chore: sonar issues

Author: usingtechnology

app/src/forms/file/middleware/upload.js

@@ -74,21 +74,21 @@ const sanitizeFilename = (filename) => {
 };
 
 const fileSetup = (options) => {
-  fileUploadsDir = (options && options.dir) || process.env.FILE_UPLOADS_DIR || defaultUploadsDir();
+  fileUploadsDir = options?.dir || process.env.FILE_UPLOADS_DIR || defaultUploadsDir();
   try {
     fs.ensureDirSync(fileUploadsDir);
   } catch (error) {
     log.error(`Error creating file uploads directory '${fileUploadsDir}':`, error);
     throw new Error(`Could not create file uploads directory '${fileUploadsDir}'.`);
   }
 
-  maxFileSize = (options && options.maxFileSize) || process.env.FILE_UPLOADS_MAX_FILE_SIZE || '25MB';
+  maxFileSize = options?.maxFileSize || process.env.FILE_UPLOADS_MAX_FILE_SIZE || '25MB';
   maxFileSize = bytes.parse(maxFileSize);
   if (maxFileSize === null) {
     throw new Error('Could not determine max file size (bytes) for file uploads.');
   }
 
-  maxFileCount = (options && options.maxFileCount) || process.env.FILE_UPLOADS_MAX_FILE_COUNT || '1';
+  maxFileCount = options?.maxFileCount || process.env.FILE_UPLOADS_MAX_FILE_COUNT || '1';
   maxFileCount = parseInt(maxFileCount);
   if (isNaN(maxFileCount)) {
     maxFileCount = 1;
@@ -101,7 +101,7 @@ const fileUpload = {
   init(options) {
     let { fileUploadsDir, maxFileSize, maxFileCount } = fileSetup(options);
 
-    const formFieldName = (options && options.fieldName) || process.env.FILE_UPLOADS_FIELD_NAME || 'files';
+    const formFieldName = options?.fieldName || process.env.FILE_UPLOADS_FIELD_NAME || 'files';
 
     storage = multer.diskStorage({
       destination: function (_req, _file, callback) {

app/src/forms/file/middleware/virusScan.js

@@ -4,6 +4,14 @@ const log = require('../../../components/log')(module.filename);
 const { fileUpload } = require('./upload');
 const uploadCleanup = require('../uploadCleanup');
 
+/**
+ * Neutralizes user-controlled text before it is written to a log line by
+ * stripping control characters (CR/LF/etc.), preventing log injection/forging.
+ * @param {*} value - The value to sanitize (e.g. an uploaded file name).
+ * @returns {string} - The value with control characters replaced by spaces.
+ */
+const sanitizeForLog = (value) => String(value ?? '').replace(/\p{Cc}/gu, ' ');
+
 /**
  * Validates that a file path is within a specified base directory.
  * @param {string} filePath - The file path to validate.
@@ -52,7 +60,7 @@ const scanFile = async (req, res, next) => {
   try {
     const scanResult = await clamAvScanner.scanFile(filePath);
 
-    log.info(`${fileName} scanned. Is infected? ${scanResult.isInfected}. Viruses: ${scanResult.viruses || 'None'}`);
+    log.info(`${sanitizeForLog(fileName)} scanned. Is infected? ${scanResult.isInfected}. Viruses: ${scanResult.viruses || 'None'}`);
 
     if (scanResult.isInfected) {
       await removeInfected(filePath);
@@ -61,7 +69,7 @@ const scanFile = async (req, res, next) => {
 
     next();
   } catch (error) {
-    log.error(`Error scanning file: ${fileName || 'unknown'}. ${error.message}`);
+    log.error(`Error scanning file: ${sanitizeForLog(fileName) || 'unknown'}. ${error.message}`);
     await uploadCleanup.removeUploadedFile(filePath, 'scan-error');
     next(error);
   }

app/src/forms/file/uploadCleanup.js

@@ -186,9 +186,9 @@ const startUploadCleanupScheduler = (options = {}) => {
     return;
   }
 
-  const staleAgeMinutes = parseInt(options.staleAgeMinutes, 10) || 1440;
-  const intervalMinutes = parseInt(options.intervalMinutes, 10) || 60;
-  const batchSize = parseInt(options.batchSize, 10) || 100;
+  const staleAgeMinutes = Number.parseInt(options.staleAgeMinutes, 10) || 1440;
+  const intervalMinutes = Number.parseInt(options.intervalMinutes, 10) || 60;
+  const batchSize = Number.parseInt(options.batchSize, 10) || 100;
 
   const runSweep = async () => {
     try {