@riocrypto/common-server 1.0.1901 → 1.0.1903

package/build/helpers/send-with-xss-guard.d.ts

@@ -0,0 +1,2 @@
+import { Response } from "express";
+export declare function sendWithXSSGuard(res: Response, data: any, statusCode: number): void;

package/build/helpers/{sanitize-and-send.js → send-with-xss-guard.js}

@@ -3,10 +3,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sanitizeAndSend = void 0;
+exports.sendWithXSSGuard = void 0;
 const xss_1 = __importDefault(require("xss"));
-function sanitizeAndSend(res, data, statusCode) {
+function sendWithXSSGuard(res, data, statusCode) {
     const sanitizedData = (0, xss_1.default)(data);
     res.status(statusCode).send(sanitizedData);
 }
-exports.sanitizeAndSend = sanitizeAndSend;
+exports.sendWithXSSGuard = sendWithXSSGuard;

package/build/index.d.ts

@@ -6,6 +6,7 @@ export * from "./middlewares/not-sandbox";
 export * from "./middlewares/set-trace";
 export * from "./middlewares/require-min-role";
 export * from "./middlewares/require-min-admin-role";
+export * from "./middlewares/csrf-protection";
 export * from "./services/apiKey";
 export * from "./services/password";
 export * from "./services/logger";
@@ -97,4 +98,4 @@ export * from "./helpers/get-tax-rate";
 export * from "./helpers/get-asset-price";
 export * from "./helpers/generate-payment-reference";
 export * from "./helpers/get-order-from-reference";
-export * from "./helpers/sanitize-and-send";
+export * from "./helpers/send-with-xss-guard";

package/build/index.js

@@ -22,6 +22,7 @@ __exportStar(require("./middlewares/not-sandbox"), exports);
 __exportStar(require("./middlewares/set-trace"), exports);
 __exportStar(require("./middlewares/require-min-role"), exports);
 __exportStar(require("./middlewares/require-min-admin-role"), exports);
+__exportStar(require("./middlewares/csrf-protection"), exports);
 __exportStar(require("./services/apiKey"), exports);
 __exportStar(require("./services/password"), exports);
 __exportStar(require("./services/logger"), exports);
@@ -113,4 +114,4 @@ __exportStar(require("./helpers/get-tax-rate"), exports);
 __exportStar(require("./helpers/get-asset-price"), exports);
 __exportStar(require("./helpers/generate-payment-reference"), exports);
 __exportStar(require("./helpers/get-order-from-reference"), exports);
-__exportStar(require("./helpers/sanitize-and-send"), exports);
+__exportStar(require("./helpers/send-with-xss-guard"), exports);

package/build/middlewares/csrf-protection.d.ts

@@ -0,0 +1,5 @@
+/// <reference types="qs" />
+import { Request, Response, NextFunction } from "express";
+declare const csrfProtection: import("express-serve-static-core").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
+declare const csrfErrorHandler: (err: any, req: Request, res: Response, next: NextFunction) => void;
+export { csrfProtection, csrfErrorHandler };

package/build/middlewares/csrf-protection.js

@@ -0,0 +1,19 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.csrfErrorHandler = exports.csrfProtection = void 0;
+const csurf_1 = __importDefault(require("csurf"));
+// Initialize CSRF protection middleware
+const csrfProtection = (0, csurf_1.default)();
+exports.csrfProtection = csrfProtection;
+// Error handling middleware for CSRF token errors
+const csrfErrorHandler = (err, req, res, next) => {
+    if (err.code !== "EBADCSRFTOKEN")
+        return next(err);
+    // CSRF token errors
+    res.status(403);
+    res.send("Form tampered with");
+};
+exports.csrfErrorHandler = csrfErrorHandler;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.1901",
+  "version": "1.0.1903",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -16,6 +16,7 @@
   "license": "ISC",
   "devDependencies": {
     "@types/crypto-js": "^4.1.1",
+    "@types/csurf": "^1.11.5",
     "@types/he": "^1.2.0",
     "@types/jsonwebtoken": "^8.5.8",
     "@types/uuid": "^9.0.1",
@@ -30,6 +31,7 @@
     "@types/express": "^4.17.13",
     "axios": "^1.7.4",
     "crypto-js": "^4.2.0",
+    "csurf": "^1.11.0",
     "express": "^4.21.1",
     "express-validator": "^6.14.2",
     "fireblocks-sdk": "^5.13.0",

package/build/helpers/sanitize-and-send.d.ts

@@ -1,2 +0,0 @@
-import { Response } from "express";
-export declare function sanitizeAndSend(res: Response, data: any, statusCode: number): void;