mastercontroller 1.3.9 → 1.3.12

package/MasterRequest.js

@@ -26,7 +26,20 @@ class MasterRequest{
      if(options){
         this.options = {};
         this.options.disableFormidableMultipartFormData = options.disableFormidableMultipartFormData === null? false : options.disableFormidableMultipartFormData;
-        this.options.formidable = options.formidable === null? {}: options.formidable;
+
+        // CRITICAL FIX: Add file upload limits to prevent DoS attacks
+        // Default formidable configuration with security limits
+        this.options.formidable = {
+            maxFiles: 10,                          // CRITICAL: Limit number of files per request
+            maxFileSize: 50 * 1024 * 1024,        // CRITICAL: 50MB per file (was unlimited)
+            maxTotalFileSize: 100 * 1024 * 1024,  // CRITICAL: 100MB total for all files
+            maxFields: 1000,                       // Limit number of fields
+            maxFieldsSize: 20 * 1024 * 1024,      // 20MB for all fields combined
+            allowEmptyFiles: false,                // Reject empty file uploads
+            minFileSize: 1,                        // Minimum 1 byte
+            ...(options.formidable || {})          // Allow user overrides
+        };
+
         // Body size limits (DoS protection)
         this.options.maxBodySize = options.maxBodySize || 10 * 1024 * 1024; // 10MB default
         this.options.maxJsonSize = options.maxJsonSize || 1 * 1024 * 1024;  // 1MB default for JSON
@@ -74,6 +87,7 @@ class MasterRequest{
                                 // Track uploaded files for cleanup on error
                                 const uploadedFiles = [];
                                 let uploadAborted = false;
+                                let totalUploadedSize = 0; // CRITICAL: Track total upload size
 
                                 $that.form.on('field', function(field, value) {
                                     $that.parsedURL.formData.fields[field] = value;
@@ -87,6 +101,30 @@ class MasterRequest{
                                 $that.form.on('file', function(field, file) {
                                     file.extension = file.name === undefined ? path.extname(file.originalFilename) : path.extname(file.name);
 
+                                    // CRITICAL: Track total uploaded size across all files
+                                    totalUploadedSize += file.size || 0;
+
+                                    // CRITICAL: Enforce maxTotalFileSize limit
+                                    const maxTotalSize = $that.options.formidable.maxTotalFileSize || 100 * 1024 * 1024;
+                                    if (totalUploadedSize > maxTotalSize) {
+                                        uploadAborted = true;
+                                        console.error(`[MasterRequest] Total upload size (${totalUploadedSize} bytes) exceeds limit (${maxTotalSize} bytes)`);
+
+                                        // Cleanup all uploaded files
+                                        uploadedFiles.forEach(f => {
+                                            if (f.filepath) {
+                                                try {
+                                                    $that.deleteFileBuffer(f.filepath);
+                                                } catch (err) {
+                                                    console.error('[MasterRequest] Cleanup failed:', err.message);
+                                                }
+                                            }
+                                        });
+
+                                        reject(new Error(`Total upload size exceeds limit (${maxTotalSize} bytes)`));
+                                        return;
+                                    }
+
                                     if(Array.isArray($that.parsedURL.formData.files[field])){
                                         $that.parsedURL.formData.files[field].push(file);
                                     }
@@ -94,6 +132,9 @@ class MasterRequest{
                                         $that.parsedURL.formData.files[field] = [];
                                         $that.parsedURL.formData.files[field].push(file);
                                     }
+
+                                    // CRITICAL: Log file upload for security audit trail
+                                    console.log(`[MasterRequest] File uploaded: ${file.originalFilename || file.name} (${file.size} bytes)`);
                                 });
 
                                 $that.form.on('error', function(err) {

package/MasterRouter.js

@@ -121,32 +121,33 @@ const isDevelopment = process.env.NODE_ENV !== 'production' && process.env.maste
             }
 
             if(routeList.length > 0){
-                // loop through routes
-                for(var item in routeList){
+                // FIXED: Use for...of instead of for...in for array iteration
+                // This prevents prototype pollution and improves performance
+                for(const route of routeList){
                     // Store current route for error handling
                     currentRouteBeingProcessed = {
-                        path: routeList[item].path,
-                        toController: routeList[item].toController,
-                        toAction: routeList[item].toAction,
-                        type: routeList[item].type
+                        path: route.path,
+                        toController: route.toController,
+                        toAction: route.toAction,
+                        type: route.type
                     };
 
                     try {
-                        requestObject.toController = routeList[item].toController;
-                        requestObject.toAction = routeList[item].toAction;
+                        requestObject.toController = route.toController;
+                        requestObject.toAction = route.toAction;
 
                         // FIX: Create a clean copy of params for each route test to prevent parameter pollution
                         // This prevents parameters from non-matching routes from accumulating in requestObject.params
                         var testParams = Object.assign({}, requestObject.params);
-                        var pathObj = normalizePaths(requestObject.pathName, routeList[item].path, testParams);
+                        var pathObj = normalizePaths(requestObject.pathName, route.path, testParams);
 
                         // if we find the route that matches the request
-                        if(pathObj.requestPath === pathObj.routePath && routeList[item].type === requestObject.type){
+                        if(pathObj.requestPath === pathObj.routePath && route.type === requestObject.type){
                             // Only commit the extracted params if this route actually matches
                             requestObject.params = testParams;
 
                             // call Constraint
-                            if(typeof routeList[item].constraint === "function"){
+                            if(typeof route.constraint === "function"){
 
                                 var newObj = {};
                                 //tools.combineObjects(newObj, this._master.controllerList);
@@ -163,7 +164,7 @@ const isDevelopment = process.env.NODE_ENV !== 'production' && process.env.maste
 
                                 // Wrap constraint execution with error handling
                                 try {
-                                    routeList[item].constraint.call(newObj, requestObject);
+                                    route.constraint.call(newObj, requestObject);
                                 } catch(constraintError) {
                                     const routeError = handleRoutingError(
                                         requestObject.pathName,
@@ -237,11 +238,15 @@ const isDevelopment = process.env.NODE_ENV !== 'production' && process.env.maste
         }
 };
 
-var loadScopedListClasses = function(){
-    for (var key in this._master._scopedList) {
-        var className =  this._master._scopedList[key];
-        this._master.requestList[key] = new className();
-    };
+// CRITICAL FIX: Race condition - Store scoped services in context instead of shared requestList
+// Previously, concurrent requests would overwrite each other's services in the shared requestList object
+// This caused unpredictable behavior and data corruption in production environments
+var loadScopedListClasses = function(context){
+    // FIXED: Use Object.entries() for safe iteration (prevents prototype pollution)
+    for (const [key, className] of Object.entries(this._master._scopedList)) {
+        // Store scoped services in the context object (request-specific) instead of shared requestList
+        context[key] = new className();
+    }
 };
 
 
@@ -397,25 +402,19 @@ class MasterRouter {
     }
 
     findMimeType(fileExt){
-        if(fileExt){
-            var type = undefined;
-            var mime = this.mimeTypes;
-            for(var i in mime) {
-
-                if("." + i === fileExt){
-                    type = mime[i];
-                }
-            }
-            if(type === undefined){
-                return false;
-            }
-            else{
-                return type;
-            }
-        }
-        else{
+        if(!fileExt){
             return false;
         }
+
+        // FIXED: O(1) direct lookup instead of O(n) loop
+        // Remove leading dot if present for consistent lookup
+        const ext = fileExt.startsWith('.') ? fileExt.slice(1) : fileExt;
+
+        // Direct object access - constant time complexity
+        const type = this.mimeTypes[ext];
+
+        // Return the MIME type or false if not found
+        return type || false;
     }
 
     _call(requestObject){
@@ -424,8 +423,11 @@ class MasterRouter {
          const requestId = `${Date.now()}-${Math.random()}`;
          performanceTracker.start(requestId, requestObject);
 
-         tools.combineObjects(this._master.requestList, requestObject);
-         requestObject = this._master.requestList;
+         // CRITICAL FIX: Create a request-specific context instead of using shared requestList
+         // This prevents race conditions where concurrent requests overwrite each other's services
+         const requestContext = Object.create(this._master.requestList);
+         tools.combineObjects(requestContext, requestObject);
+         requestObject = requestContext;
          var Control = null;
 
          try{
@@ -533,9 +535,12 @@ class MasterRouter {
     
     load(rr){ // load the the router
 
-            loadScopedListClasses.call(this);
             var $that = this;
             var requestObject = Object.create(rr);
+
+            // CRITICAL FIX: Load scoped services into request-specific context
+            // Pass requestObject so scoped services are stored per-request, not globally
+            loadScopedListClasses.call(this, requestObject);
             requestObject.pathName = requestObject.pathName.replace(/^\/|\/$/g, '').toLowerCase();
         
             var _loadEmit = new EventEmitter();