json-rest-api 1.0.21 → 1.0.22

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__connectors__lib__busboy-detector.js.txt

@@ -0,0 +1,175 @@
+     1	/**
+     2	 * Busboy File Detector for HTTP Multipart Uploads
+     3	 *
+     4	 * This detector handles multipart/form-data uploads using the busboy library.
+     5	 * It's suitable for both HTTP and Express connectors.
+     6	 *
+     7	 * Features:
+     8	 * - Streaming parser (memory efficient)
+     9	 * - Configurable file size limits
+    10	 * - Automatic field parsing
+    11	 * - No temporary files by default (keeps in memory)
+    12	 *
+    13	 * Usage:
+    14	 * ```javascript
+    15	 * import { createBusboyDetector } from 'jsonrestapi/plugins/core/lib/busboy-detector.js';
+    16	 *
+    17	 * api.use(HttpPlugin, {
+    18	 *   fileParser: 'busboy',
+    19	 *   fileParserOptions: {
+    20	 *     limits: { fileSize: 10 * 1024 * 1024 } // 10MB
+    21	 *   }
+    22	 * });
+    23	 * ```
+    24	 */
+    25	
+    26	import { requirePackage } from 'hooked-api'
+    27	import { Readable } from 'stream'
+    28	
+    29	let Busboy
+    30	try {
+    31	  Busboy = (await import('busboy')).default
+    32	} catch (e) {
+    33	  requirePackage('busboy', 'express/http-connector',
+    34	    'Busboy is required for multipart/form-data file uploads. This is a peer dependency.')
+    35	}
+    36	
+    37	/**
+    38	 * Creates a busboy-based file detector
+    39	 *
+    40	 * @param {Object} options - Busboy configuration options
+    41	 * @param {Object} options.limits - Size limits
+    42	 * @param {number} options.limits.fileSize - Max file size in bytes
+    43	 * @param {number} options.limits.files - Max number of files
+    44	 * @param {number} options.limits.fields - Max number of fields
+    45	 * @returns {Object} Detector object with detect() and parse() methods
+    46	 */
+    47	export function createBusboyDetector (options = {}) {
+    48	  return {
+    49	    name: 'busboy-multipart',
+    50	
+    51	    /**
+    52	     * Check if this detector can handle the request
+    53	     * @param {Object} params - Request parameters
+    54	     * @returns {boolean} True if this is a multipart request
+    55	     */
+    56	    detect: (params) => {
+    57	      const req = params._httpReq || params._expressReq
+    58	      if (!req || !req.headers) return false
+    59	
+    60	      const contentType = req.headers['content-type'] || ''
+    61	      return contentType.includes('multipart/form-data')
+    62	    },
+    63	
+    64	    /**
+    65	     * Parse multipart data from the request
+    66	     * @param {Object} params - Request parameters
+    67	     * @returns {Promise<{fields: Object, files: Object}>} Parsed data
+    68	     */
+    69	    parse: async (params) => {
+    70	      const req = params._httpReq || params._expressReq
+    71	
+    72	      return new Promise((resolve, reject) => {
+    73	        const busboy = new Busboy({
+    74	          headers: req.headers,
+    75	          ...options
+    76	        })
+    77	
+    78	        const fields = {}
+    79	        const files = {}
+    80	        const filePromises = []
+    81	
+    82	        // Handle fields
+    83	        busboy.on('field', (fieldname, val) => {
+    84	          // Handle array notation (field[] or field[0])
+    85	          const arrayMatch = fieldname.match(/^(.+)\[\d*\]$/)
+    86	          if (arrayMatch) {
+    87	            const baseName = arrayMatch[1]
+    88	            if (!fields[baseName]) {
+    89	              fields[baseName] = []
+    90	            }
+    91	            if (Array.isArray(fields[baseName])) {
+    92	              fields[baseName].push(val)
+    93	            }
+    94	          } else {
+    95	            fields[fieldname] = val
+    96	          }
+    97	        })
+    98	
+    99	        // Handle files
+   100	        busboy.on('file', (fieldname, file, filename, encoding, mimetype) => {
+   101	          const chunks = []
+   102	          let size = 0
+   103	
+   104	          const filePromise = new Promise((fileResolve, fileReject) => {
+   105	            file.on('data', (chunk) => {
+   106	              chunks.push(chunk)
+   107	              size += chunk.length
+   108	            })
+   109	
+   110	            file.on('limit', () => {
+   111	              fileReject(new Error(`File size limit exceeded for field '${fieldname}'`))
+   112	            })
+   113	
+   114	            file.on('end', () => {
+   115	              files[fieldname] = {
+   116	                filename,
+   117	                mimetype,
+   118	                encoding,
+   119	                size,
+   120	                data: Buffer.concat(chunks)
+   121	              }
+   122	              fileResolve()
+   123	            })
+   124	
+   125	            file.on('error', fileReject)
+   126	          })
+   127	
+   128	          filePromises.push(filePromise)
+   129	        })
+   130	
+   131	        // Handle completion
+   132	        busboy.on('finish', async () => {
+   133	          try {
+   134	            // Wait for all files to be fully read
+   135	            await Promise.all(filePromises)
+   136	            resolve({ fields, files })
+   137	          } catch (error) {
+   138	            reject(error)
+   139	          }
+   140	        })
+   141	
+   142	        // Handle errors
+   143	        busboy.on('error', (error) => {
+   144	          reject(error)
+   145	        })
+   146	
+   147	        // Handle limit errors
+   148	        busboy.on('partsLimit', () => {
+   149	          reject(new Error('Parts limit exceeded'))
+   150	        })
+   151	
+   152	        busboy.on('filesLimit', () => {
+   153	          reject(new Error('Files limit exceeded'))
+   154	        })
+   155	
+   156	        busboy.on('fieldsLimit', () => {
+   157	          reject(new Error('Fields limit exceeded'))
+   158	        })
+   159	
+   160	        // Pipe request to busboy
+   161	        if (req.pipe) {
+   162	          req.pipe(busboy)
+   163	        } else if (req.on) {
+   164	          // For already buffered requests
+   165	          const stream = new Readable()
+   166	          stream.push(req.body || req)
+   167	          stream.push(null)
+   168	          stream.pipe(busboy)
+   169	        } else {
+   170	          reject(new Error('Request object is not a stream'))
+   171	        }
+   172	      })
+   173	    }
+   174	  }
+   175	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__connectors__lib__formidable-detector.js.txt

@@ -0,0 +1,138 @@
+     1	/**
+     2	 * Formidable File Detector for HTTP Multipart Uploads
+     3	 *
+     4	 * This detector handles multipart/form-data uploads using the formidable library.
+     5	 * Unlike busboy, formidable saves files to disk temporarily, which is better
+     6	 * for large files.
+     7	 *
+     8	 * Features:
+     9	 * - Disk-based storage (better for large files)
+    10	 * - Automatic temp file cleanup
+    11	 * - Progress tracking support
+    12	 * - Built-in file type detection
+    13	 *
+    14	 * Usage:
+    15	 * ```javascript
+    16	 * import { createFormidableDetector } from 'jsonrestapi/plugins/core/lib/formidable-detector.js';
+    17	 *
+    18	 * api.use(ExpressPlugin, {
+    19	 *   fileParser: 'formidable',
+    20	 *   fileParserOptions: {
+    21	 *     uploadDir: './uploads/temp',
+    22	 *     keepExtensions: true,
+    23	 *     maxFileSize: 200 * 1024 * 1024 // 200MB
+    24	 *   }
+    25	 * });
+    26	 * ```
+    27	 */
+    28	
+    29	import { requirePackage } from 'hooked-api'
+    30	import { promises as fs } from 'fs'
+    31	import path from 'path'
+    32	
+    33	let formidable
+    34	try {
+    35	  formidable = (await import('formidable')).default
+    36	} catch (e) {
+    37	  requirePackage('formidable', 'express/http-connector',
+    38	    'Formidable is required for multipart/form-data file uploads with disk storage. This is a peer dependency.')
+    39	}
+    40	
+    41	/**
+    42	 * Creates a formidable-based file detector
+    43	 *
+    44	 * @param {Object} options - Formidable configuration options
+    45	 * @param {string} options.uploadDir - Directory for temporary files
+    46	 * @param {boolean} options.keepExtensions - Keep file extensions
+    47	 * @param {number} options.maxFileSize - Max file size in bytes
+    48	 * @param {boolean} options.multiples - Allow multiple files per field
+    49	 * @returns {Object} Detector object with detect() and parse() methods
+    50	 */
+    51	export function createFormidableDetector (options = {}) {
+    52	  // Set default upload directory
+    53	  const uploadDir = options.uploadDir || path.join(process.cwd(), 'uploads', 'temp')
+    54	
+    55	  return {
+    56	    name: 'formidable-multipart',
+    57	
+    58	    /**
+    59	     * Check if this detector can handle the request
+    60	     * @param {Object} params - Request parameters
+    61	     * @returns {boolean} True if this is a multipart request
+    62	     */
+    63	    detect: (params) => {
+    64	      const req = params._httpReq || params._expressReq
+    65	      if (!req || !req.headers) return false
+    66	
+    67	      const contentType = req.headers['content-type'] || ''
+    68	      return contentType.includes('multipart/form-data')
+    69	    },
+    70	
+    71	    /**
+    72	     * Parse multipart data from the request
+    73	     * @param {Object} params - Request parameters
+    74	     * @returns {Promise<{fields: Object, files: Object}>} Parsed data
+    75	     */
+    76	    parse: async (params) => {
+    77	      const req = params._httpReq || params._expressReq
+    78	
+    79	      // Ensure upload directory exists
+    80	      await fs.mkdir(uploadDir, { recursive: true })
+    81	
+    82	      // Create form parser
+    83	      const form = formidable({
+    84	        uploadDir,
+    85	        keepExtensions: true,
+    86	        ...options
+    87	      })
+    88	
+    89	      // Parse the request
+    90	      const [fields, fileUploads] = await form.parse(req)
+    91	
+    92	      // Normalize formidable's file format to our standard format
+    93	      const files = {}
+    94	
+    95	      for (const [fieldname, uploadedFiles] of Object.entries(fileUploads)) {
+    96	        // Formidable returns arrays for multiple files
+    97	        const fileArray = Array.isArray(uploadedFiles) ? uploadedFiles : [uploadedFiles]
+    98	
+    99	        // For now, just take the first file (TODO: handle multiple files per field)
+   100	        const file = fileArray[0]
+   101	
+   102	        if (file) {
+   103	          // Read file data into memory (for small files)
+   104	          // For large files, you might want to keep them on disk
+   105	          const data = await fs.readFile(file.filepath)
+   106	
+   107	          files[fieldname] = {
+   108	            filename: file.originalFilename || 'unknown',
+   109	            mimetype: file.mimetype || 'application/octet-stream',
+   110	            size: file.size,
+   111	            data,
+   112	            filepath: file.filepath, // Keep for reference
+   113	
+   114	            // Cleanup function to remove temp file
+   115	            cleanup: async () => {
+   116	              try {
+   117	                await fs.unlink(file.filepath)
+   118	              } catch (error) {
+   119	                // File might already be deleted, ignore
+   120	                if (error.code !== 'ENOENT') {
+   121	                  throw error
+   122	                }
+   123	              }
+   124	            }
+   125	          }
+   126	        }
+   127	      }
+   128	
+   129	      // Normalize fields (formidable returns arrays for repeated fields)
+   130	      const normalizedFields = {}
+   131	      for (const [key, value] of Object.entries(fields)) {
+   132	        normalizedFields[key] = Array.isArray(value) && value.length === 1 ? value[0] : value
+   133	      }
+   134	
+   135	      return { fields: normalizedFields, files }
+   136	    }
+   137	  }
+   138	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__connectors__lib__request-helpers.js.txt

@@ -0,0 +1,222 @@
+     1	/**
+     2	 * Helper functions for HTTP request context creation
+     3	 * Used by both HTTP and Express plugins
+     4	 */
+     5	
+     6	/**
+     7	 * Extract the real client IP address, handling proxies
+     8	 * @param {Object} req - The request object (Node.js http.IncomingMessage or Express Request)
+     9	 * @returns {string} The client IP address
+    10	 */
+    11	export function getClientIP (req) {
+    12	  // Check X-Forwarded-For header (comma-separated list, first is original client)
+    13	  const xForwardedFor = req.headers['x-forwarded-for']
+    14	  if (xForwardedFor) {
+    15	    return xForwardedFor.split(',')[0].trim()
+    16	  }
+    17	
+    18	  // Check X-Real-IP header (single IP)
+    19	  const xRealIP = req.headers['x-real-ip']
+    20	  if (xRealIP) {
+    21	    return xRealIP
+    22	  }
+    23	
+    24	  // Check Cloudflare's CF-Connecting-IP
+    25	  const cfConnectingIP = req.headers['cf-connecting-ip']
+    26	  if (cfConnectingIP) {
+    27	    return cfConnectingIP
+    28	  }
+    29	
+    30	  // Fall back to direct connection
+    31	  return req.connection?.remoteAddress ||
+    32	         req.socket?.remoteAddress ||
+    33	         req.ip || // Express specific
+    34	         'unknown'
+    35	}
+    36	
+    37	/**
+    38	 * Check if the request is using HTTPS
+    39	 * @param {Object} req - The request object
+    40	 * @returns {boolean} True if the request is secure
+    41	 */
+    42	export function isSecure (req) {
+    43	  // Express-specific property
+    44	  if (req.secure !== undefined) {
+    45	    return req.secure
+    46	  }
+    47	
+    48	  // Check X-Forwarded-Proto header (used by proxies)
+    49	  const xForwardedProto = req.headers['x-forwarded-proto']
+    50	  if (xForwardedProto) {
+    51	    return xForwardedProto === 'https'
+    52	  }
+    53	
+    54	  // Check if connection is encrypted (Node.js)
+    55	  if (req.connection?.encrypted) {
+    56	    return true
+    57	  }
+    58	
+    59	  // Check protocol directly
+    60	  if (req.protocol === 'https') {
+    61	    return true
+    62	  }
+    63	
+    64	  // Default to false
+    65	  return false
+    66	}
+    67	
+    68	/**
+    69	 * Get the hostname from the request
+    70	 * @param {Object} req - The request object
+    71	 * @returns {string} The hostname
+    72	 */
+    73	export function getHostname (req) {
+    74	  // Express-specific property
+    75	  if (req.hostname) {
+    76	    return req.hostname
+    77	  }
+    78	
+    79	  // Check Host header
+    80	  const hostHeader = req.headers.host
+    81	  if (hostHeader) {
+    82	    // Remove port if present
+    83	    const colonIndex = hostHeader.indexOf(':')
+    84	    return colonIndex === -1 ? hostHeader : hostHeader.substring(0, colonIndex)
+    85	  }
+    86	
+    87	  // Fall back
+    88	  return 'localhost'
+    89	}
+    90	
+    91	/**
+    92	 * Get the port from the request
+    93	 * @param {Object} req - The request object
+    94	 * @returns {number|null} The port number or null
+    95	 */
+    96	export function getPort (req) {
+    97	  // Check Host header for port
+    98	  const hostHeader = req.headers.host
+    99	  if (hostHeader) {
+   100	    const colonIndex = hostHeader.indexOf(':')
+   101	    if (colonIndex !== -1) {
+   102	      const port = parseInt(hostHeader.substring(colonIndex + 1), 10)
+   103	      if (!isNaN(port)) {
+   104	        return port
+   105	      }
+   106	    }
+   107	  }
+   108	
+   109	  // Check connection local port
+   110	  if (req.connection?.localPort) {
+   111	    return req.connection.localPort
+   112	  }
+   113	
+   114	  if (req.socket?.localPort) {
+   115	    return req.socket.localPort
+   116	  }
+   117	
+   118	  // Default ports based on protocol
+   119	  return isSecure(req) ? 443 : 80
+   120	}
+   121	
+   122	/**
+   123	 * Parse cookies from cookie header string
+   124	 * @param {string} cookieString - The cookie header value
+   125	 * @returns {Object} Parsed cookies as key-value pairs
+   126	 */
+   127	export function parseCookies (cookieString) {
+   128	  const cookies = {}
+   129	
+   130	  if (!cookieString || typeof cookieString !== 'string') {
+   131	    return cookies
+   132	  }
+   133	
+   134	  // Split by semicolons and parse each cookie
+   135	  cookieString.split(';').forEach(cookie => {
+   136	    const trimmedCookie = cookie.trim()
+   137	    if (trimmedCookie) {
+   138	      const eqIndex = trimmedCookie.indexOf('=')
+   139	      if (eqIndex !== -1) {
+   140	        const name = trimmedCookie.substring(0, eqIndex).trim()
+   141	        const value = trimmedCookie.substring(eqIndex + 1).trim()
+   142	        if (name) {
+   143	          // Remove quotes if present
+   144	          cookies[name] = value.replace(/^"(.*)"$/, '$1')
+   145	        }
+   146	      }
+   147	    }
+   148	  })
+   149	
+   150	  return cookies
+   151	}
+   152	
+   153	/**
+   154	 * Extract token from request based on common patterns
+   155	 * @param {Object} req - The request object
+   156	 * @returns {string|null} The extracted token or null
+   157	 */
+   158	export function extractToken (req) {
+   159	  // Check Authorization header for Bearer token
+   160	  const authHeader = req.headers.authorization || req.headers.Authorization
+   161	  if (authHeader && typeof authHeader === 'string') {
+   162	    const bearerMatch = authHeader.match(/^Bearer\s+(.+)$/i)
+   163	    if (bearerMatch) {
+   164	      return bearerMatch[1]
+   165	    }
+   166	  }
+   167	
+   168	  // Check cookies for session token (Auth.js pattern)
+   169	  const cookies = parseCookies(req.headers.cookie || '')
+   170	  if (cookies['__Secure-authjs.session-token']) {
+   171	    return cookies['__Secure-authjs.session-token']
+   172	  }
+   173	  if (cookies['authjs.session-token']) {
+   174	    return cookies['authjs.session-token']
+   175	  }
+   176	
+   177	  return null
+   178	}
+   179	
+   180	/**
+   181	 * Create a context object for the request
+   182	 * @param {Object} req - The request object
+   183	 * @param {Object} res - The response object
+   184	 * @param {string} source - The source plugin ('http' or 'express')
+   185	 * @returns {Object} The context object
+   186	 */
+   187	export function createContext (req, res, source) {
+   188	  const context = {
+   189	    source,
+   190	    auth: {
+   191	      userId: null,
+   192	      claims: null
+   193	    },
+   194	    request: {
+   195	      ip: getClientIP(req),
+   196	      userAgent: req.headers['user-agent'] || null,
+   197	      protocol: isSecure(req) ? 'https' : 'http',
+   198	      hostname: getHostname(req),
+   199	      port: getPort(req),
+   200	      method: req.method,
+   201	      path: req.url || req.path,
+   202	      headers: req.headers,
+   203	      cookies: parseCookies(req.headers.cookie || ''),
+   204	      token: extractToken(req)
+   205	    },
+   206	    raw: { req, res },
+   207	    handled: false,
+   208	    rejection: null
+   209	  }
+   210	
+   211	  // Add reject function
+   212	  context.reject = (status, message, details = {}) => {
+   213	    context.handled = true
+   214	    context.rejection = {
+   215	      status,
+   216	      message,
+   217	      ...details
+   218	    }
+   219	  }
+   220	
+   221	  return context
+   222	}