Fixed long domain names and placed maximum at 64 chars, #3973
Ylian Saint-Hilaire committed
May 13, 2022 at 00:39 UTC
37b698a633cde375f2bb430f21d4eab8fe275e4e
2 files changed
+16
-15
meshcentral.js
+2
-1
@@ -1256,7 +1256,8 @@ function CreateMeshCentralServer(config, args) {
1256
if (obj.config.domains[''].dns != null) { console.log("ERROR: Default domain can't have a DNS name."); return; }
1257
var xdomains = {}; for (i in obj.config.domains) { xdomains[i.toLowerCase()] = obj.config.domains[i]; } obj.config.domains = xdomains;
1258
var bannedDomains = ['public', 'private', 'images', 'scripts', 'styles', 'views']; // List of banned domains
1259
- for (i in obj.config.domains) { for (var j in bannedDomains) { if (i == bannedDomains[j]) { console.log("ERROR: Domain '" + i + "' is not allowed domain name in config.json."); return; } } }
1259
+ for (i in obj.config.domains) { for (var j in bannedDomains) { if (i == bannedDomains[j]) { console.log("ERROR: Domain '" + i + "' is not allowed domain name in config.json."); delete obj.config.domains[i]; } } }
1260
+ for (i in obj.config.domains) { if ((i.length > 64) || (Buffer.from(i).length > 64)) { console.log("ERROR: Domain '" + i + "' is longer that 64 bytes, this is not allowed."); delete obj.config.domains[i]; } }
1261
for (i in obj.config.domains) {
1262
// Remove any domains that start with underscore
1263
if (i.startsWith('_')) { delete obj.config.domains[i]; continue; }
meshuser.js
+14
-14
@@ -1611,7 +1611,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1611
var err = null;
1612
try {
1613
// Change the current user's notification flags for a meshid
1614
- if (common.validateString(command.meshid, 1, 1024) == false) { err = 'Invalid group identifier'; } // Check the meshid
1614
+ if (common.validateString(command.meshid, 8, 134) == false) { err = 'Invalid group identifier'; } // Check the meshid
1615
else if (command.meshid.indexOf('/') == -1) { command.meshid = 'mesh/' + domain.id + '/' + command.meshid; }
1616
if (common.validateInt(command.notify) == false) { err = 'Invalid notification flags'; }
1617
if (parent.IsMeshViewable(user, command.meshid) == false) err = 'Access denied';
@@ -2033,7 +2033,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
2033
2034
// Validate input
2035
try {
2036
- if (common.validateString(command.meshid, 1, 1024) == false) { err = 'Invalid group identifier'; } // Check the meshid
2036
+ if (common.validateString(command.meshid, 8, 134) == false) { err = 'Invalid group identifier'; } // Check the meshid
2037
else if (command.meshid.indexOf('/') == -1) { command.meshid = 'mesh/' + domain.id + '/' + command.meshid; }
2038
} catch (ex) { err = 'Validation exception: ' + ex; }
2039
@@ -2139,7 +2139,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
2139
2140
// Validate input
2141
try {
2142
- if (common.validateString(command.meshid, 1, 1024) == false) { err = 'Invalid group identifier'; } // Check the meshid
2142
+ if (common.validateString(command.meshid, 8, 134) == false) { err = 'Invalid group identifier'; } // Check the meshid
2143
else if (command.meshid.indexOf('/') == -1) { command.meshid = 'mesh/' + domain.id + '/' + command.meshid; }
2144
if (err == null) {
2145
mesh = parent.meshes[command.meshid];
@@ -2257,8 +2257,8 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
2257
}
2258
2259
try {
2260
- if (common.validateString(command.userid, 1, 1024) == false) { err = "Invalid userid"; } // Check userid
2261
- if (common.validateString(command.meshid, 1, 1024) == false) { err = "Invalid groupid"; } // Check meshid
2260
+ if (common.validateString(command.userid, 8, 1024) == false) { err = "Invalid userid"; } // Check userid
2261
+ if (common.validateString(command.meshid, 8, 134) == false) { err = "Invalid groupid"; } // Check meshid
2262
if (command.userid.indexOf('/') == -1) { command.userid = 'user/' + domain.id + '/' + command.userid; }
2263
if (command.userid == obj.user._id) { err = "Can't remove self"; } // Can't add of modify self
2264
if ((command.userid.split('/').length != 3) || ((obj.crossDomain !== true) && (command.userid.split('/')[1] != domain.id))) { err = "Invalid userid"; } // Invalid domain, operation only valid for current domain
@@ -2343,7 +2343,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
2343
case 'meshamtpolicy':
2344
{
2345
// Change a mesh Intel AMT policy
2346
- if (common.validateString(command.meshid, 1, 1024) == false) break; // Check the meshid
2346
+ if (common.validateString(command.meshid, 8, 134) == false) break; // Check the meshid
2347
if (common.validateObject(command.amtpolicy) == false) break; // Check the amtpolicy
2348
if (common.validateInt(command.amtpolicy.type, 0, 4) == false) break; // Check the amtpolicy.type
2349
if (command.amtpolicy.type === 2) {
@@ -2394,7 +2394,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
2394
}
2395
case 'addlocaldevice':
2396
{
2397
- if (common.validateString(command.meshid, 1, 1024) == false) break; // Check meshid
2397
+ if (common.validateString(command.meshid, 8, 134) == false) break; // Check meshid
2398
if ((command.meshid.split('/').length != 3) || (command.meshid.split('/')[1] != domain.id)) return; // Invalid domain, operation only valid for current domain
2399
if (common.validateString(command.devicename, 1, 256) == false) break; // Check device name
2400
if (common.validateString(command.hostname, 1, 256) == false) break; // Check hostname
@@ -2426,7 +2426,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
2426
case 'addamtdevice':
2427
{
2428
if (args.wanonly == true) return; // This is a WAN-only server, local Intel AMT computers can't be added
2429
- if (common.validateString(command.meshid, 1, 1024) == false) break; // Check meshid
2429
+ if (common.validateString(command.meshid, 8, 134) == false) break; // Check meshid
2430
if ((command.meshid.split('/').length != 3) || (command.meshid.split('/')[1] != domain.id)) return; // Invalid domain, operation only valid for current domain
2431
if (common.validateString(command.devicename, 1, 256) == false) break; // Check device name
2432
if (common.validateString(command.hostname, 1, 256) == false) break; // Check hostname
@@ -2497,7 +2497,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
2497
// Perform input validation
2498
try {
2499
if (common.validateStrArray(command.nodeids, 1, 256) == false) { err = "Invalid nodeids"; } // Check nodeids
2500
- if (common.validateString(command.meshid, 1, 1024) == false) { err = "Invalid groupid"; } // Check meshid
2500
+ if (common.validateString(command.meshid, 8, 134) == false) { err = "Invalid groupid"; } // Check meshid
2501
else {
2502
if (command.meshid.indexOf('/') == -1) { command.meshid = 'mesh/' + domain.id + '/' + command.meshid; }
2503
mesh = parent.meshes[command.meshid];
@@ -3138,7 +3138,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
3138
try {
3139
if ((domain.mailserver == null) || (args.lanonly == true)) { err = 'Unsupported feature'; } // This operation requires the email server
3140
else if ((parent.parent.certificates.CommonName == null) || (parent.parent.certificates.CommonName.indexOf('.') == -1)) { err = 'Unsupported feature'; } // Server name must be configured
3141
- else if (common.validateString(command.meshid, 1, 1024) == false) { err = 'Invalid group identifier'; } // Check meshid
3141
+ else if (common.validateString(command.meshid, 8, 134) == false) { err = 'Invalid group identifier'; } // Check meshid
3142
else {
3143
if (command.meshid.split('/').length == 1) { command.meshid = 'mesh/' + domain.id + '/' + command.meshid; }
3144
if ((command.meshid.split('/').length != 3) || (command.meshid.split('/')[1] != domain.id)) { err = 'Invalid group identifier'; } // Invalid domain, operation only valid for current domain
@@ -3751,10 +3751,9 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
3751
}
3752
}
3753
3754
- if (common.validateString(command.meshid, 8, 128) == false) { err = 'Invalid group id'; } // Check the meshid
3754
+ if (common.validateString(command.meshid, 8, 134) == false) { err = 'Invalid group id'; } // Check the meshid (Max length of a meshid is 134 bytes).
3755
else if (common.validateInt(command.expire, 0, 99999) == false) { err = 'Invalid expire time'; } // Check the expire time in hours
3756
else if (common.validateInt(command.flags, 0, 256) == false) { err = 'Invalid flags'; } // Check the flags
3757
- else if (common.validateString(command.meshid, 1, 1024) == false) { err = 'Invalid group identifier'; } // Check meshid
3757
else {
3758
if (command.meshid.split('/').length == 1) { command.meshid = 'mesh/' + domain.id + '/' + command.meshid; }
3759
var smesh = command.meshid.split('/');
@@ -3766,6 +3765,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
3765
3766
// Handle any errors
3767
if (err != null) {
3768
+ console.log(err, command.meshid);
3769
if (command.responseid != null) { try { ws.send(JSON.stringify({ action: 'createInviteLink', responseid: command.responseid, result: err })); } catch (ex) { } }
3770
break;
3771
}
@@ -3790,7 +3790,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
3790
var err = null;
3791
3792
// Argument validation
3793
- if (common.validateString(command.meshid, 8, 128) == false) { err = 'Invalid device group id'; } // Check the meshid
3793
+ if (common.validateString(command.meshid, 8, 134) == false) { err = 'Invalid device group id'; } // Check the meshid
3794
else if (command.meshid.indexOf('/') == -1) { command.meshid = 'mesh/' + domain.id + '/' + command.meshid; }
3795
else if ((command.meshid.split('/').length != 3) || (command.meshid.split('/')[1] != domain.id)) { err = 'Invalid domain'; } // Invalid domain, operation only valid for current domain
3796
else {
@@ -5179,7 +5179,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
5179
5180
var selfMeshRights = 0;
5181
try {
5182
- if (common.validateString(command.meshid, 1, 1024) == false) { err = 'Invalid groupid'; } // Check the meshid
5182
+ if (common.validateString(command.meshid, 8, 134) == false) { err = 'Invalid groupid'; } // Check the meshid
5183
else if (common.validateInt(command.meshadmin) == false) { err = 'Invalid group rights'; } // Mesh rights must be an integer
5184
else if ((common.validateStrArray(command.usernames, 1, 64) == false) && (common.validateStrArray(command.userids, 1, 128) == false)) { err = 'Invalid usernames'; } // Username is between 1 and 64 characters
5185
else {