mastercontroller 1.2.12 → 1.2.13

package/MasterRouter.js

@@ -1,4 +1,4 @@
-// version 0.0.248
+// version 0.0.249
 
 var master = require('./MasterControl');
 var toolClass =  require('./MasterTools');
@@ -7,6 +7,17 @@ var path = require('path');
 var currentRoute = {};
 var tools = new toolClass();
 
+// Enhanced error handling
+const { handleRoutingError, handleControllerError, sendErrorResponse } = require('./MasterBackendErrorHandler');
+const { logger } = require('./MasterErrorLogger');
+const { performanceTracker, errorHandlerMiddleware } = require('./MasterErrorMiddleware');
+
+// Security - Input validation and sanitization
+const { validator, detectPathTraversal, detectSQLInjection, detectCommandInjection } = require('./MasterValidator');
+const { escapeHTML } = require('./MasterSanitizer');
+
+const isDevelopment = process.env.NODE_ENV !== 'production' && process.env.master === 'development';
+
  var normalizePaths = function(requestPath, routePath, requestParams){
     var obj = {
         requestPath : "",
@@ -21,8 +32,14 @@ var tools = new toolClass();
         routeItem = routePathList[i];
         if(routeItem){
             if(routeItem.indexOf(":") > -1){
-                requestParams[routeItem.replace(":", "")] = requestItem;
-                routePathList[i] = requestItem;
+                const paramName = routeItem.replace(":", "");
+                const paramValue = requestItem;
+
+                // Security: Sanitize route parameter
+                const sanitizedValue = sanitizeRouteParam(paramName, paramValue);
+
+                requestParams[paramName] = sanitizedValue;
+                routePathList[i] = sanitizedValue;
             }
         }
     }
@@ -32,10 +49,66 @@ var tools = new toolClass();
     return obj;
  }
 
+ /**
+  * Sanitize route parameter to prevent injection attacks
+  */
+ var sanitizeRouteParam = function(paramName, paramValue) {
+    if (!paramValue || typeof paramValue !== 'string') {
+        return paramValue;
+    }
+
+    // Check for path traversal attempts
+    const pathCheck = detectPathTraversal(paramValue);
+    if (!pathCheck.safe) {
+        logger.warn({
+            code: 'MC_SECURITY_PATH_TRAVERSAL',
+            message: 'Path traversal attempt detected in route parameter',
+            param: paramName,
+            value: paramValue
+        });
+
+        // Remove dangerous content
+        return paramValue.replace(/\.\./g, '').replace(/\.\//g, '');
+    }
+
+    // Check for SQL injection attempts
+    const sqlCheck = detectSQLInjection(paramValue);
+    if (!sqlCheck.safe) {
+        logger.warn({
+            code: 'MC_SECURITY_SQL_INJECTION',
+            message: 'SQL injection attempt detected in route parameter',
+            param: paramName,
+            value: paramValue
+        });
+
+        // Escape to prevent injection
+        return escapeHTML(paramValue);
+    }
+
+    // Check for command injection attempts
+    const cmdCheck = detectCommandInjection(paramValue);
+    if (!cmdCheck.safe) {
+        logger.warn({
+            code: 'MC_SECURITY_COMMAND_INJECTION',
+            message: 'Command injection attempt detected in route parameter',
+            param: paramName,
+            value: paramValue
+        });
+
+        // Remove dangerous characters
+        return paramValue.replace(/[;&|`$()]/g, '');
+    }
+
+    // Basic sanitization for all params
+    return escapeHTML(paramValue);
+ }
+
  var processRoutes = function(requestObject, emitter, routeObject){
     var routeList = routeObject.routes;
     var root = routeObject.root;
     var isComponent = routeObject.isComponent;
+    var currentRouteBeingProcessed = null; // Track current route for better error messages
+
     try{
             // Ensure routes is an array
             if(!Array.isArray(routeList)){
@@ -51,56 +124,109 @@ var tools = new toolClass();
             if(routeList.length > 0){
                 // loop through routes
                 for(var item in routeList){
+                    // Store current route for error handling
+                    currentRouteBeingProcessed = {
+                        path: routeList[item].path,
+                        toController: routeList[item].toController,
+                        toAction: routeList[item].toAction,
+                        type: routeList[item].type
+                    };
+
+                    try {
+                        requestObject.toController = routeList[item].toController;
+                        requestObject.toAction = routeList[item].toAction;
+                        var pathObj = normalizePaths(requestObject.pathName, routeList[item].path, requestObject.params);
+
+                        // if we find the route that matches the request
+                        if(pathObj.requestPath === pathObj.routePath && routeList[item].type === requestObject.type){
+
+                            // call Constraint
+                            if(typeof routeList[item].constraint === "function"){
+
+                                var newObj = {};
+                                //tools.combineObjects(newObj, master.controllerList);
+                                newObj.next = function(){
+                                    currentRoute.root = root;
+                                    currentRoute.pathName = requestObject.pathName;
+                                    currentRoute.toAction = requestObject.toAction;
+                                    currentRoute.toController = requestObject.toController;
+                                    currentRoute.response = requestObject.response;
+                                    currentRoute.isComponent = isComponent;
+                                    currentRoute.routeDef = currentRouteBeingProcessed; // Add route definition
+                                    emitter.emit("routeConstraintGood", requestObject);
+                                };
+
+                                // Wrap constraint execution with error handling
+                                try {
+                                    routeList[item].constraint.call(newObj, requestObject);
+                                } catch(constraintError) {
+                                    const routeError = handleRoutingError(
+                                        requestObject.pathName,
+                                        [],
+                                        {
+                                            type: 'CONSTRAINT_ERROR',
+                                            route: currentRouteBeingProcessed,
+                                            error: constraintError
+                                        }
+                                    );
+                                    logger.error({
+                                        code: 'MC_ERR_ROUTE_CONSTRAINT',
+                                        message: `Route constraint failed for ${currentRouteBeingProcessed.path}`,
+                                        route: currentRouteBeingProcessed,
+                                        error: constraintError.message,
+                                        stack: constraintError.stack
+                                    });
+                                    throw constraintError;
+                                }
+
+                                return true;
+                            }else{
 
-                    requestObject.toController = routeList[item].toController;
-                    requestObject.toAction = routeList[item].toAction;
-                    var pathObj = normalizePaths(requestObject.pathName, routeList[item].path, requestObject.params);
-                    // if we find the route that matches the request
-                    if(pathObj.requestPath === pathObj.routePath && routeList[item].type === requestObject.type){
-
-                        // call Constraint
-                        if(typeof routeList[item].constraint === "function"){
-                            
-                            var newObj = {};
-                            //tools.combineObjects(newObj, master.controllerList);
-                            newObj.next = function(){
                                 currentRoute.root = root;
                                 currentRoute.pathName = requestObject.pathName;
                                 currentRoute.toAction = requestObject.toAction;
                                 currentRoute.toController = requestObject.toController;
                                 currentRoute.response = requestObject.response;
                                 currentRoute.isComponent = isComponent;
+                                currentRoute.routeDef = currentRouteBeingProcessed; // Add route definition
                                 emitter.emit("routeConstraintGood", requestObject);
-                            };
-                            routeList[item].constraint.call(newObj, requestObject);
-                            return true;
-                        }else{
-
-                            currentRoute.root = root;
-                            currentRoute.pathName = requestObject.pathName;
-                            currentRoute.toAction = requestObject.toAction;
-                            currentRoute.toController = requestObject.toController;
-                            currentRoute.response = requestObject.response;
-                            currentRoute.isComponent = isComponent;
-                            emitter.emit("routeConstraintGood", requestObject);
+                                return true;
+                            }
+
+                        }
+
+                        if(pathObj.requestPath === pathObj.routePath && "options" ===requestObject.type.toLowerCase()){
+                            // this means that the request is correct but its an options request means its the browser checking to see if the request is allowed
+                            requestObject.response.writeHead(200, {'Content-Type': 'application/json'});
+                            requestObject.response.end(JSON.stringify({"done": "true"}));
                             return true;
                         }
-                        
-                    }
+                    } catch(routeProcessError) {
+                        // Log the specific route that failed
+                        logger.error({
+                            code: 'MC_ERR_ROUTE_PROCESS',
+                            message: `Failed to process route: ${currentRouteBeingProcessed.path}`,
+                            route: currentRouteBeingProcessed,
+                            requestPath: requestObject.pathName,
+                            error: routeProcessError.message,
+                            stack: routeProcessError.stack
+                        });
 
-                    if(pathObj.requestPath === pathObj.routePath && "options" ===requestObject.type.toLowerCase()){
-                        // this means that the request is correct but its an options request means its the browser checking to see if the request is allowed
-                        requestObject.response.writeHead(200, {'Content-Type': 'application/json'});
-			            requestObject.response.end(JSON.stringify({"done": "true"}));
-                        return true;
+                        // Re-throw to be caught by outer try-catch
+                        throw routeProcessError;
                     }
-                   
+
                 };
                 return -1;
             }
         }
         catch(e){
-            throw new Error("Error processing routes: " + e.stack); 
+            // Enhanced error message with route context
+            const errorDetails = currentRouteBeingProcessed
+                ? `\n\nFailing Route:\n  Path: ${currentRouteBeingProcessed.path}\n  Controller: ${currentRouteBeingProcessed.toController}#${currentRouteBeingProcessed.toAction}\n  Method: ${currentRouteBeingProcessed.type.toUpperCase()}\n\nRequest:\n  Path: ${requestObject.pathName}\n  Method: ${requestObject.type.toUpperCase()}`
+                : '';
+
+            throw new Error(`Error processing routes: ${e.message}${errorDetails}\n\nOriginal Stack:\n${e.stack}`);
         }
 };
 
@@ -257,40 +383,113 @@ class MasterRouter {
 
     _call(requestObject){
 
+         // Start performance tracking
+         const requestId = `${Date.now()}-${Math.random()}`;
+         performanceTracker.start(requestId, requestObject);
+
          tools.combineObjects(master.requestList, requestObject);
          requestObject = master.requestList;
          var Control = null;
+
          try{
-             Control = require(path.join(currentRoute.root, 'app', 'controllers', `${tools.firstLetterlowercase(requestObject.toController)}Controller`));
-         }catch(e){
+             // Try to load controller
              try{
-                 Control = require(path.join(currentRoute.root, 'app', 'controllers', `${tools.firstLetterUppercase(requestObject.toController)}Controller`));
-             }catch(e2){
-                 console.log(`Cannot find controller name - ${requestObject.toController}`);
+                 Control = require(path.join(currentRoute.root, 'app', 'controllers', `${tools.firstLetterlowercase(requestObject.toController)}Controller`));
+             }catch(e){
+                 try{
+                     Control = require(path.join(currentRoute.root, 'app', 'controllers', `${tools.firstLetterUppercase(requestObject.toController)}Controller`));
+                 }catch(e2){
+                     // Controller not found - handle error
+                     const error = handleControllerError(
+                         new Error(`Controller not found: ${requestObject.toController}Controller`),
+                         requestObject.toController,
+                         requestObject.toAction,
+                         requestObject.pathName,
+                         currentRoute.routeDef // Pass route definition
+                     );
+
+                     sendErrorResponse(requestObject.response, error, requestObject.pathName);
+                     performanceTracker.end(requestId);
+                     return;
+                 }
              }
-         }
-         tools.combineObjectPrototype(Control, master.controllerList);
-         Control.prototype.__namespace = Control.name;
-         Control.prototype.__requestObject = requestObject;
-         Control.prototype.__currentRoute = currentRoute;
-         Control.prototype.__response = requestObject.response;
-         Control.prototype.__request = requestObject.request;
-         var control = new Control(requestObject);
-         var _callEmit = new EventEmitter();
-         
-         _callEmit.on("controller", function(){
-            control.next = function(){
-                control.__callAfterAction(control, requestObject);
-            }
-            // 
-            control[requestObject.toAction](requestObject);
-         });
-        
-         // check if before function is avaliable and wait for it to return
-         if(control.__hasBeforeAction(control, requestObject)){
-             control.__callBeforeAction(control, requestObject, _callEmit);
-         }else{
-            _callEmit.emit("controller");
+
+             tools.combineObjectPrototype(Control, master.controllerList);
+             Control.prototype.__namespace = Control.name;
+             Control.prototype.__requestObject = requestObject;
+             Control.prototype.__currentRoute = currentRoute;
+             Control.prototype.__response = requestObject.response;
+             Control.prototype.__request = requestObject.request;
+             var control = new Control(requestObject);
+             var _callEmit = new EventEmitter();
+
+             _callEmit.on("controller", function(){
+                try {
+                    control.next = function(){
+                        control.__callAfterAction(control, requestObject);
+                    }
+
+                    // Check if action exists
+                    if (typeof control[requestObject.toAction] !== 'function') {
+                        throw new Error(`Action '${requestObject.toAction}' not found in controller ${requestObject.toController}`);
+                    }
+
+                    // Wrap action with error handling
+                    const wrappedAction = errorHandlerMiddleware(
+                        control[requestObject.toAction],
+                        requestObject.toController,
+                        requestObject.toAction
+                    );
+
+                    // Execute action
+                    Promise.resolve(wrappedAction.call(control, requestObject))
+                        .then(() => {
+                            performanceTracker.end(requestId);
+                        })
+                        .catch((error) => {
+                            const mcError = handleControllerError(
+                                error,
+                                requestObject.toController,
+                                requestObject.toAction,
+                                requestObject.pathName,
+                                currentRoute.routeDef // Pass route definition
+                            );
+                            sendErrorResponse(requestObject.response, mcError, requestObject.pathName);
+                            performanceTracker.end(requestId);
+                        });
+
+                } catch (error) {
+                    // Action execution error
+                    const mcError = handleControllerError(
+                        error,
+                        requestObject.toController,
+                        requestObject.toAction,
+                        requestObject.pathName,
+                        currentRoute.routeDef // Pass route definition
+                    );
+                    sendErrorResponse(requestObject.response, mcError, requestObject.pathName);
+                    performanceTracker.end(requestId);
+                }
+             });
+
+             // check if before function is avaliable and wait for it to return
+             if(control.__hasBeforeAction(control, requestObject)){
+                 control.__callBeforeAction(control, requestObject, _callEmit);
+             }else{
+                _callEmit.emit("controller");
+             }
+
+         } catch (error) {
+             // General error
+             const mcError = handleControllerError(
+                 error,
+                 requestObject.toController,
+                 requestObject.toAction,
+                 requestObject.pathName,
+                 currentRoute.routeDef // Pass route definition
+             );
+             sendErrorResponse(requestObject.response, mcError, requestObject.pathName);
+             performanceTracker.end(requestId);
          }
 
     }
@@ -319,8 +518,16 @@ class MasterRouter {
             }
 
             if(routeFound === false){
-                master.error.log(`Cannot find route for path ${requestObject.pathName}`, "warn");
-                master.error.callHttpStatus(404, requestObject.response);
+                // Enhanced 404 handling
+                const allRoutes = [];
+                for (const route of routes) {
+                    if (this._routes[route] && this._routes[route].routes) {
+                        allRoutes.push(...this._routes[route].routes);
+                    }
+                }
+
+                const mcError = handleRoutingError(requestObject.pathName, allRoutes);
+                sendErrorResponse(requestObject.response, mcError, requestObject.pathName);
             }            
 
     }