Validate avatar_url field with a middleware (#3314) * Validate avatar_url field with a middleware * Fix validating wrong endpoint

0937f44f397eaca9c21b5a8334aca54dd3f506cc

Cohee <18619528+Cohee1207@users.noreply.github.com>

Signed

Parents: d4672b3517a09e023dcae9257eff3f2adff68797

src/endpoints/avatars.js+2 -1 Viewed

 import { jsonParser, urlencodedParser } from '../express-common.js';
 import { AVATAR_WIDTH, AVATAR_HEIGHT } from '../constants.js';
 import { getImages, tryParse } from '../util.js';
 +import { getFileNameValidationFunction } from '../middleware/validateFileName.js';
 export const router = express.Router();

     response.send(JSON.stringify(images));
 });
 router.post('/delete', jsonParser, getFileNameValidationFunction('avatar'), function (request, response) {
     if (!request.body) return response.sendStatus(400);
     if (request.body.avatar !== sanitize(request.body.avatar)) {

src/endpoints/backgrounds.js+2 -1 Viewed

 import { jsonParser, urlencodedParser } from '../express-common.js';
 import { invalidateThumbnail } from './thumbnails.js';
 import { getImages } from '../util.js';
 +import { getFileNameValidationFunction } from '../middleware/validateFileName.js';
 export const router = express.Router();

     response.send(JSON.stringify(images));
 });
 router.post('/delete', jsonParser, getFileNameValidationFunction('bg'), function (request, response) {
     if (!request.body) return response.sendStatus(400);
     if (request.body.bg !== sanitize(request.body.bg)) {

src/endpoints/characters.js+10 -9 Viewed

 import { AVATAR_WIDTH, AVATAR_HEIGHT } from '../constants.js';
 import { jsonParser, urlencodedParser } from '../express-common.js';
 +import { default as validateAvatarUrlMiddleware, getFileNameValidationFunction } from '../middleware/validateFileName.js';
 import { deepMerge, humanizedISO8601DateTime, tryParse, extractFileFromZipBuffer, MemoryLimitedMap, getConfigValue } from '../util.js';
 import { TavernCardValidator } from '../validator/TavernCardValidator.js';
 import { parse, write } from '../character-card-parser.js';

@@ -756,7 +757,7 @@ router.post('/create', urlencodedParser, async function (request, response) {
756	757	}
757	758	});
758	759
759	760	router.post('/rename', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
760	761	if (!request.body.avatar_url \|\| !request.body.new_name) {
761	762	return response.sendStatus(400);
762	763	}

+    }
 });
 router.post('/edit', urlencodedParser, validateAvatarUrlMiddleware, async function (request, response) {
     if (!request.body) {
         console.error('Error: no response body detected');
         response.status(400).send('Error: no response body detected');

  * @param {Object} response - The HTTP response object.
  * @returns {void}
  */
 router.post('/edit-attribute', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
     console.log(request.body);
     if (!request.body) {
         console.error('Error: no response body detected');

+ *
  * @returns {void}
  * */
 router.post('/merge-attributes', jsonParser, getFileNameValidationFunction('avatar'), async function (request, response) {
     try {
         const update = request.body;
         const avatarPath = path.join(request.user.directories.characters, update.avatar);

@@ -929,7 +930,7 @@ router.post('/merge-attributes', jsonParser, async function (request, response)
929	930	}
930	931	});
931	932
932	933	router.post('/delete', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
933	934	if (!request.body \|\| !request.body.avatar_url) {
934	935	return response.sendStatus(400);
935	936	}

+    }
 });
 router.post('/get', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
     try {
         if (!request.body) return response.sendStatus(400);
         const item = request.body.avatar_url;

+    }
 });
 router.post('/chats', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
     if (!request.body) return response.sendStatus(400);
     const characterDirectory = (request.body.avatar_url).replace('.png', '');

+    }
 });
 router.post('/duplicate', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
     try {
         if (!request.body.avatar_url) {
             console.log('avatar URL not found in request body');

+    }
 });
 router.post('/export', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
     try {
         if (!request.body.format || !request.body.avatar_url) {
             return response.sendStatus(400);

src/endpoints/chats.js+8 -7 Viewed

 import _ from 'lodash';
 import { jsonParser, urlencodedParser } from '../express-common.js';
 +import validateAvatarUrlMiddleware from '../middleware/validateFileName.js';
 import {
     getConfigValue,
     humanizedISO8601DateTime,

 export const router = express.Router();
 router.post('/save', jsonParser, validateAvatarUrlMiddleware, function (request, response) {
     try {
         const directoryName = String(request.body.avatar_url).replace('.png', '');
         const chatData = request.body.chat;

+    }
 });
 router.post('/get', jsonParser, validateAvatarUrlMiddleware, function (request, response) {
     try {
         const dirName = String(request.body.avatar_url).replace('.png', '');
         const directoryPath = path.join(request.user.directories.chats, dirName);

 });
 router.post('/rename', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
     if (!request.body || !request.body.original_file || !request.body.renamed_file) {
         return response.sendStatus(400);
+    }

     return response.send({ ok: true, sanitizedFileName });
 });
 router.post('/delete', jsonParser, validateAvatarUrlMiddleware, function (request, response) {
     const dirName = String(request.body.avatar_url).replace('.png', '');
     const fileName = String(request.body.chatfile);
     const filePath = path.join(request.user.directories.chats, dirName, sanitize(fileName));

     return response.send('ok');
 });
 router.post('/export', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
     if (!request.body.file || (!request.body.avatar_url && request.body.is_group === false)) {
         return response.sendStatus(400);
+    }

+    }
 });
 router.post('/import', urlencodedParser, validateAvatarUrlMiddleware, function (request, response) {
     if (!request.body) return response.sendStatus(400);
     const format = request.body.file_type;

     return response.send({ ok: true });
 });
 router.post('/search', jsonParser, validateAvatarUrlMiddleware, function (request, response) {
     try {
         const { query, avatar_url, group_id } = request.body;
         let chatFiles = [];

src/endpoints/settings.js+3 -2 Viewed

 import { getConfigValue, generateTimestamp, removeOldBackups } from '../util.js';
 import { jsonParser } from '../express-common.js';
 import { getAllUserHandles, getUserDirectories } from '../users.js';
 +import { getFileNameValidationFunction } from '../middleware/validateFileName.js';
 const ENABLE_EXTENSIONS = !!getConfigValue('extensions.enabled', true);
 const ENABLE_EXTENSIONS_AUTO_UPDATE = !!getConfigValue('extensions.autoUpdate', true);

+    }
 });
 router.post('/load-snapshot', jsonParser, getFileNameValidationFunction('name'), async (request, response) => {
     try {
         const userFilesPattern = getFilePrefix(request.user.profile.handle);

+    }
 });
 router.post('/restore-snapshot', jsonParser, getFileNameValidationFunction('name'), async (request, response) => {
     try {
         const userFilesPattern = getFilePrefix(request.user.profile.handle);

src/middleware/validateFileName.js+34 -0 Viewed

 +import path from 'node:path';
++
 +/**
 + * Gets a middleware function that validates the field in the request body.
 + * @param {string} fieldName Field name
 + * @returns {import('express').RequestHandler} Middleware function
 + */
 +export function getFileNameValidationFunction(fieldName) {
 +    /**
 +    * Validates the field in the request body.
 +    * @param {import('express').Request} req Request object
 +    * @param {import('express').Response} res Response object
 +    * @param {import('express').NextFunction} next Next middleware
 +    */
 +    return function validateAvatarUrlMiddleware(req, res, next) {
 +        if (req.body && fieldName in req.body && typeof req.body[fieldName] === 'string') {
 +            const forbiddenRegExp = path.sep === '/' ? /[/\x00]/ : /[/\x00\\]/;
 +            if (forbiddenRegExp.test(req.body[fieldName])) {
 +                console.error('An error occurred while validating the request body', {
 +                    handle: req.user.profile.handle,
 +                    path: req.originalUrl,
 +                    field: fieldName,
 +                    value: req.body[fieldName],
 +                });
 +                return res.sendStatus(400);
 +            }
 +        }
++
 +        next();
 +    };
 +}
++
 +const avatarUrlValidationFunction = getFileNameValidationFunction('avatar_url');
 +export default avatarUrlValidationFunction;