Code files

Chapter08/anticipating-malicious-input/app/index-fixed.js

@@ -0,0 +1,21 @@
+'use strict'
+
+const express = require('express')
+const app = express()
+
+app.get('/', (req, res) => {
+  pretendDbQuery(() => {
+    var msg = req.query.msg
+
+    if (Array.isArray(msg)) msg = msg.pop()
+
+    const yelling = (msg || '').toUpperCase()
+    res.send(yelling)
+  })
+})
+
+app.listen(3000)
+
+function pretendDbQuery (cb) {
+  setTimeout(cb, 0)
+}

Chapter08/anticipating-malicious-input/app/index.js

@@ -0,0 +1,17 @@
+'use strict'
+
+const express = require('express')
+const app = express()
+
+app.get('/', (req, res) => {
+  pretendDbQuery(() => {
+    const yelling = (req.query.msg || '').toUpperCase()
+    res.send(yelling)
+  })
+})
+
+app.listen(3000)
+
+function pretendDbQuery (cb) {
+  setTimeout(cb, 0)
+}

Chapter08/anticipating-malicious-input/app/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "app",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "express": "^4.15.2"
+  }
+}

Chapter08/anticipating-malicious-input/buffer-safety/index-fixed.js

@@ -0,0 +1,87 @@
+'use strict'
+
+const http = require('http')
+
+const server = http.createServer((req, res) => {
+  if (req.method === 'GET') {
+    res.setHeader('Content-Type', 'text/html')
+    if (req.url === '/') return res.end(html())
+    res.setHeader('Content-Type', 'application/json')
+    if (req.url === '/friends') return res.end(friends())
+    
+    return
+  }
+  if (req.method === 'POST') {
+    if (req.url === '/') return action(req, res) 
+  }
+})
+
+function html (res) {
+  return `
+    <div id=friends></div>
+    <form>
+      <input id=friend> <input type=submit value="Add Friend">
+    </form>
+    <script>
+      void function () {
+        var friend = document.getElementById('friend')
+        var friends = document.getElementById('friends')
+        function load () {
+          fetch('/friends', {
+            headers: {
+              'Accept': 'application/json, text/plain, */*',
+              'Content-Type': 'application/json'
+            }
+          }).catch((err) => console.error(err))
+            .then((res) => res.json())
+            .then((arr) => friends.innerHTML = arr.map((f) => atob(f)).join('<br>'))
+        }
+        load()
+
+        document.forms[0].addEventListener('submit', function () {
+          fetch('/', {
+            method: 'post', 
+            headers: {
+              'Accept': 'application/json, text/plain, */*',
+              'Content-Type': 'application/json'
+            },
+            body: JSON.stringify({cmd: 'add', friend: friend.value})
+          }).catch((err) => console.error(err))
+            .then(load)
+        })
+      }()
+    </script>
+  `
+}
+
+function friends () {
+  return JSON.stringify(friends.list)
+}
+friends.list = [Buffer.from('Dave').toString('base64')]
+friends.add = (friend) => {
+  friends.list.push(Buffer.from(friend).toString('base64'))
+}
+
+function action (req, res) {
+  var data = ''
+  req.on('data', (chunk) => data += chunk)
+  req.on('end', () => {
+    try {
+      data = JSON.parse(data)
+    } catch (e) {
+      console.error(e)
+      res.end('{"ok": false}')
+      return
+    }
+    if (data.cmd === 'add') {
+      try {
+        friends.add(data.friend)
+      } catch (e) {
+        console.error(e)
+        res.end('{"ok": false}')
+      }
+    }
+  })
+}
+
+server.listen(3000)

Chapter08/anticipating-malicious-input/buffer-safety/index.js

@@ -0,0 +1,80 @@
+'use strict'
+
+const http = require('http')
+
+const server = http.createServer((req, res) => {
+  if (req.method === 'GET') {
+    res.setHeader('Content-Type', 'text/html')
+    if (req.url === '/') return res.end(html())
+    res.setHeader('Content-Type', 'application/json')
+    if (req.url === '/friends') return res.end(friends())
+    
+    return
+  }
+  if (req.method === 'POST') {
+    if (req.url === '/') return action(req, res) 
+  }
+})
+
+function html (res) {
+  return `
+    <div id=friends></div>
+    <form>
+      <input id=friend> <input type=submit value="Add Friend">
+    </form>
+    <script>
+      void function () {
+        var friend = document.getElementById('friend')
+        var friends = document.getElementById('friends')
+        function load () {
+          fetch('/friends', {
+            headers: {
+              'Accept': 'application/json, text/plain, */*',
+              'Content-Type': 'application/json'
+            }
+          }).catch((err) => console.error(err))
+            .then((res) => res.json())
+            .then((arr) => friends.innerHTML = arr.map((f) => atob(f)).join('<br>'))
+        }
+        load()
+
+        document.forms[0].addEventListener('submit', function () {
+          fetch('/', {
+            method: 'post', 
+            headers: {
+              'Accept': 'application/json, text/plain, */*',
+              'Content-Type': 'application/json'
+            },
+            body: JSON.stringify({cmd: 'add', friend: friend.value})
+          }).catch((err) => console.error(err))
+            .then(load)
+        })
+      }()
+    </script>
+  `
+}
+
+function friends () {
+  return JSON.stringify(friends.list)
+}
+friends.list = [Buffer('Dave').toString('base64')]
+friends.add = (friend) => friends.list.push(Buffer(friend).toString('base64'))
+
+function action (req, res) {
+  var data = ''
+  req.on('data', (chunk) => data += chunk)
+  req.on('end', () => {
+    try {
+      data = JSON.parse(data)
+    } catch (e) {
+      res.end('{"ok": false}')
+      return
+    }
+    if (data.cmd === 'add') {
+      friends.add(data.friend)
+    }
+    res.end('{"ok": true}')
+  })
+}
+
+server.listen(3000)

Chapter08/anticipating-malicious-input/json-validation/index-fixed.js

@@ -0,0 +1,78 @@
+'use strict'
+
+const http = require('http')
+const Ajv = require('ajv')
+const ajv = new Ajv
+const schema = {
+  title: 'UserReg',
+  properties: {
+    id: {type: 'integer'},
+    name: {type: 'string'},
+    privileges: {
+      anyOf: [
+        {type: 'string'},
+        {type: 'boolean'},
+        {type: 'array', items: {type: 'string'}},
+        {type: 'object'}
+      ]
+    }
+  },
+  additionalProperties: false,
+  required: ['id', 'name']
+}
+const validate = ajv.compile(schema)
+const {STATUS_CODES} = http
+
+const server = http.createServer((req, res) => {
+
+  if (req.method !== 'POST') {
+    res.statusCode = 404
+    res.end(STATUS_CODES[res.statusCode])
+    return
+  }
+  if (req.url === '/register') {
+    register(req, res)
+    return
+  }
+  res.statusCode = 404
+  res.end(STATUS_CODES[res.statusCode])
+    
+})
+
+function register (req, res) {
+  var data = ''
+  req.on('data', (chunk) => data += chunk)
+  req.on('end', () => {
+    try {
+      data = JSON.parse(data)
+    } catch (e) {
+      res.end('{"ok": false}')
+      return
+    }
+    const valid = validate(data, schema)
+    if (!valid) {
+      console.error(validate.errors)
+      res.end('{"ok": false}')
+      return
+    }
+      
+    if (data.hasOwnProperty('privileges')) {
+      createAdminUser(data)
+      res.end('{"ok": true, "admin": true}')
+    } else {
+      createUser(data)
+      res.end('{"ok": true, "admin": false}')
+    }
+  })
+}
+
+function createAdminUser (user) {
+  const key = user.id + user.name
+  // ... 
+}
+
+function createUser (user) {
+  // ... 
+}
+
+server.listen(3000)

Chapter08/anticipating-malicious-input/json-validation/index.js

@@ -0,0 +1,53 @@
+'use strict'
+
+const http = require('http')
+const {STATUS_CODES} = http
+
+const server = http.createServer((req, res) => {
+
+  if (req.method !== 'POST') {
+    res.statusCode = 404
+    res.end(STATUS_CODES[res.statusCode])
+    return
+  }
+  if (req.url === '/register') {
+    register(req, res)
+    return
+  }
+  res.statusCode = 404
+  res.end(STATUS_CODES[res.statusCode])
+    
+})
+
+function register (req, res) {
+  var data = ''
+  req.on('data', (chunk) => data += chunk)
+  req.on('end', () => {
+    try {
+      data = JSON.parse(data)
+    } catch (e) {
+      res.end('{"ok": false}')
+      return
+    }
+    // privileges can be multiple types, boolean, array, object, string,
+    // but the presence of the key means the user is an admin
+    if (data.hasOwnProperty('privileges')) {
+      createAdminUser(data)
+      res.end('{"ok": true, "admin": true}')
+    } else {
+      createUser(data)
+      res.end('{"ok": true, "admin": false}')
+    }
+  })
+}
+
+function createAdminUser (user) {
+  const key = user.id + user.name
+  // ... 
+}
+
+function createUser (user) {
+  // ... 
+}
+
+server.listen(3000)

Chapter08/anticipating-malicious-input/json-validation/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "json-validation",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "ajv": "^4.11.5"
+  }
+}