@reldens/server-utils 0.6.0 → 0.8.0

package/lib/app-server-factory.js

@@ -12,6 +12,8 @@ const bodyParser = require('body-parser');
 const session = require('express-session');
 const rateLimit = require('express-rate-limit');
 const cors = require('cors');
+const helmet = require('helmet');
+const xss = require('xss-clean');
 
 class AppServerFactory
 {
@@ -23,6 +25,7 @@ class AppServerFactory
         this.session = session;
         this.appServer = false;
         this.app = express();
+        this.rateLimit = rateLimit;
         this.useCors = 1 === Number(process.env.RELDENS_USE_CORS || 1);
         this.useExpressJson = 1 === Number(process.env.RELDENS_USE_EXPRESS_JSON || 1);
         this.useUrlencoded = 1 === Number(process.env.RELDENS_USE_URLENCODED || 1);
@@ -36,6 +39,14 @@ class AppServerFactory
         this.windowMs = Number(process.env.RELDENS_EXPRESS_RATE_LIMIT_MS || 60000);
         this.maxRequests = Number(process.env.RELDENS_EXPRESS_RATE_LIMIT_MAX_REQUESTS || 30);
         this.applyKeyGenerator = 1 === Number(process.env.RELDENS_EXPRESS_RATE_LIMIT_APPLY_KEY_GENERATOR || 0);
+        this.jsonLimit = String(process.env.RELDENS_EXPRESS_JSON_LIMIT || '1mb');
+        this.urlencodedLimit = String(process.env.RELDENS_EXPRESS_URLENCODED_LIMIT || '1mb');
+        this.useHelmet = 1 === Number(process.env.RELDENS_USE_HELMET || 1);
+        this.useXssProtection = 1 === Number(process.env.RELDENS_USE_XSS_PROTECTION || 1);
+        this.globalRateLimit = 1 === Number(process.env.RELDENS_GLOBAL_RATE_LIMIT || 0);
+        this.corsOrigin = String(process.env.RELDENS_CORS_ORIGIN || '*');
+        this.corsMethods = String(process.env.RELDENS_CORS_METHODS || 'GET,POST').split(',');
+        this.corsHeaders = String(process.env.RELDENS_CORS_HEADERS || 'Content-Type,Authorization').split(',');
         this.errorMessage = '';
     }
 
@@ -44,14 +55,46 @@ class AppServerFactory
         if(appServerConfig){
             Object.assign(this, appServerConfig);
         }
+        if(this.useHelmet){
+            this.app.use(helmet());
+        }
         if(this.useCors){
-            this.app.use(cors());
+            let corsOptions = {
+                origin: this.corsOrigin,
+                methods: this.corsMethods,
+                allowedHeaders: this.corsHeaders
+            };
+            this.app.use(cors(corsOptions));
+        }
+        if(this.globalRateLimit){
+            let limiterParams = {
+                windowMs: this.windowMs,
+                max: this.maxRequests,
+                standardHeaders: true,
+                legacyHeaders: false,
+                message: 'Too many requests from this IP, please try again later'
+            };
+            if(this.applyKeyGenerator){
+                limiterParams.keyGenerator = function(req){
+                    return req.ip;
+                };
+            }
+            this.app.use(this.rateLimit(limiterParams));
+        }
+        if(this.useXssProtection){
+            this.app.use(xss());
         }
         if(this.useExpressJson){
-            this.app.use(this.applicationFramework.json());
+            this.app.use(this.applicationFramework.json({
+                limit: this.jsonLimit,
+                verify: this.verifyContentTypeJson
+            }));
         }
         if(this.useUrlencoded){
-            this.app.use(this.bodyParser.urlencoded({extended: true}));
+            this.app.use(this.bodyParser.urlencoded({
+                extended: true,
+                limit: this.urlencodedLimit
+            }));
         }
         if('' !== this.trustedProxy){
             this.app.enable('trust proxy', this.trustedProxy);
@@ -60,19 +103,30 @@ class AppServerFactory
         return {app: this.app, appServer: this.appServer};
     }
 
+    verifyContentTypeJson(req, res, buf)
+    {
+        let contentType = req.headers['content-type'] || '';
+        if(
+            req.method === 'POST'
+            && 0 < buf.length
+            && !contentType.includes('application/json')
+            && !contentType.includes('multipart/form-data')
+        ){
+            throw new Error('Invalid content-type');
+        }
+    }
+
     createServer()
     {
         if(!this.useHttps){
             return http.createServer(this.app);
         }
-        let key = FileHandler.readFile(this.keyPath);
+        let key = FileHandler.readFile(this.keyPath, 'Key');
         if(!key){
-            this.errorMessage = 'Key file not found: ' + this.keyPath;
             return false;
         }
-        let cert = FileHandler.readFile(this.certPath);
+        let cert = FileHandler.readFile(this.certPath, 'Cert');
         if(!cert){
-            this.errorMessage = 'Cert file not found: ' + this.certPath;
             return false;
         }
         let credentials = {
@@ -81,7 +135,7 @@ class AppServerFactory
             passphrase: this.passphrase
         };
         if('' !== this.httpsChain){
-            let ca = FileHandler.readFile(this.httpsChain);
+            let ca = FileHandler.readFile(this.httpsChain, 'Certificate Authority');
             if(ca){
                 credentials.ca = ca;
             }
@@ -92,17 +146,17 @@ class AppServerFactory
     async enableServeHome(app, homePageLoadCallback)
     {
         let limiterParams = {
-            // default 60000 = 1 minute:
             windowMs: this.windowMs,
-            // limit each IP to 30 requests per windowMs:
             max: this.maxRequests,
+            standardHeaders: true,
+            legacyHeaders: false
         };
         if(this.applyKeyGenerator){
-            limiterParams.keyGenerator = function (req) {
+            limiterParams.keyGenerator = function(req){
                 return req.ip;
             };
         }
-        let limiter = rateLimit(limiterParams);
+        let limiter = this.rateLimit(limiterParams);
         app.post('/', limiter);
         app.post('/', async (req, res, next) => {
             if('/' === req._parsedUrl.pathname){
@@ -116,7 +170,12 @@ class AppServerFactory
                 if('function' !== typeof homePageLoadCallback){
                     return res.send('Homepage contents could not be loaded.');
                 }
-                return res.send(await homePageLoadCallback(req));
+                try {
+                    return res.send(await homePageLoadCallback(req));
+                } catch(error){
+                    this.errorMessage = 'Error loading homepage.';
+                    return res.status(500).send('Error loading homepage.');
+                }
             }
             next();
         });
@@ -124,12 +183,38 @@ class AppServerFactory
 
     async serveStatics(app, statics)
     {
-        app.use(this.applicationFramework.static(statics));
+        if(!FileHandler.isValidPath(statics)){
+            this.errorMessage = 'Invalid statics path.';
+            return;
+        }
+        let staticOptions = {
+            maxAge: '1d',
+            etag: true,
+            lastModified: true,
+            index: false,
+            setHeaders: function(res){
+                res.set('X-Content-Type-Options', 'nosniff');
+            }
+        };
+        app.use(this.applicationFramework.static(statics, staticOptions));
     }
 
     async serveStaticsPath(app, staticsPath, statics)
     {
-        app.use(staticsPath, this.applicationFramework.static(statics));
+        if(!FileHandler.isValidPath(staticsPath) || !FileHandler.isValidPath(statics)){
+            this.errorMessage = 'Invalid statics path to be served.';
+            return;
+        }
+        let staticOptions = {
+            maxAge: '1d',
+            etag: true,
+            lastModified: true,
+            index: false,
+            setHeaders: function(res){
+                res.set('X-Content-Type-Options', 'nosniff');
+            }
+        };
+        app.use(staticsPath, this.applicationFramework.static(statics, staticOptions));
     }
 
 }

package/lib/file-handler.js

@@ -24,13 +24,57 @@ class FileHandler
 
     exists(fullPath)
     {
+        if(!this.isValidPath(fullPath)){
+            this.error = {message: 'Invalid path.', fullPath};
+            return false;
+        }
         return fs.existsSync(fullPath);
     }
 
+    isValidPath(filePath)
+    {
+        if(!filePath){
+            return false;
+        }
+        let pathStr = String(filePath);
+        if(pathStr.includes('../') || pathStr.includes('..\\')){
+            return false;
+        }
+        return true;
+    }
+
+    sanitizePath(filePath)
+    {
+        if(!filePath){
+            return '';
+        }
+        let sanitized = String(filePath)
+            .replace(/\.\./g, '')
+            .replace(/[:*?"<>|]/g, '')
+            .substring(0, 255);
+        return sanitized;
+    }
+
+    generateSecureFilename(originalName)
+    {
+        let ext = path.extname(originalName).toLowerCase();
+        let randomStr = '';
+        let chars = 'abcdefghijklmnopqrstuvwxyz0123456789';
+        let charLength = chars.length;
+        for(let i = 0; i < 32; i++){
+            randomStr += chars.charAt(Math.floor(Math.random() * charLength));
+        }
+        return randomStr + ext;
+    }
+
     remove(fullPath)
     {
         try {
-            let deletePath = Array.isArray(fullPath) ? this.joinPaths(...fullPath) : fullPath
+            if(!this.isValidPath(fullPath)){
+                this.error = {message: 'Invalid path for removal.', fullPath};
+                return false;
+            }
+            let deletePath = Array.isArray(fullPath) ? this.joinPaths(...fullPath) : fullPath;
             if(fs.existsSync(deletePath)){
                 fs.rmSync(deletePath, {recursive: true, force: true});
                 return true;
@@ -44,6 +88,10 @@ class FileHandler
     createFolder(folderPath)
     {
         try {
+            if(!this.isValidPath(folderPath)){
+                this.error = {message: 'Invalid folder path.', folderPath};
+                return false;
+            }
             if(fs.existsSync(folderPath)){
                 return true;
             }
@@ -58,6 +106,10 @@ class FileHandler
     copyFolderSync(from, to)
     {
         try {
+            if(!this.isValidPath(from) || !this.isValidPath(to)){
+                this.error = {message: 'Invalid path for folder copy.', from, to};
+                return false;
+            }
             fs.mkdirSync(to, {recursive: true});
             let folders = fs.readdirSync(from);
             for(let element of folders){
@@ -80,6 +132,10 @@ class FileHandler
 
     copyFileSyncIfDoesNotExist(from, to)
     {
+        if(!this.isValidPath(from) || !this.isValidPath(to)){
+            this.error = {message: 'Invalid path for file copy.', from, to};
+            return false;
+        }
         if(!fs.existsSync(to)){
             return fs.copyFileSync(from, to);
         }
@@ -87,6 +143,10 @@ class FileHandler
 
     copyFile(from, to)
     {
+        if(!this.isValidPath(from) || !this.isValidPath(to)){
+            this.error = {message: 'Invalid path for file copy.', from, to};
+            return false;
+        }
         let origin = Array.isArray(from) ? this.joinPaths(...from) : from;
         let dest = Array.isArray(to) ? this.joinPaths(...to) : to;
         if(!this.exists(origin)){
@@ -109,11 +169,19 @@ class FileHandler
 
     readFolder(folder, options)
     {
+        if(!this.isValidPath(folder)){
+            this.error = {message: 'Invalid folder path.', folder};
+            return [];
+        }
         return fs.readdirSync(folder, options);
     }
 
     fetchSubFoldersList(folder, options)
     {
+        if(!this.isValidPath(folder)){
+            this.error = {message: 'Invalid folder path.', folder};
+            return [];
+        }
         let files = fs.readdirSync(folder, options);
         let subFolders = [];
         for(let file of files){
@@ -127,6 +195,10 @@ class FileHandler
 
     isFile(filePath)
     {
+        if(!this.isValidPath(filePath)){
+            this.error = {message: 'Invalid file path.', filePath};
+            return false;
+        }
         try {
             return fs.lstatSync(filePath).isFile();
         } catch (error) {
@@ -137,6 +209,10 @@ class FileHandler
 
     permissionsCheck(systemPath)
     {
+        if(!this.isValidPath(systemPath)){
+            this.error = {message: 'Invalid system path.', systemPath};
+            return false;
+        }
         try {
             let crudTestPath = path.join(systemPath, 'crud-test');
             fs.mkdirSync(crudTestPath, {recursive: true});
@@ -150,49 +226,84 @@ class FileHandler
 
     fetchFileJson(filePath)
     {
+        if(!this.isValidPath(filePath)){
+            this.error = {message: 'Invalid file path.', filePath};
+            return false;
+        }
         let fileContents = this.fetchFileContents(filePath);
         if(!fileContents){
             this.error = {message: 'Failed to fetch file contents.', filePath};
             return false;
         }
-        let importedJson = JSON.parse(fileContents);
-        if(!importedJson){
-            this.error = {message: 'Can not parse data file.', filePath};
+        try {
+            return JSON.parse(fileContents);
+        } catch(error){
+            this.error = {message: 'Can not parse data file.', filePath, error};
             return false;
         }
-        return importedJson;
     }
 
     fetchFileContents(filePath)
     {
+        if(!this.isValidPath(filePath)){
+            this.error = {message: 'Invalid file path.', filePath};
+            return false;
+        }
         if(!this.isFile(filePath)){
             this.error = {message: 'File check failed to fetch file contents.', filePath};
             return false;
         }
-        let fileContent = this.readFile(filePath);
-        if(!fileContent){
-            this.error = {message: 'Can not read data or empty file.', filePath};
+        try {
+            let fileContent = this.readFile(filePath);
+            if(!fileContent){
+                this.error = {message: 'Can not read data or empty file.', filePath};
+                return false;
+            }
+            return fileContent;
+        } catch(error){
+            this.error = {message: 'Error reading file.', filePath, error};
             return false;
         }
-        return fileContent;
     }
 
     readFile(filePath)
     {
+        if(!this.isValidPath(filePath)){
+            this.error = {message: 'Invalid file path.', filePath};
+            return false;
+        }
         if(!filePath){
             this.error = {message: 'Missing data file.', filePath};
             return false;
         }
-        return fs.readFileSync(filePath, {encoding: this.encoding, flag: 'r'});
+        try {
+            return fs.readFileSync(filePath, {encoding: this.encoding, flag: 'r'});
+        } catch(error){
+            this.error = {message: 'Error reading file.', filePath, error};
+            return false;
+        }
     }
 
     async updateFileContents(filePath, contents)
     {
-        return fs.writeFileSync(fs.openSync(filePath, 'w+'), contents);
+        if(!this.isValidPath(filePath)){
+            this.error = {message: 'Invalid file path.', filePath};
+            return false;
+        }
+        try {
+            return fs.writeFileSync(fs.openSync(filePath, 'w+'), contents);
+        } catch(error){
+            this.error = {message: 'Error updating file.', filePath, error};
+            return false;
+        }
     }
 
     writeFile(fileName, content)
     {
+        if(!this.isValidPath(fileName)){
+            this.error = {message: 'Invalid file name.', fileName};
+            return false;
+        }
         try {
             fs.writeFileSync(fileName, content, this.encoding);
             return true;
@@ -202,6 +313,66 @@ class FileHandler
         return false;
     }
 
+    validateFileType(filePath, allowedType, allowedFileTypes, maxFileSize)
+    {
+        if(!this.isFile(filePath)){
+            return false;
+        }
+        let extension = path.extname(filePath).toLowerCase();
+        let allowedExtensions = allowedFileTypes[allowedType] || allowedFileTypes.any;
+        if(0 === allowedExtensions.length){
+            return true;
+        }
+        if(!allowedExtensions.includes(extension)){
+            this.error = {message: 'Invalid file extension.', extension, allowedType};
+            return false;
+        }
+        let fileSize = fs.statSync(filePath).size;
+        if(fileSize > maxFileSize){
+            this.error = {message: 'File too large.', fileSize, maxFileSize};
+            return false;
+        }
+        return true;
+    }
+
+    isValidJson(filePath)
+    {
+        if(!this.isFile(filePath)){
+            return false;
+        }
+        try {
+            JSON.parse(this.readFile(filePath));
+            return true;
+        } catch(error){
+            this.error = {message: 'Invalid JSON file.', filePath, error};
+            return false;
+        }
+    }
+
+    getFirstFileBytes(filePath, bytes = 4100)
+    {
+        if(!this.isFile(filePath)){
+            return null;
+        }
+        let fd;
+        try {
+            fd = fs.openSync(filePath, 'r');
+            let buffer = Buffer.alloc(bytes);
+            let bytesRead = fs.readSync(fd, buffer, 0, bytes, 0);
+            fs.closeSync(fd);
+            return buffer.slice(0, bytesRead);
+        } catch(err){
+            if(fd !== undefined){
+                try {
+                    fs.closeSync(fd);
+                } catch(e){
+                }
+            }
+            this.error = {message: 'Error reading file head.', filePath, error: err};
+            return null;
+        }
+    }
+
 }
 
 module.exports.FileHandler = new FileHandler();

package/lib/uploader-factory.js

@@ -12,45 +12,157 @@ class UploaderFactory
 
     constructor(props)
     {
-        this.mimeTypes = props.mimeTypes;
+        this.mimeTypes = props.mimeTypes || {};
         this.error = {message: ''};
+        this.maxFileSize = props.maxFileSize || 20 * 1024 * 1024;
+        this.fileLimit = props.fileLimit || 0;
+        this.allowedExtensions = props.allowedExtensions;
+        this.applySecureFileNames = props.applySecureFileNames;
     }
 
     createUploader(fields, buckets, allowedFileTypes)
     {
-        let storage = multer.diskStorage({
+        if(!this.validateInputs(fields, buckets, allowedFileTypes)){
+            throw new Error('Invalid uploader configuration: ' + this.error.message);
+        }
+        let diskStorageConfiguration = {
             destination: (req, file, cb) => {
-                cb(null, buckets[file.fieldname]);
-            },
-            filename: (req,file,cb) => {
-                cb(null, file.originalname);
+                let dest = buckets[file.fieldname];
+                if(!FileHandler.isValidPath(dest)){
+                    return cb(new Error('Invalid destination path'));
+                }
+                FileHandler.createFolder(dest);
+                cb(null, dest);
             }
-        })
-        return multer({
+        };
+        if(this.applySecureFileNames){
+            diskStorageConfiguration['filename'] = (req, file, cb) => {
+                let secureFilename = FileHandler.generateSecureFilename(file.originalname);
+                if(!req.fileNameMapping){
+                    req.fileNameMapping = {};
+                }
+                req.fileNameMapping[secureFilename] = file.originalname;
+                cb(null, secureFilename);
+            };
+        }
+        let storage = multer.diskStorage(diskStorageConfiguration);
+        let limits = {
+            fileSize: this.maxFileSize
+        };
+        if(0 < this.fileLimit){
+            limits['files'] = this.fileLimit;
+        }
+        let upload = multer({
             storage,
+            limits,
             fileFilter: (req, file, cb) => {
-                return this.checkFileType(file, allowedFileTypes[file.fieldname], cb);
+                return this.validateFile(file, allowedFileTypes[file.fieldname], cb);
+            }
+        });
+        return (req, res, next) => {
+            upload.fields(fields)(req, res, async (err) => {
+                if(err){
+                    if(err instanceof multer.MulterError){
+                        if(err.code === 'LIMIT_FILE_SIZE'){
+                            return res.status(413).send('File too large');
+                        }
+                        if(err.code === 'LIMIT_FILE_COUNT'){
+                            return res.status(413).send('Too many files');
+                        }
+                        return res.status(400).send('File upload error: ' + err.message);
+                    }
+                    return res.status(500).send('Server error during file upload');
+                }
+                if(!req.files){
+                    return next();
+                }
+                try {
+                    for(let fieldName in req.files){
+                        for(let file of req.files[fieldName]){
+                            if(!await this.validateFileContents(file, allowedFileTypes[fieldName])){
+                                if(FileHandler.exists(file.path)){
+                                    FileHandler.remove(file.path);
+                                }
+                                return res.status(415).send('File contents do not match declared type');
+                            }
+                        }
+                    }
+                    next();
+                } catch(error){
+                    console.error('File validation error:', error);
+                    this.cleanupFiles(req.files);
+                    return res.status(500).send('Error processing uploaded files');
+                }
+            });
+        };
+    }
+
+    validateInputs(fields, buckets, allowedFileTypes)
+    {
+        if(!Array.isArray(fields)){
+            this.error = {message: 'Fields must be an array'};
+            return false;
+        }
+        if(!buckets || typeof buckets !== 'object'){
+            this.error = {message: 'Buckets must be an object'};
+            return false;
+        }
+        if(!allowedFileTypes || typeof allowedFileTypes !== 'object'){
+            this.error = {message: 'AllowedFileTypes must be an object'};
+            return false;
+        }
+        for(let field of fields){
+            if(!field.name || typeof field.name !== 'string'){
+                this.error = {message: 'Field name is invalid'};
+                return false;
+            }
+            if(!Object.prototype.hasOwnProperty.call(buckets, field.name)){
+                this.error = {message: `Missing bucket for field: ${field.name}`};
+                return false;
             }
-        }).fields(fields);
+            if(!Object.prototype.hasOwnProperty.call(allowedFileTypes, field.name)){
+                this.error = {message: `Missing allowedFileType for field: ${field.name}`};
+                return false;
+            }
+        }
+        return true;
     }
 
-    checkFileType(file, allowedFileTypes, cb)
+    validateFile(file, allowedFileType, cb)
     {
-        if(!allowedFileTypes){
+        if(!allowedFileType){
             return cb(null, true);
         }
-        let allowedFileTypeCheck = this.convertToRegex(allowedFileTypes);
-        if(!allowedFileTypeCheck){
-            this.error = {message: 'File type could not be converted to regex.', allowedFileTypes};
+        let fileExtension = FileHandler.extension(file.originalname).toLowerCase();
+        let allowedExtensions = this.allowedExtensions[allowedFileType];
+        if(allowedExtensions && !allowedExtensions.includes(fileExtension)){
+            this.error = {message: `Invalid file extension: ${fileExtension}`};
             return cb(null, false);
         }
-        let extension = allowedFileTypeCheck.test(FileHandler.extension(file.originalname).toLowerCase());
-        let mimeType = allowedFileTypeCheck.test(file.mimetype);
-        if(mimeType && extension){
-            return cb(null, true);
+        let allowedFileTypeRegex = this.convertToRegex(allowedFileType);
+        if(!allowedFileTypeRegex){
+            this.error = {message: 'File type could not be converted to regex.', allowedFileType};
+            return cb(null, false);
+        }
+        let mimeTypeValid = allowedFileTypeRegex.test(file.mimetype);
+        if(!mimeTypeValid){
+            this.error = {message: `Invalid MIME type: ${file.mimetype}`};
+            return cb(null, false);
+        }
+        return cb(null, true);
+    }
+
+    async validateFileContents(file, allowedFileType)
+    {
+        try {
+            if(!FileHandler.isFile(file.path)){
+                return false;
+            }
+            return FileHandler.validateFileType(file.path, allowedFileType, this.allowedExtensions, this.maxFileSize);
+        } catch(err){
+            console.error('Error validating file contents:', err);
+            return false;
         }
-        this.error = {message: 'File type not supported.', extension, mimeType, allowedFileTypes};
-        return cb(null, false);
     }
 
     convertToRegex(key)
@@ -58,10 +170,29 @@ class UploaderFactory
         if(!this.mimeTypes[key]){
             return false;
         }
-        let types = this.mimeTypes[key].map(type => type.split('/').pop().replace('+', '\\+'));
+        let types = this.mimeTypes[key].map(type =>
+            type.split('/').pop().replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+        );
         return new RegExp(types.join('|'));
     }
 
+    cleanupFiles(files)
+    {
+        if(!files){
+            return;
+        }
+        for(let fieldName in files){
+            for(let file of files[fieldName]){
+                try {
+                    if(FileHandler.exists(file.path)){
+                        FileHandler.remove(file.path);
+                    }
+                } catch(err){
+                    console.error('Error cleaning up file:', file.path, err);
+                }
+            }
+        }
+    }
 }
 
 module.exports.UploaderFactory = UploaderFactory;

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@reldens/server-utils",
     "scope": "@reldens",
-    "version": "0.6.0",
+    "version": "0.8.0",
     "description": "Reldens - Server Utils",
     "author": "Damian A. Pastorini",
     "license": "MIT",
@@ -40,6 +40,8 @@
         "express": "4.21.2",
         "express-rate-limit": "7.5.0",
         "express-session": "1.18.1",
-        "multer": "^1.4.5-lts.2"
+        "helmet": "8.1.0",
+        "multer": "^1.4.5-lts.2",
+        "xss-clean": "^0.1.4"
     }
 }