - Updates existing file
-- `isFile(path)` - Checks if path is file
-- `isFolder(path)` - Checks if path is folder
+- `isFile(path)` - Checks if a path is a file
+- `isFolder(path)` - Checks if a path is folder
 - `getFilesInFolder(path, extensions)` - Lists files with optional filtering
 - `validateFileType(path, type, allowedTypes, maxSize)` - Validates file type and size
 - `detectFileType(path)` - Detects MIME type from file signature
 - `generateSecureFilename(originalName)` - Generates cryptographically secure filename
 - `quarantineFile(path, reason)` - Moves file to quarantine folder
-- `createTempFile(prefix, extension)` - Creates temporary file path
+- `createTempFile(prefix, extension)` - Creates a temporary file path
 
 ### Encryptor Methods
 
@@ -281,9 +282,8 @@ let serverResult = appServerFactory.createAppServer({
 
 - `createUploader(fields, buckets, allowedTypes)` - Creates multer upload middleware
 - `validateFilenameSecurity(filename)` - Validates filename for security
-- `validateFile(file, allowedType, callback)` - Validates file during upload
+- `validateFile(file, allowedType, callback)` - Validates a file during upload
 - `validateFileContents(file, allowedType)` - Validates file content after upload
-- `cleanupFiles(files)` - Removes uploaded files on error
 
 ## Security Features
 
@@ -291,7 +291,7 @@ let serverResult = appServerFactory.createAppServer({
 All file operations include comprehensive path validation to prevent directory traversal attacks and access to system files.
 
 ### Secure File Upload
-File uploads are validated at multiple levels including filename, MIME type, file extension, file size, and content validation using magic number detection.
+File uploads are validated at multiple levels including filename, MIME type, file extension, file size, and content validation using magic number detection. Failed uploads are automatically cleaned up using efficient file removal.
 
 ### Rate Limiting
 Configurable rate limiting with development mode detection for appropriate thresholds in different environments.

package/lib/file-handler.js

@@ -141,6 +141,20 @@ class FileHandler
         }
     }
 
+    removeMultiple(filePaths)
+    {
+        if(!Array.isArray(filePaths)){
+            this.error = {message: 'File paths must be an array'};
+            return false;
+        }
+        for(let filePath of filePaths){
+            if(!this.remove(filePath)){
+                return false;
+            }
+        }
+        return true;
+    }
+
     createFolder(folderPath)
     {
         if(!this.isValidPath(folderPath)){

package/lib/uploader-factory.js

@@ -25,38 +25,55 @@ class UploaderFactory
         this.maxFilenameLength = props.maxFilenameLength || 255;
     }
 
+    setError(message, additionalData = {})
+    {
+        if(!this.error.message){
+            this.error = {message, ...additionalData};
+        }
+    }
+
     createUploader(fields, buckets, allowedFileTypes)
     {
         if(!this.validateInputs(fields, buckets, allowedFileTypes)){
-            this.error = {message: 'Invalid uploader configuration: ' + this.error.message};
+            this.setError('Invalid uploader configuration: ' + this.error.message);
             return false;
         }
-        let diskStorageConfiguration = {
+        let storage = multer.diskStorage({
             destination: (req, file, cb) => {
-                let dest = buckets[file.fieldname];
-                if(!FileHandler.isValidPath(dest)){
-                    return cb(new Error('Invalid destination path'));
+                try{
+                    let dest = buckets[file.fieldname];
+                    if(!FileHandler.isValidPath(dest)){
+                        this.setError('Invalid destination path', {dest, fieldname: file.fieldname});
+                        return cb(new Error('Invalid destination path'));
+                    }
+                    let folderCreated = FileHandler.createFolder(dest);
+                    if(!folderCreated){
+                        this.setError('Cannot create destination folder', {dest, fileHandlerError: FileHandler.error});
+                        return cb(new Error('Cannot create destination folder'));
+                    }
+                    cb(null, dest);
+                } catch(error){
+                    this.setError('Cannot prepare destination.', {error: error});
+                    cb(error);
                 }
-                FileHandler.createFolder(dest);
-                cb(null, dest);
-            }
-        };
-        diskStorageConfiguration.filename = (req, file, cb) => {
-            if(!this.validateFilenameSecurity(file.originalname)){
-                return cb(new Error('Invalid filename'));
-            }
-            if(!this.applySecureFileNames) {
-                cb(null, file.originalname);
-                return;
-            }
-            let secureFilename = FileHandler.generateSecureFilename(file.originalname);
-            if(!req.fileNameMapping){
-                req.fileNameMapping = {};
+            },
+            filename: (req, file, cb) => {
+                if(!this.validateFilenameSecurity(file.originalname)){
+                    this.setError('Invalid filename', {originalname: file.originalname});
+                    return cb(new Error('Invalid filename'));
+                }
+                if(!this.applySecureFileNames) {
+                    cb(null, file.originalname);
+                    return;
+                }
+                let secureFilename = FileHandler.generateSecureFilename(file.originalname);
+                if(!req.fileNameMapping){
+                    req.fileNameMapping = {};
+                }
+                req.fileNameMapping[secureFilename] = file.originalname;
+                cb(null, secureFilename);
             }
-            req.fileNameMapping[secureFilename] = file.originalname;
-            cb(null, secureFilename);
-        };
-        let storage = multer.diskStorage(diskStorageConfiguration);
+        });
         let limits = {
             fileSize: this.maxFileSize
         };
@@ -74,39 +91,44 @@ class UploaderFactory
             upload.fields(fields)(req, res, async (multerError) => {
                 if(multerError){
                     if(multerError instanceof multer.MulterError){
-                        if(multerError.code === 'LIMIT_FILE_SIZE'){
+                        if('LIMIT_FILE_SIZE' === multerError.code){
                             let messageFile = 'File too large.';
+                            this.setError(messageFile, {multerError});
                             if('function' === typeof this.processErrorResponse){
                                 return this.processErrorResponse(413, messageFile, req, res);
                             }
                             return res.status(413).send(messageFile);
                         }
-                        if(multerError.code === 'LIMIT_FILE_COUNT'){
+                        if('LIMIT_FILE_COUNT' === multerError.code){
                             let messageTooMany = 'Too many files.';
+                            this.setError(messageTooMany, {multerError});
                             if('function' === typeof this.processErrorResponse){
                                 return this.processErrorResponse(413, messageTooMany, req, res);
                             }
                             return res.status(413).send(messageTooMany);
                         }
                         let messageUpload = 'File upload error.';
+                        this.setError(messageUpload, {multerError});
                         if('function' === typeof this.processErrorResponse){
                             return this.processErrorResponse(400, messageUpload, multerError, req, res);
                         }
                         return res.status(400).send(messageUpload);
                     }
-                    let messageServer = 'Server error during file upload.';
+                    let messageServer = this.error?.message ? this.error.message : 'Server error during file upload.';
+                    this.setError(messageServer, {multerError});
                     if('function' === typeof this.processErrorResponse){
-                        return this.processErrorResponse(500, messageServer, req, res);
+                        return this.processErrorResponse(415, messageServer, req, res);
                     }
-                    return res.status(500).send(messageServer);
+                    return res.status(415).send(messageServer);
                 }
                 if(!req.files){
                     return next();
                 }
                 let validationResult = await this.validateAllUploadedFiles(req, allowedFileTypes);
                 if(!validationResult){
-                    this.cleanupFiles(req.files);
-                    let messageContents = 'File validation failed.';
+                    let filePaths = Object.values(req.files).flat().map(file => file.path);
+                    FileHandler.removeMultiple(filePaths);
+                    let messageContents = this.error?.message ? this.error.message : 'File validation failed.';
                     if('function' === typeof this.processErrorResponse){
                         return this.processErrorResponse(415, messageContents, req, res);
                     }
@@ -122,7 +144,8 @@ class UploaderFactory
         try {
             for(let fieldName in req.files){
                 for(let file of req.files[fieldName]){
-                    if(!await this.validateFileContents(file, allowedFileTypes[fieldName])){
+                    let validationResult = await this.validateFileContents(file, allowedFileTypes[fieldName]);
+                    if(!validationResult){
                         FileHandler.remove(file.path);
                         return false;
                     }
@@ -130,7 +153,7 @@ class UploaderFactory
             }
             return true;
         } catch(error){
-            this.error = {message: 'Error processing uploaded files.', error};
+            this.setError('Error processing uploaded files.', {error});
             return false;
         }
     }
@@ -159,28 +182,28 @@ class UploaderFactory
     validateInputs(fields, buckets, allowedFileTypes)
     {
         if(!Array.isArray(fields)){
-            this.error = {message: 'Fields must be an array'};
+            this.setError('Fields must be an array');
             return false;
         }
         if(!buckets || 'object' !== typeof buckets){
-            this.error = {message: 'Buckets must be an object'};
+            this.setError('Buckets must be an object');
             return false;
         }
         if(!allowedFileTypes || 'object' !== typeof allowedFileTypes){
-            this.error = {message: 'AllowedFileTypes must be an object'};
+            this.setError('AllowedFileTypes must be an object');
             return false;
         }
         for(let field of fields){
             if(!field.name || 'string' !== typeof field.name){
-                this.error = {message: 'Field name is invalid'};
+                this.setError('Field name is invalid');
                 return false;
             }
             if(!buckets[field.name]){
-                this.error = {message: 'Missing bucket for field: ' + field.name};
+                this.setError('Missing bucket for field: ' + field.name);
                 return false;
             }
             if(!allowedFileTypes[field.name]){
-                this.error = {message: 'Missing allowedFileType for field: ' + field.name};
+                this.setError('Missing allowedFileType for field: ' + field.name);
                 return false;
             }
         }
@@ -190,49 +213,77 @@ class UploaderFactory
     validateFile(file, allowedFileType, cb)
     {
         if(!allowedFileType){
-            return cb();
+            return cb(null, true);
         }
         if(!this.validateFilenameSecurity(file.originalname)){
-            this.error = {message: 'Insecure filename: ' + file.originalname};
-            return cb(new Error('Insecure filename: ' + file.originalname));
+            this.setError('Insecure filename: '+file.originalname, {originalname: file.originalname});
+            return cb(new Error('Insecure filename: '+file.originalname));
         }
         let fileExtension = FileHandler.extension(file.originalname).toLowerCase();
-        let allowedExtensions = this.allowedExtensions[allowedFileType];
+        let allowedExtensions = this.allowedExtensions && this.allowedExtensions[allowedFileType];
         if(allowedExtensions && !allowedExtensions.includes(fileExtension)){
-            this.error = {message: 'Invalid file extension: ' + fileExtension};
-            return cb(new Error('Invalid file extension: ' + fileExtension));
+            this.setError('Invalid file extension: '+fileExtension, {
+                extension: fileExtension,
+                allowedExtensions,
+                allowedFileType,
+                filename: file.originalname
+            });
+            return cb(new Error('Invalid file extension: '+fileExtension));
         }
         let allowedFileTypeRegex = this.convertToRegex(allowedFileType);
         if(!allowedFileTypeRegex){
-            this.error = {message: 'File type could not be converted to regex.', allowedFileType};
+            this.setError('File type could not be converted to regex.', {allowedFileType});
             return cb(new Error('File type could not be converted to regex'));
         }
         let mimeTypeValid = allowedFileTypeRegex.test(file.mimetype);
         if(!mimeTypeValid){
-            this.error = {message: 'Invalid MIME type: ' + file.mimetype};
-            return cb(new Error('Invalid MIME type: ' + file.mimetype));
+            this.setError('Invalid MIME type: '+file.mimetype, {
+                mimetype: file.mimetype,
+                allowedFileType,
+                filename: file.originalname,
+                regex: allowedFileTypeRegex
+            });
+            return cb(new Error('Invalid MIME type: '+file.mimetype));
         }
-        return cb();
+        return cb(null, true);
     }
 
     async validateFileContents(file, allowedFileType)
     {
         if(!FileHandler.isFile(file.path)){
-            this.error = {message: 'File path must be provided.', file};
+            this.setError('File path must be provided.', {file});
             return false;
         }
         let detectedType = FileHandler.detectFileType(file.path);
         if(detectedType && 'application/octet-stream' !== detectedType){
             let expectedMimeTypes = this.mimeTypes[allowedFileType] || [];
             if(0 < expectedMimeTypes.length && -1 === expectedMimeTypes.indexOf(detectedType)){
-                this.error = {
-                    message: 'File content type mismatch.',
-                    detected: detectedType, expected: expectedMimeTypes
-                };
+                this.setError('File content type mismatch.', {
+                    detected: detectedType,
+                    expected: expectedMimeTypes,
+                    filename: file.filename,
+                    path: file.path,
+                    allowedFileType
+                });
                 return false;
             }
         }
-        return FileHandler.validateFileType(file.path, allowedFileType, this.allowedExtensions, this.maxFileSize);
+        let typeValidationResult = FileHandler.validateFileType(
+            file.path,
+            allowedFileType,
+            this.allowedExtensions,
+            this.maxFileSize
+        );
+        if(!typeValidationResult){
+            this.setError('File type validation failed.', {
+                fileHandlerError: FileHandler.error,
+                filename: file.filename,
+                path: file.path,
+                allowedFileType
+            });
+            return false;
+        }
+        return true;
     }
 
     convertToRegex(key)
@@ -246,17 +297,6 @@ class UploaderFactory
         return new RegExp(types.join('|'));
     }
 
-    cleanupFiles(files)
-    {
-        if(!files){
-            return;
-        }
-        for(let fieldName in files){
-            for(let file of files[fieldName]){
-                FileHandler.remove(file.path);
-            }
-        }
-    }
 }
 
 module.exports.UploaderFactory = UploaderFactory;

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@reldens/server-utils",
     "scope": "@reldens",
-    "version": "0.24.0",
+    "version": "0.26.0",
     "description": "Reldens - Server Utils",
     "author": "Damian A. Pastorini",
     "license": "MIT",