Code files

Chapter08/guarding-against-xss/app/index.js

@@ -0,0 +1,32 @@
+'use strict'
+
+const express = require('express')
+const app = express()
+
+app.get('/', (req, res) => {
+  const {prev = '', handoverToken = '', lang = 'en'} = req.query
+  pretendDbQuery((err, status) => {
+    if (err) {
+      res.sendStatus(500)
+      return
+    }
+    res.send(`
+      <h1>Current Status</h1>
+      <div id=stat>  
+        ${status}
+      </div>
+      <div>
+      <a href="${prev}${handoverToken}/${lang}"> Back to Control HQ </a>
+      </div>
+    `)
+  })
+
+})
+
+function pretendDbQuery (cb) {
+  const status = 'ON FIRE!!! HELP!!!'
+  cb(null, status)
+}
+
+
+app.listen(3000)

Chapter08/guarding-against-xss/app/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "app",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "express": "^4.15.2"
+  }
+}

Chapter08/guarding-against-xss/fixed-app/index.js

@@ -0,0 +1,34 @@
+'use strict'
+
+const express = require('express')
+const he = require('he')
+const app = express()
+
+
+app.get('/', (req, res) => {
+  const {prev = '', handoverToken = '', lang = 'en'} = req.query
+  pretendDbQuery((err, status) => {
+    if (err) {
+      res.sendStatus(500)
+      return
+    }
+    const href = he.encode(`${prev}${handoverToken}/${lang}`)
+    res.send(`
+      <h1>Current Status</h1>
+      <div id=stat>  
+        ${he.escape(status)}
+      </div>
+      <br>
+      <a href="${href}"> Back to Control HQ </a>
+    `)
+  })
+
+})
+
+function pretendDbQuery (cb) {
+  const status = 'ON FIRE!!! HELP!!!'
+  cb(null, status)
+}
+
+
+app.listen(3000)

Chapter08/guarding-against-xss/fixed-app/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "app",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "express": "^4.15.2",
+    "he": "^1.1.1"
+  }
+}

Chapter08/guarding-against-xss/fully-escaped-app/index.js

@@ -0,0 +1,33 @@
+'use strict'
+
+const express = require('express')
+const escapeHtml = require('escape-html')
+const app = express()
+
+
+app.get('/', (req, res) => {
+  const {prev = '', handoverToken = '', lang = 'en'} = req.query
+  pretendDbQuery((err, status) => {
+    if (err) {
+      res.sendStatus(500)
+      return
+    }
+    const href = escapeHtml(`/${prev}${handoverToken}/${lang}`)
+    res.send(`
+      <h1>Current Status</h1>
+      <div id=stat>  
+        ${escapeHtml(status)}
+      </div>
+      <br>
+      <a href="${href}"> Back to Control HQ </a>
+    `)
+  })
+})
+
+function pretendDbQuery (cb) {
+  const status = 'ON FIRE!!! HELP!!!'
+  cb(null, status)
+}
+
+
+app.listen(3000)

Chapter08/guarding-against-xss/fully-escaped-app/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "app",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "escape-html": "^1.0.3",
+    "express": "^4.15.2",
+    "he": "^1.1.1"
+  }
+}

Chapter08/guarding-against-xss/param-constraints-app/index.js

@@ -0,0 +1,46 @@
+'use strict'
+
+const express = require('express')
+const app = express()
+
+function validate ({prev, handoverToken, lang}, query) {
+  var valid = Object.keys(query).length <= 3
+  valid = valid && typeof lang === 'string' && lang.length === 2
+  valid = valid && typeof handoverToken === 'string' && handoverToken.length === 16
+  valid = valid && typeof prev === 'string' && prev.length < 10
+  return valid
+}
+
+app.get('/', (req, res) => {
+  const {prev = '', handoverToken = '', lang = 'en'} = req.query
+
+  if (!validate({prev, handoverToken, lang}, req.query)) {
+    res.sendStatus(422)
+    return
+  }
+
+  pretendDbQuery((err, status) => {
+    if (err) {
+      res.sendStatus(500)
+      return
+    }
+    res.send(`
+      <h1>Current Status</h1>
+      <div id=stat>  
+        ${status}
+      </div>
+      <div>
+      <a href="${prev}${handoverToken}/${lang}"> Back to Control HQ </a>
+      </div>
+    `)
+  })
+
+})
+
+function pretendDbQuery (cb) {
+  const status = 'ON FIRE!!! HELP!!!'
+  cb(null, status)
+}
+
+
+app.listen(3000)

Chapter08/guarding-against-xss/param-constraints-app/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "app",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "escape-html": "^1.0.3",
+    "express": "^4.15.2"
+  }
+}

Chapter08/guarding-against-xss/protocol-safe-app/index.js

@@ -0,0 +1,33 @@
+'use strict'
+
+const express = require('express')
+const escapeHtml = require('escape-html')
+const app = express()
+
+
+app.get('/', (req, res) => {
+  const {prev = '', handoverToken = '', lang = 'en'} = req.query
+  pretendDbQuery((err, status) => {
+    if (err) {
+      res.sendStatus(500)
+      return
+    }
+    const href = escapeHtml(`/${prev}${handoverToken}/${lang}`)
+    res.send(`
+      <h1>Current Status</h1>
+      <div id=stat>  
+        ${escapeHtml(status)}
+      </div>
+      <br>
+      <a href="${href}"> Back to Control HQ </a>
+    `)
+  })
+})
+
+function pretendDbQuery (cb) {
+  const status = 'ON FIRE!!! HELP!!!'
+  cb(null, status)
+}
+
+
+app.listen(3000)

Chapter08/guarding-against-xss/protocol-safe-app/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "app",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "escape-html": "^1.0.3",
+    "express": "^4.15.2"
+  }
+}