Chapter 9: Malicious Input samples

2020-09-06 00:20:09 +01:00
parent d8520f9bea
commit a77f753e2f
7 changed files with 558 additions and 0 deletions
@@ -0,0 +1,52 @@
+const http = require("http");
+const { STATUS_CODES } = http;
+
+const Ajv = require("ajv");
+const ajv = new Ajv();
+const schema = {
+  title: "Greeting",
+  properties: {
+    msg: { type: "string" },
+    name: { type: "string" },
+  },
+  additionalProperties: false,
+  required: ["msg"],
+};
+const validate = ajv.compile(schema);
+
+const server = http.createServer((req, res) => {
+  if (req.method === "POST" && req.url === "/") {
+    greeting(req, res);
+    return;
+  }
+
+  res.statusCode = 404;
+  res.end(STATUS_CODES[res.statusCode]);
+});
+
+greeting = (req, res) => {
+  let data = "";
+  req.on("data", (chunk) => (data += chunk));
+  req.on("end", () => {
+    try {
+      data = JSON.parse(data);
+    } catch (e) {
+      res.end('{"msg": ""}');
+      return;
+    }
+
+    if (!validate(data, schema)) {
+      res.end("");
+      return;
+    }
+
+    if (data.hasOwnProperty("name")) {
+      res.end(`${data.msg} ${data.name}`);
+    } else {
+      res.end(data.msg);
+    }
+  });
+};
+
+server.listen(3000);
+
@@ -0,0 +1,45 @@
+{
+  "requires": true,
+  "lockfileVersion": 1,
+  "dependencies": {
+    "ajv": {
+      "version": "6.12.4",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.4.tgz",
+      "integrity": "sha512-eienB2c9qVQs2KWexhkrdMLVDoIQCz5KSeLxwg9Lzk4DOfBtIK9PQwwufcsn1jjGuf9WZmqPMbGxOzfcuphJCQ==",
+      "requires": {
+        "fast-deep-equal": "3.1.3",
+        "fast-json-stable-stringify": "2.1.0",
+        "json-schema-traverse": "0.4.1",
+        "uri-js": "4.4.0"
+      }
+    },
+    "fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="
+    },
+    "fast-json-stable-stringify": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
+      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw=="
+    },
+    "json-schema-traverse": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg=="
+    },
+    "punycode": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.1.1.tgz",
+      "integrity": "sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A=="
+    },
+    "uri-js": {
+      "version": "4.4.0",
+      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.0.tgz",
+      "integrity": "sha512-B0yRTzYdUCCn9n+F4+Gh4yIDtMQcaJsmYBDsTSG8g/OejKBodLQ2IHfN3bM7jUsRXndopT7OIXWdYqc1fjmV6g==",
+      "requires": {
+        "punycode": "2.1.1"
+      }
+    }
+  }
+}
@@ -0,0 +1,34 @@
+const http = require("http");
+const { STATUS_CODES } = http;
+
+const server = http.createServer((req, res) => {
+  if (req.method === "POST" && req.url === "/") {
+    greeting(req, res);
+    return;
+  }
+
+  res.statusCode = 404;
+  res.end(STATUS_CODES[res.statusCode]);
+});
+
+greeting = (req, res) => {
+  let data = "";
+  req.on("data", (chunk) => (data += chunk));
+  req.on("end", () => {
+    try {
+      data = JSON.parse(data);
+    } catch (e) {
+      res.end('{"msg": ""}');
+      return;
+    }
+
+    if (data.hasOwnProperty("name")) {
+      res.end(`${data.msg} ${data.name}`);
+    } else {
+      res.end(data.msg);
+    }
+  });
+};
+
+server.listen(3000);
+