fhirsmith 0.11.2 → 0.13.0

package/publisher/publisher.js

@@ -1,13 +1,20 @@
 const express = require('express');
 const path = require('path');
 const fs = require('fs');
+const validation = require('./validation');
 const Database = require('sqlite3').Database;
 const bcrypt = require('bcrypt');
 const session = require('express-session');
+const rateLimit = require('express-rate-limit');
+const crypto = require('crypto');
 const folders = require('../library/folder-setup');
 const escape = require('escape-html');
 const {Utilities} = require("../library/utilities");
 
+// GitHub refuses any file larger than this at the pre-receive hook, and the rejection takes down
+// the whole push rather than just the offending file.
+const GITHUB_MAX_FILE_SIZE = 100 * 1024 * 1024;
+
 
 class PublisherModule {
   constructor(stats) {
@@ -30,11 +37,28 @@ class PublisherModule {
     await this.initializeDatabase();
 
     // Set up session middleware - use in-memory sessions or separate session db
+    if (!this.config.sessionSecret) {
+      // Never fall back to a constant. This project is open source, so a fixed default
+      // secret is a published signing key: anyone could mint themselves an admin session
+      // on any deployment that forgot the setting, and nothing about the server would
+      // look wrong. A random secret fails safe instead - sessions simply do not survive
+      // a restart, which is visible and harmless. token.js does the same.
+      this.logger.warn('publisher: no sessionSecret configured - using a random one, so ' +
+        'logins will not survive a restart. Set modules.publisher.sessionSecret.');
+    }
     this.router.use(session({
-      secret: this.config.sessionSecret || 'your-secret-key-change-this',
+      secret: this.config.sessionSecret || crypto.randomBytes(64).toString('hex'),
       resave: false,
       saveUninitialized: false,
-      cookie: { secure: false, maxAge: 24 * 60 * 60 * 1000 } // 24 hours
+      cookie: {
+        // Secure by default: the cookie is then only ever sent over HTTPS. Express is
+        // configured to trust the proxy, so this works behind an NGINX TLS terminator
+        // reporting X-Forwarded-Proto. Set cookieSecure false to run the publisher over
+        // plain HTTP - without it the browser will not send the cookie back and login
+        // appears to succeed and then silently do nothing.
+        secure: this.config.cookieSecure ?? true,
+        maxAge: 24 * 60 * 60 * 1000 // 24 hours
+      }
       // Not using SQLiteStore to avoid the database conflict
     }));
 
@@ -272,9 +296,20 @@ class PublisherModule {
     // Main dashboard
     this.router.get('/', this.renderDashboard.bind(this));
 
-    // Authentication
+    // Authentication. The login post is rate limited: besides slowing down guessing, it
+    // is the one unauthenticated route that runs bcrypt, and bcrypt.compare holds a libuv
+    // threadpool thread (4 by default) for ~100ms - so without a limit a handful of
+    // concurrent attempts stall every file operation the server wants to do.
+    const loginLimiter = rateLimit({
+      windowMs: 15 * 60 * 1000,
+      max: this.config.loginAttemptsPerWindow ?? 20,
+      message: 'Too many login attempts, please try again later.',
+      standardHeaders: true,
+      legacyHeaders: false
+    });
+
     this.router.get('/login', this.renderLogin.bind(this));
-    this.router.post('/login', this.handleLogin.bind(this));
+    this.router.post('/login', loginLimiter, this.handleLogin.bind(this));
     this.router.post('/logout', this.handleLogout.bind(this));
 
     // Tasks
@@ -928,6 +963,137 @@ class PublisherModule {
     }
   }
 
+  // The IG Publisher can leave a file in the web folder that GitHub will not accept - typically a
+  // technical correction archive, which is a zip of an entire published version folder and so
+  // carries that folder's own full-ig.zip inside it. GitHub rejects the entire push over one such
+  // file, at the very last step of a publication run. The IG Publisher will keep these out of the
+  // web folder itself from the next release; until then, move them aside here.
+  //
+  // Does nothing unless publisher.large-file-archive says where to put them, and the website is
+  // one that's hosted on GitHub in the first place.
+  async archiveLargeFiles(task, website) {
+    const configured = this.config['large-file-archive'];
+    if (!configured || !this.isGitHubHosted(website)) {
+      return;
+    }
+    const root = website.git_root || website.local_folder;
+    const oversized = this.findLargeFiles(root, GITHUB_MAX_FILE_SIZE);
+    if (oversized.length === 0) {
+      return;
+    }
+
+    const archiveDir = path.isAbsolute(configured)
+        ? configured
+        : folders.filePath('publisher', configured);
+    if (!fs.existsSync(archiveDir)) {
+      fs.mkdirSync(archiveDir, { recursive: true });
+    }
+
+    for (const file of oversized) {
+      const sizeMB = Math.round(fs.statSync(file).size / (1024 * 1024));
+      const dest = this.nonClashingPath(archiveDir, path.basename(file));
+      this.moveFile(file, dest);
+      await this.logTaskMessage(task.id, 'warn', 'Large file ' + path.relative(root, file) + ' (' + sizeMB +
+          ' MB) is over the 100 MB GitHub limit - moved to ' + dest + ' instead of being published');
+    }
+  }
+
+  // Only a website kept in a GitHub repository has a 100MB problem - others can carry files of any
+  // size. $.website.github in the web root's publish-setup.json says which is which; if that can't
+  // be read, or doesn't say, assume not and leave the files where they are.
+  isGitHubHosted(website) {
+    if (!website.local_folder) {
+      return false;
+    }
+    const setupPath = path.join(website.local_folder, 'publish-setup.json');
+    try {
+      const setup = JSON.parse(fs.readFileSync(setupPath, 'utf8'));
+      return !!(setup.website && setup.website.github === true);
+    } catch (err) {
+      this.logger.warn('Could not read ' + setupPath + ' to check whether the website is on GitHub: ' + err.message);
+      return false;
+    }
+  }
+
+  // Files in the web folder that are too big to push. Never descends into .git: a pack file over the
+  // limit is perfectly normal there, and moving it would destroy the repository. Files git is already
+  // ignoring are left alone, since they were never going to be pushed anyway.
+  findLargeFiles(root, limit) {
+    const found = [];
+    const walk = (dir) => {
+      let entries;
+      try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+      } catch (err) {
+        this.logger.warn('Large file scan could not read ' + dir + ': ' + err.message);
+        return;
+      }
+      for (const entry of entries) {
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+          if (entry.name !== '.git') {
+            walk(full);
+          }
+        } else if (entry.isFile()) {
+          try {
+            if (fs.statSync(full).size > limit) {
+              found.push(full);
+            }
+          } catch (err) {
+            // the file went away between readdir and stat - nothing left to move
+          }
+        }
+      }
+    };
+    walk(root);
+    return found.length === 0 ? found : this.removeGitIgnored(root, found);
+  }
+
+  removeGitIgnored(root, files) {
+    try {
+      const result = require('child_process').spawnSync('git', ['check-ignore', '--stdin'],
+          { cwd: root, input: files.join('\n'), encoding: 'utf8' });
+      // exit 0: at least one path is ignored. 1: none are. anything else: git could not tell us,
+      // in which case treat everything as pushable rather than leaving a file that breaks the push.
+      if (result.status !== 0 || !result.stdout) {
+        return files;
+      }
+      const ignored = new Set(result.stdout.split('\n').map((s) => s.trim()).filter((s) => s));
+      return files.filter((f) => !ignored.has(f));
+    } catch (err) {
+      this.logger.warn('Could not check the gitignore status of large files: ' + err.message);
+      return files;
+    }
+  }
+
+  nonClashingPath(dir, name) {
+    let candidate = path.join(dir, name);
+    if (!fs.existsSync(candidate)) {
+      return candidate;
+    }
+    const ext = path.extname(name);
+    const stem = path.basename(name, ext);
+    let i = 2;
+    do {
+      candidate = path.join(dir, stem + '-' + i + ext);
+      i++;
+    } while (fs.existsSync(candidate));
+    return candidate;
+  }
+
+  // rename() fails across filesystems, and the archive folder will not always be on the same one
+  moveFile(src, dest) {
+    try {
+      fs.renameSync(src, dest);
+    } catch (err) {
+      if (err.code !== 'EXDEV') {
+        throw err;
+      }
+      fs.copyFileSync(src, dest);
+      fs.unlinkSync(src);
+    }
+  }
+
   async runPublication(task) {
     const website = await this.getWebsite(task.website_id);
     if (!website) {
@@ -1016,6 +1182,9 @@ class PublisherModule {
     // url - can survive into the web tree. Catch that here, before anything is committed.
     await this.verifyPublishedPackage(task, website, draftDir);
 
+    // Step 5c: Move anything too big for GitHub out of the web folder, before it gets staged
+    await this.archiveLargeFiles(task, website);
+
     // Step 6: Commit and push the web folder
     await this.logTaskMessage(task.id, 'info', 'Committing changes to web folder...');
     const gitUrl = 'https://github.com/' + task.github_org + '/' + task.github_repo + '.git';
@@ -1181,7 +1350,7 @@ class PublisherModule {
         content += '<div class="col-12">';
 
         if (req.session.userId) {
-          content += '<p>Welcome, ' + req.session.userName + '!</p>';
+          content += '<p>Welcome, ' + escape(req.session.userName) + '!</p>';
           content += '<div class="mb-3">';
           content += '<a href="/publisher/tasks" class="btn btn-primary me-2">View All Tasks</a>';
           if (req.session.isAdmin) {
@@ -1209,11 +1378,11 @@ class PublisherModule {
           tasks.forEach(task => {
             content += '<tr>';
             content += '<td><strong>#' + task.id + '</strong></td>';
-            content += '<td>' + task.npm_package_id + '</td>';
-            content += '<td>' + task.version + '</td>';
-            content += '<td><span class="badge bg-' + this.getStatusColor(task.status) + '">' + task.status + '</span></td>';
+            content += '<td>' + escape(task.npm_package_id) + '</td>';
+            content += '<td>' + escape(task.version) + '</td>';
+            content += '<td><span class="badge bg-' + this.getStatusColor(task.status) + '">' + escape(task.status) + '</span></td>';
             content += '<td>' + new Date(task.queued_at).toLocaleString() + '</td>';
-            content += '<td>' + task.user_name + '</td>';
+            content += '<td>' + escape(task.user_name) + '</td>';
             content += '</tr>';
           });
 
@@ -1363,23 +1532,23 @@ class PublisherModule {
           content += '</div>';
           content += '<div class="col-md-3">';
           content += '<label for="github_org" class="form-label">GitHub Org</label>';
-          content += '<input type="text" class="form-control" id="github_org" name="github_org" required placeholder="hl7">';
+          content += '<input type="text" class="form-control" id="github_org" name="github_org" required maxlength="39" pattern="' + escape(validation.HTML_PATTERNS.github_org) + '" title="Letters, digits and single hyphens" placeholder="hl7">';
           content += '</div>';
           content += '<div class="col-md-3">';
           content += '<label for="github_repo" class="form-label">GitHub Repo</label>';
-          content += '<input type="text" class="form-control" id="github_repo" name="github_repo" required placeholder="fhir-us-core">';
+          content += '<input type="text" class="form-control" id="github_repo" name="github_repo" required maxlength="100" pattern="' + escape(validation.HTML_PATTERNS.github_repo) + '" title="Letters, digits, dots, hyphens and underscores" placeholder="fhir-us-core">';
           content += '</div>';
           content += '<div class="col-md-3">';
           content += '<label for="git_branch" class="form-label">Branch</label>';
-          content += '<input type="text" class="form-control" id="git_branch" name="git_branch" required placeholder="main">';
+          content += '<input type="text" class="form-control" id="git_branch" name="git_branch" required maxlength="255" pattern="' + escape(validation.HTML_PATTERNS.git_branch) + '" title="A git branch name - slashes are fine, but not spaces, backslashes, markup characters, or any of ~ ^ : ? * [" placeholder="main">';
           content += '</div>';
           content += '<div class="col-md-4">';
           content += '<label for="npm_package_id" class="form-label">NPM Package ID</label>';
-          content += '<input type="text" class="form-control" id="npm_package_id" name="npm_package_id" required placeholder="hl7.fhir.us.core">';
+          content += '<input type="text" class="form-control" id="npm_package_id" name="npm_package_id" required maxlength="128" pattern="' + escape(validation.HTML_PATTERNS.npm_package_id) + '" title="Letters, digits, dots, hyphens and underscores" placeholder="hl7.fhir.us.core">';
           content += '</div>';
           content += '<div class="col-md-4">';
           content += '<label for="version" class="form-label">Version</label>';
-          content += '<input type="text" class="form-control" id="version" name="version" required placeholder="6.0.0">';
+          content += '<input type="text" class="form-control" id="version" name="version" required maxlength="64" pattern="' + escape(validation.HTML_PATTERNS.version) + '" title="Letters, digits, dots, hyphens and plus signs" placeholder="6.0.0">';
           content += '</div>';
           content += '<div class="col-md-4 d-flex align-items-end">';
           content += '<button type="submit" class="btn btn-primary">Create Task</button>';
@@ -1415,13 +1584,13 @@ class PublisherModule {
 
             content += '<tr>';
             content += '<td><strong>#' + task.id + '</strong></td>';
-            content += '<td><code>' + task.npm_package_id + '</code></td>';
-            content += '<td>' + task.version + '</td>';
-            content += '<td>' + task.website_name + '</td>';
-            content += '<td><span class="badge bg-' + this.getStatusColor(task.status) + '">' + task.status + '</span></td>';
+            content += '<td><code>' + escape(task.npm_package_id) + '</code></td>';
+            content += '<td>' + escape(task.version) + '</td>';
+            content += '<td>' + escape(task.website_name) + '</td>';
+            content += '<td><span class="badge bg-' + this.getStatusColor(task.status) + '">' + escape(task.status) + '</span></td>';
             content += '<td>' + (task.publisher_version ? '<code>' + escape(task.publisher_version) + '</code>' : '<span class="text-muted">—</span>') + '</td>';
             content += '<td>' + new Date(task.queued_at).toLocaleString() + '</td>';
-            content += '<td>' + task.user_name + '</td>';
+            content += '<td>' + escape(task.user_name) + '</td>';
             content += '<td class="task-actions">';
             content += '<a href="/publisher/tasks/' + task.id + '/history" class="btn btn-sm btn-outline-secondary me-1">History</a>';
 
@@ -1495,6 +1664,15 @@ class PublisherModule {
       try {
         const {website_id, github_org, github_repo, git_branch, npm_package_id, version} = req.body;
 
+        // Check the input before it goes anywhere near a git command line or a
+        // file name. The browser checks these too (see HTML_PATTERNS), but the
+        // form isn't the only way to reach this route.
+        const problems = validation.validateTaskInput(req.body);
+        if (problems.length > 0) {
+          this.logger.warn('Rejected task creation from user ' + req.session.userId + ': ' + problems.join('; '));
+          return res.status(400).send('Invalid task details: ' + problems.join('; '));
+        }
+
         // Verify user has permission for this website
         const canQueue = await this.userCanQueue(req.session.userId, website_id);
         if (!canQueue) {
@@ -1720,20 +1898,20 @@ class PublisherModule {
 
         if (req.headers.accept && req.headers.accept.includes('text/html')) {
           const htmlServer = require('../library/html-server');
-          let content = '<h3>Task Output: #' + task.id + ' - ' + task.npm_package_id + '#' + task.version + '</h3>';
-          content += '<p><strong>Status:</strong> <span class="badge bg-' + this.getStatusColor(task.status) + '">' + task.status + '</span></p>';
-          content += '<p><strong>GitHub:</strong> ' + task.github_org + '/' + task.github_repo + ' (' + task.git_branch + ')</p>';
+          let content = '<h3>Task Output: #' + task.id + ' - ' + escape(task.npm_package_id) + '#' + escape(task.version) + '</h3>';
+          content += '<p><strong>Status:</strong> <span class="badge bg-' + this.getStatusColor(task.status) + '">' + escape(task.status) + '</span></p>';
+          content += '<p><strong>GitHub:</strong> ' + escape(task.github_org) + '/' + escape(task.github_repo) + ' (' + escape(task.git_branch) + ')</p>';
 
           if (task.publisher_version) {
             content += '<p><strong>IG Publisher:</strong> <code>' + escape(task.publisher_version) + '</code></p>';
           }
 
           if (task.local_folder) {
-            content += '<p><strong>Local Folder:</strong> <code>' + task.local_folder + '</code></p>';
+            content += '<p><strong>Local Folder:</strong> <code>' + escape(task.local_folder) + '</code></p>';
           }
 
           if (task.failure_reason) {
-            content += '<div class="alert alert-danger"><strong>Failure Reason:</strong> ' + task.failure_reason + '</div>';
+            content += '<div class="alert alert-danger"><strong>Failure Reason:</strong> ' + escape(task.failure_reason) + '</div>';
           }
 
           // Task logs section
@@ -1745,7 +1923,7 @@ class PublisherModule {
             logs.forEach(log => {
               const timestamp = new Date(log.timestamp).toLocaleString();
               const levelClass = log.level === 'error' ? 'text-danger' : (log.level === 'warn' ? 'text-warning' : '');
-              content += '<div class="' + levelClass + '">[' + timestamp + '] [' + log.level.toUpperCase() + '] ' + log.message + '</div>';
+              content += '<div class="' + levelClass + '">[' + timestamp + '] [' + escape(log.level.toUpperCase()) + '] ' + escape(log.message) + '</div>';
             });
             content += '</div>';
           }
@@ -1861,7 +2039,7 @@ class PublisherModule {
         content += '<div class="card mb-4"><div class="card-body">';
         content += '<div class="row">';
         content += '<div class="col-md-6">';
-        content += '<p><strong>Status:</strong> <span class="badge bg-' + this.getStatusColor(task.status) + '">' + task.status + '</span></p>';
+        content += '<p><strong>Status:</strong> <span class="badge bg-' + this.getStatusColor(task.status) + '">' + escape(task.status) + '</span></p>';
         content += '<p><strong>Package:</strong> <code>' + escape(task.npm_package_id) + '</code></p>';
         content += '<p><strong>Version:</strong> ' + escape(task.version) + '</p>';
         content += '<p><strong>Website:</strong> ' + escape(task.website_name) + '</p>';
@@ -1937,7 +2115,7 @@ class PublisherModule {
           if (action.action === 'create_task') actionLabel = 'Created task';
           else if (action.action === 'approve_task') actionLabel = 'Approved task';
           else if (action.action === 'delete_task') actionLabel = 'Deleted task';
-          else actionLabel = action.action.replace(/_/g, ' ');
+          else actionLabel = escape(action.action.replace(/_/g, ' '));
 
           events.push({
             timestamp: action.timestamp,
@@ -2158,7 +2336,7 @@ class PublisherModule {
 
           websites.forEach(website => {
             content += '<tr>';
-            content += '<td>' + website.name + '</td>';
+            content += '<td>' + escape(website.name) + '</td>';
             content += '<td><code>' + escape(website.local_folder) + '</code></td>';
             content += '<td><code>' + escape(website.git_root || '') + '</code></td>';
             content += '<td><code>' + escape(website.history_templates) + '</code></td>';
@@ -2279,7 +2457,7 @@ class PublisherModule {
 
             content += '<div class="card mb-3">';
             content += '<div class="card-header">';
-            content += '<h5>' + user.name + ' (' + user.login + ') ' + (user.is_admin ? '<span class="badge bg-warning">Admin</span>' : '') + '</h5>';
+            content += '<h5>' + escape(user.name) + ' (' + escape(user.login) + ') ' + (user.is_admin ? '<span class="badge bg-warning">Admin</span>' : '') + '</h5>';
             content += '</div>';
             content += '<div class="card-body">';
 
@@ -2295,7 +2473,7 @@ class PublisherModule {
 
               websites.forEach(website => {
                 const perm = permissions.find(p => p.website_id === website.id) || {};
-                content += '<div>' + website.name + '</div>';
+                content += '<div>' + escape(website.name) + '</div>';
                 content += '<div>';
                 content += '<input type="checkbox" name="queue_' + website.id + '"' + (perm.can_queue ? ' checked' : '') + '>';
                 content += '</div>';

package/publisher/validation.js

@@ -0,0 +1,210 @@
+/**
+ * Validation for the fields a user types into the publication task form.
+ *
+ * None of these values can cause command injection - they're passed to spawn()
+ * as argv, and nothing goes near a shell - but they do end up in git command
+ * lines, in URLs, and in file names, so they're checked at the boundary rather
+ * than trusted to be harmless everywhere they're later used.
+ *
+ * The rules are mostly the ones GitHub and git themselves enforce (see
+ * git-check-ref-format(1) for the branch rules): anything rejected here would
+ * have failed at clone time anyway, with a much worse error. The exception is
+ * the markup characters in a branch name, which git permits and we do not - see
+ * validateGitBranch.
+ *
+ * These checks are NOT the defence against markup in the pages that display
+ * these values. Output escaping is, and it has to stay there whatever this file
+ * allows; the branch rule below is a second line, not the first.
+ */
+
+// GitHub owner names: letters, digits and single hyphens, no hyphen at either
+// end, 39 characters at most.
+const MAX_OWNER = 39;
+// Repository names: letters, digits, dot, hyphen, underscore, 100 at most.
+const MAX_REPO = 100;
+// git imposes no length limit on a ref, but a branch name past this is a
+// filesystem problem waiting to happen.
+const MAX_BRANCH = 255;
+const MAX_PACKAGE_ID = 128;
+const MAX_VERSION = 64;
+
+/**
+ * A GitHub organisation or user name.
+ */
+function validateGithubOwner(value) {
+  if (!value) {
+    return 'GitHub org is required';
+  }
+  if (value.length > MAX_OWNER) {
+    return `GitHub org must be ${MAX_OWNER} characters or less`;
+  }
+  if (!/^[A-Za-z0-9](?:-?[A-Za-z0-9])*$/.test(value)) {
+    return 'GitHub org may only contain letters, digits and single hyphens, and may not start or end with a hyphen';
+  }
+  return null;
+}
+
+/**
+ * A GitHub repository name.
+ */
+function validateGithubRepo(value) {
+  if (!value) {
+    return 'GitHub repo is required';
+  }
+  if (value.length > MAX_REPO) {
+    return `GitHub repo must be ${MAX_REPO} characters or less`;
+  }
+  if (!/^[A-Za-z0-9._-]+$/.test(value)) {
+    return 'GitHub repo may only contain letters, digits, dots, hyphens and underscores';
+  }
+  if (value === '.' || value === '..') {
+    return 'GitHub repo is not a valid name';
+  }
+  // the code appends '.git' when it builds the clone URL, and GitHub won't
+  // create a repository with that suffix anyway
+  if (value.toLowerCase().endsWith('.git')) {
+    return 'GitHub repo should not include the .git suffix';
+  }
+  return null;
+}
+
+/**
+ * A branch name, by the rules in git-check-ref-format(1). Slashes are fine -
+ * that's how branches are grouped - but the characters git reserves for
+ * revision syntax are not. Note that git itself rejects a backslash in a ref
+ * name, so this does too.
+ */
+function validateGitBranch(value) {
+  if (!value) {
+    return 'Branch is required';
+  }
+  if (value.length > MAX_BRANCH) {
+    return `Branch must be ${MAX_BRANCH} characters or less`;
+  }
+  // space, the ASCII control characters, and DEL
+  // eslint-disable-next-line no-control-regex
+  if (/[\u0000-\u001F\u007F ]/.test(value)) {
+    return 'Branch may not contain spaces or control characters';
+  }
+  // the characters git reserves for revision syntax
+  if (/[~^:?*[\\]/.test(value)) {
+    return 'Branch may not contain any of ~ ^ : ? * [ \\';
+  }
+  // git itself allows these, but a branch name is displayed on the task pages, and a value that
+  // has to be escaped everywhere it is shown is one escape away from being a stored XSS. Nobody
+  // needs a branch called <script>, so refuse it at the boundary as well as escaping on output
+  if (/[<>"'&]/.test(value)) {
+    return 'Branch may not contain any of < > " \' &';
+  }
+  if (value.includes('..')) {
+    return 'Branch may not contain ..';
+  }
+  if (value.includes('@{')) {
+    return 'Branch may not contain @{';
+  }
+  if (value === '@') {
+    return 'Branch may not be @';
+  }
+  if (value.startsWith('-')) {
+    return 'Branch may not start with a hyphen';
+  }
+  if (value.startsWith('/') || value.endsWith('/') || value.includes('//')) {
+    return 'Branch may not start or end with /, or contain //';
+  }
+  if (value.endsWith('.')) {
+    return 'Branch may not end with .';
+  }
+  for (const part of value.split('/')) {
+    if (part.startsWith('.')) {
+      return 'No part of a branch name may start with .';
+    }
+    if (part.endsWith('.lock')) {
+      return 'No part of a branch name may end with .lock';
+    }
+  }
+  return null;
+}
+
+/**
+ * An NPM package id. This one is not about git at all: the package id and the
+ * version are concatenated into file names under the zips directory
+ * (<id>#<version>.log, <id>#<version>-announcement.txt), so a value containing
+ * a path separator would look outside that directory.
+ */
+function validatePackageId(value) {
+  if (!value) {
+    return 'NPM package id is required';
+  }
+  if (value.length > MAX_PACKAGE_ID) {
+    return `NPM package id must be ${MAX_PACKAGE_ID} characters or less`;
+  }
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value)) {
+    return 'NPM package id may only contain letters, digits, dots, hyphens and underscores, and must start with a letter or digit';
+  }
+  if (value.includes('..')) {
+    return 'NPM package id may not contain ..';
+  }
+  return null;
+}
+
+/**
+ * A package version. Loose enough for semver with pre-release and build
+ * metadata, tight enough that it can't become a path.
+ */
+function validateVersion(value) {
+  if (!value) {
+    return 'Version is required';
+  }
+  if (value.length > MAX_VERSION) {
+    return `Version must be ${MAX_VERSION} characters or less`;
+  }
+  if (!/^[A-Za-z0-9][A-Za-z0-9.+-]*$/.test(value)) {
+    return 'Version may only contain letters, digits, dots, hyphens and plus signs, and must start with a letter or digit';
+  }
+  if (value.includes('..')) {
+    return 'Version may not contain ..';
+  }
+  return null;
+}
+
+/**
+ * Validate everything the task form collects.
+ * @returns {string[]} the problems found, empty if the input is acceptable
+ */
+function validateTaskInput(input) {
+  const errors = [];
+  const checks = [
+    validateGithubOwner(input.github_org),
+    validateGithubRepo(input.github_repo),
+    validateGitBranch(input.git_branch),
+    validatePackageId(input.npm_package_id),
+    validateVersion(input.version)
+  ];
+  for (const error of checks) {
+    if (error) {
+      errors.push(error);
+    }
+  }
+  return errors;
+}
+
+// Patterns for the HTML form, so the browser objects before the round trip.
+// Deliberately a subset of the checks above - the server is what decides -
+// but they catch the obvious mistakes as the user types.
+const HTML_PATTERNS = {
+  github_org: '[A-Za-z0-9](-?[A-Za-z0-9])*',
+  github_repo: '[A-Za-z0-9._-]+',
+  git_branch: '[^\\\\ ~^:?*\\[<>"\'&]+',
+  npm_package_id: '[A-Za-z0-9][A-Za-z0-9._-]*',
+  version: '[A-Za-z0-9][A-Za-z0-9.+-]*'
+};
+
+module.exports = {
+  validateGithubOwner,
+  validateGithubRepo,
+  validateGitBranch,
+  validatePackageId,
+  validateVersion,
+  validateTaskInput,
+  HTML_PATTERNS
+};