hof 22.8.4 → 22.9.0-beta.v1

package/package/config/rate-limits.js

@@ -0,0 +1,20 @@
+
+module.exports = {
+  rateLimits: {
+    env: process.env.NODE_ENV,
+    requests: {
+      active: false,
+      windowSizeInMinutes: 5,
+      maxWindowRequestCount: 100,
+      windowLogIntervalInMinutes: 1,
+      errCode: 'DDOS_RATE_LIMIT'
+    },
+    submissions: {
+      active: false,
+      windowSizeInMinutes: 10,
+      maxWindowRequestCount: 1,
+      windowLogIntervalInMinutes: 1,
+      errCode: 'SUBMISSION_RATE_LIMIT'
+    }
+  }
+};

package/package/config/sanitisation-rules.js

@@ -0,0 +1,32 @@
+'use strict';
+/* eslint no-process-env: "off" */
+
+const sanitisationBlacklistArray = {
+  // Input will be sanitised using the below rules
+  // Each one is an array which will run sequentially
+  // Some have multiple steps which allow us to remove dups then append the suffix
+  // Useful for ensuring we're not re-sanitising the same input multiple times (and appending extra hypens each time)
+  // The key is what we're sanitising out
+  // The regex is the rule we used to find them (note some dictate repeating characters)
+  // And the replace is what we're replacing that pattern with. Usually nothing sometimes a
+  // single character or sometimes a single character followed by a "-"
+  '/*': [{ regex: '\/\\*', replace: '-' }],
+  '*/': [{ regex: '\\*\\/', replace: '-' }],
+  '|': [{ regex: '\\|', replace: '-' }],
+  '&&': [{ regex: '&&+', replace: '&' }],
+  '@@': [{ regex: '@@+', replace: '@' }],
+  '/..;/': [{ regex: '/\\.\\.;/', replace: '-' }], // Purposely input before ".." as they conflict
+  // '..': [{ regex: '\\.\\.+', replace: '.' }], // Agreed to disable this rule for now unless its specifically required
+  '/etc/passwd': [{ regex: '\/etc\/passwd', replace: '-' }],
+  'c:\\': [{ regex: 'c:\\\\', replace: '-' }],
+  'cmd.exe': [{ regex: 'cmd\\.exe', replace: '-' }],
+  '<': [{ regex: '<+', replace: '<' }, { regex: '<(?!-)', replace: '<-' }],
+  '>': [{ regex: '>+', replace: '>' }, { regex: '>(?!-)', replace: '>-' }],
+  '[': [{ regex: '\\[+', replace: '[' }, { regex: '\\[(?!-)', replace: '[-' }],
+  ']': [{ regex: '\\]+', replace: ']-' }, { regex: '\\](?!-)', replace: ']-' }],
+  '~': [{ regex: '~+', replace: '~' }, { regex: '~(?!-)', replace: '~-' }],
+  '&#': [{ regex: '&#', replace: '-' }],
+  '%U': [{ regex: '%U', replace: '-' }]
+};
+
+module.exports = sanitisationBlacklistArray;

package/package/controller/base-controller.js

@@ -0,0 +1,296 @@
+'use strict';
+
+/* eslint no-unused-vars: [2, {"vars": "all", "args": "none"}] */
+const _ = require('lodash');
+const express = require('express');
+const EventEmitter = require('events').EventEmitter;
+const debug = require('debug')('hmpo:form');
+const dataFormatter = require('./formatting');
+const dataValidator = require('./validation');
+const ErrorClass = require('./validation-error');
+const Helpers = require('../utilities').helpers;
+const sanitisationBlacklistArray = require('../config/sanitisation-rules');
+
+module.exports = class BaseController extends EventEmitter {
+  constructor(options) {
+    if (!options) {
+      throw new Error('Options must be provided');
+    }
+    if (!options.template) {
+      debug('No template provided');
+    }
+    super(options);
+    options.defaultFormatters = options.defaultFormatters || ['trim', 'singlespaces', 'hyphens'];
+    options.fields = options.fields || {};
+    this.options = options;
+    this.ValidationError = ErrorClass;
+
+    this.router = express.Router({ mergeParams: true });
+  }
+
+  requestHandler() {
+    ['get', 'post', 'put', 'delete'].forEach(method => {
+      if (typeof this[method] === 'function') {
+        this.router[method]('*', this[method].bind(this));
+      } else {
+        this.router[method]('*', (req, res, next) => {
+          const err = new Error('Method not supported');
+          err.statusCode = 405;
+          next(err);
+        });
+      }
+    });
+    this.router.use(this.errorHandler.bind(this));
+    return this.router;
+  }
+
+  use() {
+    this.router.use.apply(this.router, arguments);
+  }
+
+  get(req, res, callback) {
+    express.Router({ mergeParams: true })
+      .use([
+        this._configure.bind(this),
+        this._getErrors.bind(this),
+        this._getValues.bind(this),
+        this._locals.bind(this),
+        this.render.bind(this),
+        // eslint-disable-next-line no-shadow
+        (err, req, res, next) => {
+          callback(err);
+        }
+      ])
+      .handle(req, res, callback);
+  }
+
+  post(req, res, callback) {
+    this.setErrors(null, req, res);
+    express.Router({ mergeParams: true })
+      .use([
+        this._configure.bind(this),
+        this._process.bind(this),
+        this._validate.bind(this),
+        this._sanitize.bind(this),
+        this._getHistoricalValues.bind(this),
+        this.saveValues.bind(this),
+        this.successHandler.bind(this),
+        // eslint-disable-next-line no-shadow
+        (err, req, res, next) => {
+          callback(err);
+        }
+      ])
+      .handle(req, res, callback);
+  }
+
+  _locals(req, res, callback) {
+    Object.assign(res.locals, {
+      errors: req.form.errors,
+      errorlist: _.map(req.form.errors, _.identity),
+      values: req.form.values,
+      options: req.form.options,
+      action: req.baseUrl !== '/' ? req.baseUrl + req.path : req.path
+    });
+    Object.assign(res.locals, this.locals(req, res));
+    callback();
+  }
+
+  // eslint-disable-next-line no-inline-comments, spaced-comment
+  locals(/*req, res*/) {
+    return {};
+  }
+
+  render(req, res, callback) {
+    if (!req.form.options.template) {
+      callback(new Error('A template must be provided'));
+    } else {
+      res.render(req.form.options.template);
+    }
+  }
+
+  _getErrors(req, res, callback) {
+    req.form.errors = this.getErrors(req, res);
+    callback();
+  }
+
+  // placeholder methods for persisting error messages between POST and GET
+  // eslint-disable-next-line no-inline-comments, spaced-comment
+  getErrors(/*req, res*/) {
+    return {};
+  }
+
+  // eslint-disable-next-line no-inline-comments, spaced-comment
+  setErrors(/*err, req, res*/) {}
+
+  _validate(req, res, callback) {
+    debug('Validating...');
+
+    const formatter = dataFormatter(
+      req.form.options.fields,
+      req.form.options.defaultFormatters,
+      req.form.options.formatters
+    );
+    const validator = dataValidator(req.form.options.fields);
+
+    const errors = _.reduce(req.form.values, (errs, value, key) => {
+      const error = this.validateField(key, req, validator, formatter);
+      if (error) {
+        const errorKey = error.group || error.key;
+        return Object.assign({}, errs, {
+          [errorKey]: new this.ValidationError(errorKey, error)
+        });
+      }
+      return errs;
+    }, {});
+
+    if (!_.isEmpty(errors)) {
+      callback(errors);
+    } else {
+      this.validate(req, res, callback);
+    }
+  }
+
+  validate(req, res, callback) {
+    callback();
+  }
+
+  validateField(key, req, vld, fmtr) {
+    const formatter = fmtr || dataFormatter(
+      req.form.options.fields,
+      req.form.options.defaultFormatters,
+      req.form.options.formatters
+    );
+    const validator = vld || dataValidator(req.form.options.fields);
+    const emptyValue = formatter(key, '');
+    return validator(key, req.form.values[key], req.form.values, emptyValue);
+  }
+
+  _sanitize(req, res, callback) {
+    // Sanitisation could be disabled in the config
+    if(!this.options.sanitiseInputs) return callback();
+
+    // If we don't have any data, no need to progress
+    if(!_.isEmpty(req.form.values)) {
+      Object.keys(req.form.values).forEach(function (property, propertyIndex) {
+        // If it's not a string, don't sanitise it
+        if(_.isString(req.form.values[property])) {
+          // For each property in our form data
+          Object.keys(sanitisationBlacklistArray).forEach(function (blacklisted, blacklistedIndex) {
+            const blacklistedDetail = sanitisationBlacklistArray[blacklisted];
+            blacklistedDetail.forEach(step => {
+              const regexQuery = new RegExp(step.regex, 'gi');
+              // Will perform the required replace based on our passed in regex and the replace string
+              req.form.values[property] = req.form.values[property].replace(regexQuery, step.replace);
+            });
+          });
+        }
+      });
+    }
+    return callback();
+  }
+
+  _process(req, res, callback) {
+    req.form.values = req.form.values || {};
+    const formatter = dataFormatter(
+      req.form.options.fields,
+      req.form.options.defaultFormatters,
+      req.form.options.formatters
+    );
+    Object.assign(req.form.values, _.reduce(req.form.options.fields, (fields, field, key) =>
+      Object.assign({}, fields, { [key]: formatter(key, req.body[key] || '') })
+    , {}));
+    this.process(req, res, callback);
+  }
+
+  process(req, res, callback) {
+    callback();
+  }
+
+  _configure(req, res, callback) {
+    req.form = req.form || {};
+    req.form.options = _.cloneDeep(this.options);
+    this.configure(req, res, callback);
+  }
+
+  configure(req, res, callback) {
+    callback();
+  }
+
+  _getValues(req, res, callback) {
+    this.getValues(req, res, (err, values) => {
+      req.form.values = values || {};
+      callback(err);
+    });
+  }
+
+  // populate the historical values into the request to allow fork evaluation against those.
+  _getHistoricalValues(req, res, callback) {
+    this.getValues(req, res, (err, values) => {
+      req.form.historicalValues = values || {};
+      callback(err);
+    });
+  }
+
+  getValues(req, res, callback) {
+    callback();
+  }
+
+  saveValues(req, res, callback) {
+    callback();
+  }
+
+  _getForkTarget(req, res) {
+    // If a fork condition is met, its target supercedes the next property
+    return req.form.options.forks.reduce((result, value) =>
+      Helpers.isFieldValueInPageOrSessionValid(req, res, value.condition) ?
+        value.target :
+        result
+    , req.form.options.next);
+  }
+
+  getForkTarget(req, res) {
+    return this._getForkTarget(req, res);
+  }
+
+  getNextStep(req, res) {
+    let next = req.form.options.next || req.path;
+    if (req.form.options.forks && Array.isArray(req.form.options.forks)) {
+      next = this._getForkTarget(req, res);
+    }
+    if (req.baseUrl !== '/') {
+      next = req.baseUrl + next;
+    }
+    return next;
+  }
+
+  getErrorStep(err, req) {
+    const redirectError = _.every(err, error => error.redirect);
+    let redirect = req.originalUrl;
+
+    if (redirectError) {
+      redirect = _.find(err, error => error.redirect).redirect;
+    }
+
+    return redirect;
+  }
+
+  isValidationError(err) {
+    return !_.isEmpty(err) && _.every(err, e => e instanceof this.ValidationError);
+  }
+
+  // eslint-disable-next-line consistent-return
+  errorHandler(err, req, res, callback) {
+    if (this.isValidationError(err)) {
+      this.setErrors(err, req, res);
+      res.redirect(this.getErrorStep(err, req));
+    } else {
+      // if the error is not a validation error then throw and let the error handler pick it up
+      return callback(err);
+    }
+  }
+
+  successHandler(req, res) {
+    this.emit('complete', req, res);
+    res.redirect(this.getNextStep(req, res));
+  }
+};

package/package/controller/behaviour-hooks.js

@@ -0,0 +1,51 @@
+'use strict';
+
+const _ = require('lodash');
+const Router = require('express').Router;
+
+module.exports = SuperClass => {
+  class Behaviour extends SuperClass {
+    runHooks(hook) {
+      return (req, res, next) => {
+        // find the fields which have the current hook defined
+        const hooks = _(req.form.options.fields)
+          .filter(field => field.hooks)
+          .map('hooks')
+          .filter(h => h[hook])
+          .map(hook)
+          .value();
+        if (hooks.length) {
+          Router({ mergeParams: true }).use(hooks).handle(req, res, next);
+        } else {
+          next();
+        }
+      };
+    }
+  }
+
+  [
+    // GET pipeline
+    '_getErrors',
+    '_getValues',
+    '_locals',
+    'render',
+    // POST pipeline
+    '_process',
+    '_validate',
+    'saveValues',
+    'successHandler'
+  ].forEach(method => {
+    /* eslint-disable func-names */
+    Behaviour.prototype[method] = function (req, res, next) {
+      /* eslint-enable func-names */
+      const methodName = method.replace(/^_/, '');
+      Router({ mergeParams: true }).use([
+        this.runHooks(`pre-${methodName}`),
+        SuperClass.prototype[method].bind(this),
+        this.runHooks(`post-${methodName}`)
+      ]).handle(req, res, next);
+    };
+  });
+
+  return Behaviour;
+};

package/package/controller/behaviour-session.js

@@ -0,0 +1,64 @@
+'use strict';
+
+const _ = require('lodash');
+const path = require('path');
+
+module.exports = SuperClass => class extends SuperClass {
+  configure(req, res, callback) {
+    if (!req.sessionModel) {
+      throw new Error('req.sessionModel must be defined in order to use this behaviour');
+    }
+    super.configure(req, res, callback);
+  }
+
+  getValues(req, res, callback) {
+    const json = req.sessionModel.toJSON();
+    delete json.errorValues;
+    callback(null, Object.assign({}, json, req.sessionModel.get('errorValues')));
+  }
+
+  saveValues(req, res, callback) {
+    req.sessionModel.set(req.form.values);
+    req.sessionModel.unset('errorValues');
+    callback();
+  }
+
+  getErrors(req) {
+    let errs = req.sessionModel.get('errors');
+    errs = _.pick(errs, Object.keys(req.form.options.fields));
+    errs = _.pickBy(errs, err => !err.redirect);
+    return errs;
+  }
+
+  setErrors(err, req) {
+    if (req.form) {
+      req.sessionModel.set('errorValues', req.form.values);
+    }
+    req.sessionModel.set('errors', err);
+  }
+
+  locals(req, res) {
+    return Object.assign({}, super.locals(req, res), {
+      baseUrl: req.baseUrl,
+      nextPage: this.getNextStep(req, res)
+    });
+  }
+
+  missingPrereqHandler(req, res) {
+    const last = _.last(req.sessionModel.get('steps'));
+    let redirect = _.first(Object.keys(this.options.steps));
+
+    if (last && this.options.steps[last]) {
+      redirect = this.options.steps[last].next || last;
+    }
+    res.redirect(path.join(req.baseUrl, redirect));
+  }
+
+  errorHandler(err, req, res, next) {
+    if (err.code === 'MISSING_PREREQ') {
+      this.missingPrereqHandler(req, res, next);
+    } else {
+      super.errorHandler(err, req, res, next);
+    }
+  }
+};