solid-server 5.7.9 → 5.7.10

package/.nvmrc

@@ -1 +1 @@
-16.14.0
+v18.19.0

package/default-views/auth/reset-link-sent.hbs

@@ -14,7 +14,7 @@
   </div>
 
   <div class="alert alert-success">
-    <p>A Reset Password link has been sent to your email.</p>
+    <p>A Reset Password link has been sent to the associated email account.</p>
   </div>
 </div>
 </body>

package/lib/ldp.js

@@ -145,18 +145,26 @@ class LDP {
 
     const ldp = this
     debug.handlers('POST -- On parent: ' + containerPath)
-    // prepare slug
+    if (container) {
+      // Containers should not receive an extension
+      extension = ''
+    }
+    // pepare slug
     if (slug) {
-      if (this.isAuxResource(slug, extension)) throw error(403, 'POST is not allowed for auxiliary resources')
       slug = decodeURIComponent(slug)
+
+      if (container) {
+        // the name of a container cannot be a valid auxiliary resource document
+        while (this._containsInvalidSuffixes(slug + '/')) {
+          const idx = slug.lastIndexOf('.')
+          slug = slug.substr(0, idx)
+        }
+      } else if (this.isAuxResource(slug, extension)) throw error(403, 'POST to auxiliary resources is not allowed')
+
       if (slug.match(/\/|\||:/)) {
-        throw error(400, 'The name of new file POSTed may not contain : | or /')
+        throw error(400, 'The name of a POSTed new file may not contain ":" (colon), "|" (pipe), or "/" (slash)')
       }
     }
-    // Containers should not receive an extension
-    if (container) {
-      extension = ''
-    }
 
     // always return a valid URL.
     const resourceUrl = await ldp.getAvailableUrl(hostname, containerPath, { slug, extension, container })
@@ -327,11 +335,25 @@ class LDP {
     } catch (err) { }
   }
 
+  /**
+   * This function is used to make sure a resource or container which contains
+   * reserved suffixes for auxiliary documents cannot be created.
+   * @param {string} path - the uri to check for invalid suffixes
+   * @returns {boolean} true is fail - if the path contains reserved suffixes
+   */
+  _containsInvalidSuffixes (path) {
+    return AUXILIARY_RESOURCES.some(suffix => path.endsWith(suffix + '/'))
+  }
+
   // check whether a document (or container) has the same name as another document (or container)
   async checkItemName (url) {
     let testName, testPath
     const { hostname, pathname } = this.resourceMapper._parseUrl(url) // (url.url || url)
     let itemUrl = this.resourceMapper.resolveUrl(hostname, pathname)
+    // make sure the resource being created does not attempt invalid resource creation
+    if (this._containsInvalidSuffixes(itemUrl)) {
+      throw error(400, `${itemUrl} contained reserved suffixes in path`)
+    }
     const container = itemUrl.endsWith('/')
     try {
       const testUrl = container ? itemUrl.slice(0, -1) : itemUrl + '/'

package/lib/models/account-manager.js

@@ -537,7 +537,7 @@ class AccountManager {
       throw new Error('Email service is not set up')
     }
 
-    if (!userAccount.email) {
+    if (userAccount && !userAccount.email) {
       throw new Error('Account recovery email has not been provided')
     }
   }

package/lib/requests/create-account-request.js

@@ -178,7 +178,7 @@ class CreateAccountRequest extends AuthRequest {
       .then(exists => {
         if (exists) {
           debug(`Canceling account creation, ${userAccount.webId} already exists`)
-          const error = new Error('Account already exists')
+          const error = new Error('Account creation failed')
           error.status = 400
           throw error
         }

package/lib/requests/password-reset-email-request.js

@@ -94,7 +94,7 @@ class PasswordResetEmailRequest extends AuthRequest {
       .then(() => request.validate())
       .then(() => request.loadUser())
       .then(userAccount => request.sendResetLink(userAccount))
-      .then(() => request.renderSuccess())
+      .then(() => request.resetLinkMessage())
       .catch(error => request.error(error))
   }
 
@@ -123,7 +123,10 @@ class PasswordResetEmailRequest extends AuthRequest {
     return this.accountManager.accountExists(username)
       .then(exists => {
         if (!exists) {
-          throw new Error('Account not found for that username')
+          // For security reasons, avoid leaking error information
+          // See: https://github.com/nodeSolidServer/node-solid-server/issues/1770
+          this.accountManager.verifyEmailDependencies()
+          return this.resetLinkMessage()
         }
 
         const userData = { username }
@@ -191,7 +194,7 @@ class PasswordResetEmailRequest extends AuthRequest {
   /**
    * Displays the 'your reset link has been sent' success message view
    */
-  renderSuccess () {
+  resetLinkMessage () {
     this.response.render('auth/reset-link-sent')
   }
 }

package/lib/requests/sharing-request.js

@@ -64,10 +64,11 @@ class SharingRequest extends AuthRequest {
    * @param req {IncomingRequest}
    * @param res {ServerResponse}
    */
-  static async get (req, res) {
+  static async get (req, res, next) {
     const request = SharingRequest.fromParams(req, res)
 
     const appUrl = request.getAppUrl()
+    if (!appUrl) return next()
     const appOrigin = appUrl.origin
     const serverUrl = new url.URL(req.app.locals.ldp.serverUri)
 
@@ -153,6 +154,7 @@ class SharingRequest extends AuthRequest {
   }
 
   getAppUrl () {
+    if (!this.authQueryParams.redirect_uri) return
     return new url.URL(this.authQueryParams.redirect_uri)
   }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "solid-server",
   "description": "Solid server on top of the file-system",
-  "version": "5.7.9",
+  "version": "5.7.10",
   "author": {
     "name": "Tim Berners-Lee",
     "email": "timbl@w3.org"
@@ -89,7 +89,7 @@
     "ip-range-check": "0.2.0",
     "is-ip": "^3.1.0",
     "li": "^1.3.0",
-    "mashlib": "^1.8.9",
+    "mashlib": "^1.8.10",
     "mime-types": "^2.1.35",
     "negotiator": "^0.6.3",
     "node-fetch": "^2.7.0",
@@ -146,6 +146,7 @@
     "validate": "node ./test/validate-turtle.js",
     "nyc": "cross-env NODE_TLS_REJECT_UNAUTHORIZED=0 nyc --reporter=text-summary mocha --recursive test/integration/ test/unit/",
     "mocha": "cross-env NODE_TLS_REJECT_UNAUTHORIZED=0 mocha --recursive test/integration/ test/unit/",
+    "mocha-integration": "cross-env NODE_TLS_REJECT_UNAUTHORIZED=0 mocha --recursive test/integration/http-test.js",
     "prepublishOnly": "npm test",
     "postpublish": "git push --follow-tags",
     "test": "npm run standard && npm run validate && npm run nyc",