hof 22.9.0-beta.v1 → 22.9.0-beta.v3

package/package/config/rate-limits.js

@@ -1,20 +0,0 @@
-
-module.exports = {
-  rateLimits: {
-    env: process.env.NODE_ENV,
-    requests: {
-      active: false,
-      windowSizeInMinutes: 5,
-      maxWindowRequestCount: 100,
-      windowLogIntervalInMinutes: 1,
-      errCode: 'DDOS_RATE_LIMIT'
-    },
-    submissions: {
-      active: false,
-      windowSizeInMinutes: 10,
-      maxWindowRequestCount: 1,
-      windowLogIntervalInMinutes: 1,
-      errCode: 'SUBMISSION_RATE_LIMIT'
-    }
-  }
-};

package/package/config/sanitisation-rules.js

@@ -1,32 +0,0 @@
-'use strict';
-/* eslint no-process-env: "off" */
-
-const sanitisationBlacklistArray = {
-  // Input will be sanitised using the below rules
-  // Each one is an array which will run sequentially
-  // Some have multiple steps which allow us to remove dups then append the suffix
-  // Useful for ensuring we're not re-sanitising the same input multiple times (and appending extra hypens each time)
-  // The key is what we're sanitising out
-  // The regex is the rule we used to find them (note some dictate repeating characters)
-  // And the replace is what we're replacing that pattern with. Usually nothing sometimes a
-  // single character or sometimes a single character followed by a "-"
-  '/*': [{ regex: '\/\\*', replace: '-' }],
-  '*/': [{ regex: '\\*\\/', replace: '-' }],
-  '|': [{ regex: '\\|', replace: '-' }],
-  '&&': [{ regex: '&&+', replace: '&' }],
-  '@@': [{ regex: '@@+', replace: '@' }],
-  '/..;/': [{ regex: '/\\.\\.;/', replace: '-' }], // Purposely input before ".." as they conflict
-  // '..': [{ regex: '\\.\\.+', replace: '.' }], // Agreed to disable this rule for now unless its specifically required
-  '/etc/passwd': [{ regex: '\/etc\/passwd', replace: '-' }],
-  'c:\\': [{ regex: 'c:\\\\', replace: '-' }],
-  'cmd.exe': [{ regex: 'cmd\\.exe', replace: '-' }],
-  '<': [{ regex: '<+', replace: '<' }, { regex: '<(?!-)', replace: '<-' }],
-  '>': [{ regex: '>+', replace: '>' }, { regex: '>(?!-)', replace: '>-' }],
-  '[': [{ regex: '\\[+', replace: '[' }, { regex: '\\[(?!-)', replace: '[-' }],
-  ']': [{ regex: '\\]+', replace: ']-' }, { regex: '\\](?!-)', replace: ']-' }],
-  '~': [{ regex: '~+', replace: '~' }, { regex: '~(?!-)', replace: '~-' }],
-  '&#': [{ regex: '&#', replace: '-' }],
-  '%U': [{ regex: '%U', replace: '-' }]
-};
-
-module.exports = sanitisationBlacklistArray;

package/package/controller/base-controller.js

@@ -1,296 +0,0 @@
-'use strict';
-
-/* eslint no-unused-vars: [2, {"vars": "all", "args": "none"}] */
-const _ = require('lodash');
-const express = require('express');
-const EventEmitter = require('events').EventEmitter;
-const debug = require('debug')('hmpo:form');
-const dataFormatter = require('./formatting');
-const dataValidator = require('./validation');
-const ErrorClass = require('./validation-error');
-const Helpers = require('../utilities').helpers;
-const sanitisationBlacklistArray = require('../config/sanitisation-rules');
-
-module.exports = class BaseController extends EventEmitter {
-  constructor(options) {
-    if (!options) {
-      throw new Error('Options must be provided');
-    }
-    if (!options.template) {
-      debug('No template provided');
-    }
-    super(options);
-    options.defaultFormatters = options.defaultFormatters || ['trim', 'singlespaces', 'hyphens'];
-    options.fields = options.fields || {};
-    this.options = options;
-    this.ValidationError = ErrorClass;
-
-    this.router = express.Router({ mergeParams: true });
-  }
-
-  requestHandler() {
-    ['get', 'post', 'put', 'delete'].forEach(method => {
-      if (typeof this[method] === 'function') {
-        this.router[method]('*', this[method].bind(this));
-      } else {
-        this.router[method]('*', (req, res, next) => {
-          const err = new Error('Method not supported');
-          err.statusCode = 405;
-          next(err);
-        });
-      }
-    });
-    this.router.use(this.errorHandler.bind(this));
-    return this.router;
-  }
-
-  use() {
-    this.router.use.apply(this.router, arguments);
-  }
-
-  get(req, res, callback) {
-    express.Router({ mergeParams: true })
-      .use([
-        this._configure.bind(this),
-        this._getErrors.bind(this),
-        this._getValues.bind(this),
-        this._locals.bind(this),
-        this.render.bind(this),
-        // eslint-disable-next-line no-shadow
-        (err, req, res, next) => {
-          callback(err);
-        }
-      ])
-      .handle(req, res, callback);
-  }
-
-  post(req, res, callback) {
-    this.setErrors(null, req, res);
-    express.Router({ mergeParams: true })
-      .use([
-        this._configure.bind(this),
-        this._process.bind(this),
-        this._validate.bind(this),
-        this._sanitize.bind(this),
-        this._getHistoricalValues.bind(this),
-        this.saveValues.bind(this),
-        this.successHandler.bind(this),
-        // eslint-disable-next-line no-shadow
-        (err, req, res, next) => {
-          callback(err);
-        }
-      ])
-      .handle(req, res, callback);
-  }
-
-  _locals(req, res, callback) {
-    Object.assign(res.locals, {
-      errors: req.form.errors,
-      errorlist: _.map(req.form.errors, _.identity),
-      values: req.form.values,
-      options: req.form.options,
-      action: req.baseUrl !== '/' ? req.baseUrl + req.path : req.path
-    });
-    Object.assign(res.locals, this.locals(req, res));
-    callback();
-  }
-
-  // eslint-disable-next-line no-inline-comments, spaced-comment
-  locals(/*req, res*/) {
-    return {};
-  }
-
-  render(req, res, callback) {
-    if (!req.form.options.template) {
-      callback(new Error('A template must be provided'));
-    } else {
-      res.render(req.form.options.template);
-    }
-  }
-
-  _getErrors(req, res, callback) {
-    req.form.errors = this.getErrors(req, res);
-    callback();
-  }
-
-  // placeholder methods for persisting error messages between POST and GET
-  // eslint-disable-next-line no-inline-comments, spaced-comment
-  getErrors(/*req, res*/) {
-    return {};
-  }
-
-  // eslint-disable-next-line no-inline-comments, spaced-comment
-  setErrors(/*err, req, res*/) {}
-
-  _validate(req, res, callback) {
-    debug('Validating...');
-
-    const formatter = dataFormatter(
-      req.form.options.fields,
-      req.form.options.defaultFormatters,
-      req.form.options.formatters
-    );
-    const validator = dataValidator(req.form.options.fields);
-
-    const errors = _.reduce(req.form.values, (errs, value, key) => {
-      const error = this.validateField(key, req, validator, formatter);
-      if (error) {
-        const errorKey = error.group || error.key;
-        return Object.assign({}, errs, {
-          [errorKey]: new this.ValidationError(errorKey, error)
-        });
-      }
-      return errs;
-    }, {});
-
-    if (!_.isEmpty(errors)) {
-      callback(errors);
-    } else {
-      this.validate(req, res, callback);
-    }
-  }
-
-  validate(req, res, callback) {
-    callback();
-  }
-
-  validateField(key, req, vld, fmtr) {
-    const formatter = fmtr || dataFormatter(
-      req.form.options.fields,
-      req.form.options.defaultFormatters,
-      req.form.options.formatters
-    );
-    const validator = vld || dataValidator(req.form.options.fields);
-    const emptyValue = formatter(key, '');
-    return validator(key, req.form.values[key], req.form.values, emptyValue);
-  }
-
-  _sanitize(req, res, callback) {
-    // Sanitisation could be disabled in the config
-    if(!this.options.sanitiseInputs) return callback();
-
-    // If we don't have any data, no need to progress
-    if(!_.isEmpty(req.form.values)) {
-      Object.keys(req.form.values).forEach(function (property, propertyIndex) {
-        // If it's not a string, don't sanitise it
-        if(_.isString(req.form.values[property])) {
-          // For each property in our form data
-          Object.keys(sanitisationBlacklistArray).forEach(function (blacklisted, blacklistedIndex) {
-            const blacklistedDetail = sanitisationBlacklistArray[blacklisted];
-            blacklistedDetail.forEach(step => {
-              const regexQuery = new RegExp(step.regex, 'gi');
-              // Will perform the required replace based on our passed in regex and the replace string
-              req.form.values[property] = req.form.values[property].replace(regexQuery, step.replace);
-            });
-          });
-        }
-      });
-    }
-    return callback();
-  }
-
-  _process(req, res, callback) {
-    req.form.values = req.form.values || {};
-    const formatter = dataFormatter(
-      req.form.options.fields,
-      req.form.options.defaultFormatters,
-      req.form.options.formatters
-    );
-    Object.assign(req.form.values, _.reduce(req.form.options.fields, (fields, field, key) =>
-      Object.assign({}, fields, { [key]: formatter(key, req.body[key] || '') })
-    , {}));
-    this.process(req, res, callback);
-  }
-
-  process(req, res, callback) {
-    callback();
-  }
-
-  _configure(req, res, callback) {
-    req.form = req.form || {};
-    req.form.options = _.cloneDeep(this.options);
-    this.configure(req, res, callback);
-  }
-
-  configure(req, res, callback) {
-    callback();
-  }
-
-  _getValues(req, res, callback) {
-    this.getValues(req, res, (err, values) => {
-      req.form.values = values || {};
-      callback(err);
-    });
-  }
-
-  // populate the historical values into the request to allow fork evaluation against those.
-  _getHistoricalValues(req, res, callback) {
-    this.getValues(req, res, (err, values) => {
-      req.form.historicalValues = values || {};
-      callback(err);
-    });
-  }
-
-  getValues(req, res, callback) {
-    callback();
-  }
-
-  saveValues(req, res, callback) {
-    callback();
-  }
-
-  _getForkTarget(req, res) {
-    // If a fork condition is met, its target supercedes the next property
-    return req.form.options.forks.reduce((result, value) =>
-      Helpers.isFieldValueInPageOrSessionValid(req, res, value.condition) ?
-        value.target :
-        result
-    , req.form.options.next);
-  }
-
-  getForkTarget(req, res) {
-    return this._getForkTarget(req, res);
-  }
-
-  getNextStep(req, res) {
-    let next = req.form.options.next || req.path;
-    if (req.form.options.forks && Array.isArray(req.form.options.forks)) {
-      next = this._getForkTarget(req, res);
-    }
-    if (req.baseUrl !== '/') {
-      next = req.baseUrl + next;
-    }
-    return next;
-  }
-
-  getErrorStep(err, req) {
-    const redirectError = _.every(err, error => error.redirect);
-    let redirect = req.originalUrl;
-
-    if (redirectError) {
-      redirect = _.find(err, error => error.redirect).redirect;
-    }
-
-    return redirect;
-  }
-
-  isValidationError(err) {
-    return !_.isEmpty(err) && _.every(err, e => e instanceof this.ValidationError);
-  }
-
-  // eslint-disable-next-line consistent-return
-  errorHandler(err, req, res, callback) {
-    if (this.isValidationError(err)) {
-      this.setErrors(err, req, res);
-      res.redirect(this.getErrorStep(err, req));
-    } else {
-      // if the error is not a validation error then throw and let the error handler pick it up
-      return callback(err);
-    }
-  }
-
-  successHandler(req, res) {
-    this.emit('complete', req, res);
-    res.redirect(this.getNextStep(req, res));
-  }
-};

package/package/controller/behaviour-hooks.js

@@ -1,51 +0,0 @@
-'use strict';
-
-const _ = require('lodash');
-const Router = require('express').Router;
-
-module.exports = SuperClass => {
-  class Behaviour extends SuperClass {
-    runHooks(hook) {
-      return (req, res, next) => {
-        // find the fields which have the current hook defined
-        const hooks = _(req.form.options.fields)
-          .filter(field => field.hooks)
-          .map('hooks')
-          .filter(h => h[hook])
-          .map(hook)
-          .value();
-        if (hooks.length) {
-          Router({ mergeParams: true }).use(hooks).handle(req, res, next);
-        } else {
-          next();
-        }
-      };
-    }
-  }
-
-  [
-    // GET pipeline
-    '_getErrors',
-    '_getValues',
-    '_locals',
-    'render',
-    // POST pipeline
-    '_process',
-    '_validate',
-    'saveValues',
-    'successHandler'
-  ].forEach(method => {
-    /* eslint-disable func-names */
-    Behaviour.prototype[method] = function (req, res, next) {
-      /* eslint-enable func-names */
-      const methodName = method.replace(/^_/, '');
-      Router({ mergeParams: true }).use([
-        this.runHooks(`pre-${methodName}`),
-        SuperClass.prototype[method].bind(this),
-        this.runHooks(`post-${methodName}`)
-      ]).handle(req, res, next);
-    };
-  });
-
-  return Behaviour;
-};

package/package/controller/behaviour-session.js

@@ -1,64 +0,0 @@
-'use strict';
-
-const _ = require('lodash');
-const path = require('path');
-
-module.exports = SuperClass => class extends SuperClass {
-  configure(req, res, callback) {
-    if (!req.sessionModel) {
-      throw new Error('req.sessionModel must be defined in order to use this behaviour');
-    }
-    super.configure(req, res, callback);
-  }
-
-  getValues(req, res, callback) {
-    const json = req.sessionModel.toJSON();
-    delete json.errorValues;
-    callback(null, Object.assign({}, json, req.sessionModel.get('errorValues')));
-  }
-
-  saveValues(req, res, callback) {
-    req.sessionModel.set(req.form.values);
-    req.sessionModel.unset('errorValues');
-    callback();
-  }
-
-  getErrors(req) {
-    let errs = req.sessionModel.get('errors');
-    errs = _.pick(errs, Object.keys(req.form.options.fields));
-    errs = _.pickBy(errs, err => !err.redirect);
-    return errs;
-  }
-
-  setErrors(err, req) {
-    if (req.form) {
-      req.sessionModel.set('errorValues', req.form.values);
-    }
-    req.sessionModel.set('errors', err);
-  }
-
-  locals(req, res) {
-    return Object.assign({}, super.locals(req, res), {
-      baseUrl: req.baseUrl,
-      nextPage: this.getNextStep(req, res)
-    });
-  }
-
-  missingPrereqHandler(req, res) {
-    const last = _.last(req.sessionModel.get('steps'));
-    let redirect = _.first(Object.keys(this.options.steps));
-
-    if (last && this.options.steps[last]) {
-      redirect = this.options.steps[last].next || last;
-    }
-    res.redirect(path.join(req.baseUrl, redirect));
-  }
-
-  errorHandler(err, req, res, next) {
-    if (err.code === 'MISSING_PREREQ') {
-      this.missingPrereqHandler(req, res, next);
-    } else {
-      super.errorHandler(err, req, res, next);
-    }
-  }
-};