Added URL args validation.
Ylian Saint-Hilaire committed
Jun 21, 2020 at 01:45 UTC
a7ea8fead55f112de173006cb9ad7e00ce794ffa
6 files changed
+22
-8
common.js
+3
-1
@@ -157,10 +157,12 @@ module.exports.unEscapeAllLinksFieldName = function (docs) { for (var i in docs)
157
module.exports.validateString = function (str, minlen, maxlen) { return ((str != null) && (typeof str == 'string') && ((minlen == null) || (str.length >= minlen)) && ((maxlen == null) || (str.length <= maxlen))); };
158
module.exports.validateInt = function (int, minval, maxval) { return ((int != null) && (typeof int == 'number') && ((minval == null) || (int >= minval)) && ((maxval == null) || (int <= maxval))); };
159
module.exports.validateArray = function (array, minlen, maxlen) { return ((array != null) && Array.isArray(array) && ((minlen == null) || (array.length >= minlen)) && ((maxlen == null) || (array.length <= maxlen))); };
160
-module.exports.validateStrArray = function (array, minlen, maxlen) { if (((array != null) && Array.isArray(array)) == false) return false; for (var i in array) { if ((typeof array[i] != 'string') && ((minlen == null) || (array[i].length >= minlen)) && ((maxlen == null) || (array[i].length <= maxlen))) return false; } return true; };
160
+module.exports.validateStrArray = function (array, minlen, maxlen) { if (((array != null) && Array.isArray(array)) == false) return false; for (var i in array) { if ( (typeof array[i] != 'string') || ((minlen != null) && (array[i].length < minlen)) || ((maxlen != null) && (array[i].length > maxlen))) return false; } return true; };
161
module.exports.validateObject = function (obj) { return ((obj != null) && (typeof obj == 'object')); };
162
module.exports.validateEmail = function (email, minlen, maxlen) { if (module.exports.validateString(email, minlen, maxlen) == false) return false; var emailReg = /^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/; return emailReg.test(email); };
163
module.exports.validateUsername = function (username, minlen, maxlen) { return (module.exports.validateString(username, minlen, maxlen) && (username.indexOf(' ') == -1) && (username.indexOf('"') == -1) && (username.indexOf(',') == -1)); };
164
+module.exports.isAlphaNumeric = function (str) { return (str.match(/^[A-Za-z0-9]+$/) != null); };
165
+module.exports.validateAlphaNumericArray = function (array, minlen, maxlen) { if (((array != null) && Array.isArray(array)) == false) return false; for (var i in array) { if ((typeof array[i] != 'string') || (module.exports.isAlphaNumeric(array[i]) == false) || ((minlen != null) && (array[i].length < minlen)) || ((maxlen != null) && (array[i].length > maxlen)) ) return false; } return true; };
166
167
// Check password requirements
168
module.exports.checkPasswordRequirements = function(password, requirements) {
meshcentral.js
+1
@@ -1044,6 +1044,7 @@ function CreateMeshCentralServer(config, args) {
1044
if (obj.config.domains[i].dns == null) { obj.config.domains[i].url = (i == '') ? '/' : ('/' + i + '/'); } else { obj.config.domains[i].url = '/'; }
1045
obj.config.domains[i].id = i;
1046
if (typeof obj.config.domains[i].loginkey == 'string') { obj.config.domains[i].loginkey = [obj.config.domains[i].loginkey]; }
1047
+ if ((obj.config.domains[i].loginkey != null) && (obj.common.validateAlphaNumericArray(obj.config.domains[i].loginkey, 1, 128) == false)) { console.log("ERROR: Invalid login key, must be alpha-numeric string with no spaces."); process.exit(); return; }
1048
if (typeof obj.config.domains[i].userallowedip == 'string') { if (obj.config.domains[i].userallowedip == '') { obj.config.domains[i].userallowedip = null; } else { obj.config.domains[i].userallowedip = obj.config.domains[i].userallowedip.split(','); } }
1049
if (typeof obj.config.domains[i].userblockedip == 'string') { if (obj.config.domains[i].userblockedip == '') { obj.config.domains[i].userblockedip = null; } else { obj.config.domains[i].userblockedip = obj.config.domains[i].userblockedip.split(','); } }
1050
if (typeof obj.config.domains[i].agentallowedip == 'string') { if (obj.config.domains[i].agentallowedip == '') { obj.config.domains[i].agentallowedip = null; } else { obj.config.domains[i].agentallowedip = obj.config.domains[i].agentallowedip.split(','); } }
public/scripts/common-0.0.1.js
+4
-1
@@ -107,4 +107,7 @@ function random(max) { return Math.floor(Math.random() * max); }
107
function trademarks(x) { return x.replace(/\(R\)/g, '®').replace(/\(TM\)/g, '™'); }
108
109
// Pad a number with zeros on the left
110
-function zeroPad(num, c) { if (c == null) { c = 2; } var s = "00000000" + num; return s.substr(s.length - c); }
\ No newline at end of file
110
+function zeroPad(num, c) { if (c == null) { c = 2; } var s = "00000000" + num; return s.substr(s.length - c); }
111
+
112
+// String validation
113
+function isAlphaNumeric(str) { return (str.match(/^[A-Za-z0-9]+$/) != null); };
\ No newline at end of file
views/default-mobile.handlebars
+4
-1
@@ -735,7 +735,10 @@
735
for (var i in webState) { localStorage.setItem(i, webState[i]); }
736
if (!webState.loctag) { delete localStorage.removeItem('loctag'); }
737
738
- var args = parseUriArgs(), urlargs = args;
738
+ var urlargs = parseUriArgs();
739
+ if (urlargs.key && (isAlphaNumeric(urlargs.key) == false)) { delete urlargs.key; }
740
+ if (urlargs.locale && (isAlphaNumeric(urlargs.locale) == false)) { delete urlargs.locale; }
741
+ var args = urlargs;
742
var debugLevel = parseInt('{{{debuglevel}}}');
743
var features = parseInt('{{{features}}}');
744
var sessionTime = parseInt('{{{sessiontime}}}');
views/default.handlebars
+7
-4
@@ -1273,8 +1273,10 @@
1273
if (top != self && (loc == null || top.active == false)) { top.location = self.location; return; }
1274
}
1275
1276
- // Fetch URL arguments
1276
+ // Fetch URL arguments & do sanitation
1277
urlargs = parseUriArgs();
1278
+ if (urlargs.key && (isAlphaNumeric(urlargs.key) == false)) { delete urlargs.key; }
1279
+ if (urlargs.locale && (isAlphaNumeric(urlargs.locale) == false)) { delete urlargs.locale; }
1280
delete urlargs.viewmode;
1281
delete urlargs.gotonode;
1282
delete urlargs.gotomesh;
@@ -1282,12 +1284,13 @@
1284
delete urlargs.gotougrp;
1285
1286
// Fix links if a loginKey is used
1285
- if (urlargs.key) {
1286
- Q('termsLinkFooter').href += '?key=' + urlargs.key;
1287
- }
1287
+ if (urlargs.key) { Q('termsLinkFooter').href += '?key=' + urlargs.key; }
1288
1289
// Check if we are in debug mode
1290
args = parseUriArgs();
1291
+ if (args.key && (isAlphaNumeric(args.key) == false)) { delete args.key; }
1292
+ if (args.locale && (isAlphaNumeric(args.locale) == false)) { delete args.locale; }
1293
+
1294
if (!args.locale) { var x = getstore('loctag', 0); if ((x != null) && (x != '*')) { args.locale = x; } }
1295
debugmode = args.debug;
1296
views/messenger.handlebars
+3
-1
@@ -42,9 +42,11 @@
42
<input id="uploadFileInput" type="file" multiple style="display:none">
43
<script type="text/javascript" onunload="onUnLoad()">
44
var userInputFocus = 0;
45
- var args = parseUriArgs();
45
var socket = null; // Websocket object
46
var state = 0; // Connection state. 0 = Disconnected, 1 = Connecting, 2 = Connected.
47
+ var args = parseUriArgs();
48
+ if (args.key && (isAlphaNumeric(args.key) == false)) { delete args.key; }
49
+ if (args.locale && (isAlphaNumeric(args.locale) == false)) { delete args.locale; }
50
51
// WebRTC sessions and data, audio and video channels
52
var random = Math.random(); // Selected random, larger value initiates WebRTC.