most-box 0.0.1

package/src/utils/errors.js

@@ -0,0 +1,66 @@
+/**
+ * Custom Error Classes
+ * Helps categorize errors for better frontend handling
+ */
+
+export class AppError extends Error {
+  constructor(message, code = 'UNKNOWN') {
+    super(message)
+    this.name = 'AppError'
+    this.code = code
+  }
+}
+
+export class ValidationError extends AppError {
+  constructor(message) {
+    super(message, 'VALIDATION_ERROR')
+    this.name = 'ValidationError'
+  }
+}
+
+export class FileSizeError extends AppError {
+  constructor(message, size) {
+    super(message, 'FILE_SIZE_ERROR')
+    this.name = 'FileSizeError'
+    this.size = size
+  }
+}
+
+export class PathSecurityError extends AppError {
+  constructor(message = 'Path validation failed') {
+    super(message, 'PATH_SECURITY_ERROR')
+    this.name = 'PathSecurityError'
+  }
+}
+
+export class PeerNotFoundError extends AppError {
+  constructor(message = 'No peers found. Please ensure the publisher is online.') {
+    super(message, 'PEER_NOT_FOUND')
+    this.name = 'PeerNotFoundError'
+  }
+}
+
+export class IntegrityError extends AppError {
+  constructor(message = 'File integrity check failed. File may be corrupted or tampered.') {
+    super(message, 'INTEGRITY_ERROR')
+    this.name = 'IntegrityError'
+  }
+}
+
+export class PermissionError extends AppError {
+  constructor(message = 'Permission denied') {
+    super(message, 'PERMISSION_ERROR')
+    this.name = 'PermissionError'
+  }
+}
+
+export class EngineNotInitializedError extends AppError {
+  constructor(message = 'Engine not initialized. Call start() first.') {
+    super(message, 'ENGINE_NOT_INITIALIZED')
+    this.name = 'EngineNotInitializedError'
+  }
+}
+
+export function isErrorWithCode(err, code) {
+  return err && err.code === code
+}

package/src/utils/security.js

@@ -0,0 +1,166 @@
+import path from 'node:path'
+import fs from 'node:fs'
+
+import { MAX_FILE_SIZE } from '../config.js'
+
+const DANGEROUS_CHARS = /[<>:"|?*\x00-\x1f]/g
+const DANGEROUS_PREFIXES = /^[\s.]+|[\s.]+$/
+const RESERVED_NAMES = /^(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])$/i
+
+/**
+ * Sanitize filename to prevent security issues
+ * @param {string} filename - Original filename
+ * @returns {string} - Sanitized filename
+ */
+export function sanitizeFilename(filename) {
+  if (typeof filename !== 'string') {
+    throw new Error('Filename must be a string')
+  }
+  
+  let sanitized = filename
+  
+  // Normalize backslashes to forward slashes (S3-style folder paths)
+  sanitized = sanitized.replace(/\\/g, '/')
+  
+  // Remove dangerous characters but preserve / for folder paths
+  sanitized = sanitized.replace(/[<>:"|?*\x00-\x1f]/g, '_')
+  
+  // Remove dangerous prefixes/suffixes
+  sanitized = sanitized.replace(DANGEROUS_PREFIXES, '')
+  
+  // Prevent path traversal
+  sanitized = sanitized.replace(/\.\./g, '_')
+  
+  // Normalize multiple consecutive slashes
+  sanitized = sanitized.replace(/\/{2,}/g, '/')
+  
+  // Remove leading/trailing slashes
+  sanitized = sanitized.replace(/^\/+|\/+$/g, '')
+  
+  // Sanitize each path segment individually
+  const segments = sanitized.split('/')
+  const safeSegments = segments.map(seg => {
+    let safe = seg.replace(/[<>:"|?*]/g, '_')
+    const baseName = safe.replace(/\.[^.]+$/, '')
+    if (RESERVED_NAMES.test(baseName)) {
+      safe = '_' + safe
+    }
+    return safe.substring(0, 255) || 'unnamed'
+  })
+  
+  sanitized = safeSegments.join('/')
+  
+  return sanitized || 'unnamed_file'
+}
+
+/**
+ * Validate and sanitize file path to prevent path traversal attacks
+ * @param {string} inputPath - User input path
+ * @param {object} options - Validation options
+ * @param {string} [options.allowedBase] - Base directory that paths must be within (optional)
+ * @returns {{ cleanPath: string, error?: string }}
+ */
+export function validateAndSanitizePath(inputPath, options = {}) {
+  if (typeof inputPath !== 'string') {
+    return { cleanPath: '', error: 'Path must be a string' }
+  }
+  
+  let cleanPath = inputPath
+  
+  cleanPath = cleanPath.replace(/[\u200B-\u200D\uFEFF\u202A-\u202E]/g, '')
+  
+  cleanPath = cleanPath.replace(/"/g, '').trim()
+  
+  const pathTraversalPattern = /\.\./
+  if (pathTraversalPattern.test(cleanPath)) {
+    return { cleanPath: '', error: 'Path traversal detected: path cannot contain ".."' }
+  }
+  
+  cleanPath = path.normalize(cleanPath)
+  
+  if (options.allowedBase) {
+    const resolvedPath = path.resolve(cleanPath)
+    const allowedBase = path.resolve(options.allowedBase)
+    if (!resolvedPath.startsWith(allowedBase)) {
+      return { cleanPath: '', error: 'Path must be within allowed directory' }
+    }
+  }
+  
+  return { cleanPath }
+}
+
+/**
+ * Check if file size is within limits
+ * @param {string} filePath - Path to file
+ * @param {number} [maxSize] - Maximum allowed size in bytes (default: 100GB)
+ * @returns {{ valid: boolean, size?: number, error?: string }}
+ */
+export async function validateFileSize(filePath, maxSize = MAX_FILE_SIZE) {
+  try {
+    const stats = await fs.promises.stat(filePath)
+    const size = stats.size
+    
+    if (!stats.isFile()) {
+      return { valid: false, error: 'Path is not a file' }
+    }
+    
+    if (size > maxSize) {
+      const maxGB = Math.round(maxSize / (1024 * 1024 * 1024))
+      return { 
+        valid: false, 
+        size, 
+        error: `File size exceeds limit of ${maxGB} GB` 
+      }
+    }
+    
+    return { valid: true, size }
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      return { valid: false, error: 'File does not exist' }
+    }
+    return { valid: false, error: `Failed to check file size: ${err.message}` }
+  }
+}
+
+/**
+ * Check if directory is writable
+ * @param {string} dirPath - Directory path to check
+ * @returns {{ writable: boolean, error?: string }}
+ */
+export async function checkDirectoryWritable(dirPath) {
+  try {
+    if (!fs.existsSync(dirPath)) {
+      fs.mkdirSync(dirPath, { recursive: true })
+    }
+    
+    const testFile = path.join(dirPath, '.write-test-' + Date.now())
+    await fs.promises.writeFile(testFile, 'test')
+    await fs.promises.unlink(testFile)
+    
+    return { writable: true }
+  } catch (err) {
+    return { 
+      writable: false, 
+      error: `Cannot write to directory: ${err.message}` 
+    }
+  }
+}
+
+/**
+ * Get human-readable file size string
+ * @param {number} bytes - Size in bytes
+ * @returns {string}
+ */
+export function formatFileSize(bytes) {
+  const units = ['B', 'KB', 'MB', 'GB', 'TB']
+  let unitIndex = 0
+  let size = bytes
+  
+  while (size >= 1024 && unitIndex < units.length - 1) {
+    size /= 1024
+    unitIndex++
+  }
+  
+  return `${size.toFixed(2)} ${units[unitIndex]}`
+}
+