Merge pull request #354 from bcgov/bugfix/remove-null-characters

Request Sanitizing Middleware

Author: kyle1morel

.codeclimate.yml

@@ -9,6 +9,7 @@ import { randomBytes } from 'crypto';
 
 import { version as appVersion } from './package.json';
 import { getLogger, httpLogger } from './src/components/log';
+import { requestSanitizer } from './src/middleware/requestSanitizer';
 import router from './src/routes';
 import { Problem } from './src/utils';
 import { DEFAULTCORS } from './src/utils/constants/application';
@@ -26,6 +27,7 @@ app.use(compression());
 app.use(cors(DEFAULTCORS));
 app.use(express.json({ limit: config.get('server.bodyLimit') }));
 app.use(express.urlencoded({ extended: true }));
+app.use(requestSanitizer);
 app.set('query parser', 'extended');
 
 app.use((_req, res, next) => {

app/app.ts

@@ -19,8 +19,6 @@ const controller = {
         const attachments: Array<EmailAttachment> = [];
 
         if (req.currentContext?.bearerToken) {
-          const comsObjects = await comsService.getObjects(req.currentContext?.bearerToken, req.body.selectedFileIds);
-
           // Attempt to get the requested documents from COMS
           // If succesful it is converted to base64 encoding and added to the attachment list
           const objectPromises = req.body.selectedFileIds.map(async (id) => {
@@ -30,7 +28,7 @@ const controller = {
             );
 
             if (status === 200) {
-              const filename = comsObjects.find((x: { id: string }) => x.id === id)?.name;
+              const filename = headers['x-amz-meta-name'];
               if (filename) {
                 attachments.push({
                   content: Buffer.from(data).toString('base64'),

app/src/controllers/roadmap.ts

@@ -0,0 +1,16 @@
+import type { NextFunction, Request, Response } from 'express';
+
+import { sanitize } from './utils';
+
+/**
+ * Express middleware to sanitize incoming request bodies
+ * @param req The Express request object
+ * @param _res The Express response object
+ * @param next The next middleware function
+ */
+export function requestSanitizer(req: Request, _res: Response, next: NextFunction): void {
+  if (req.body !== undefined) {
+    req.body = sanitize(req.body);
+  }
+  next();
+}

app/src/middleware/requestSanitizer.ts

@@ -0,0 +1,34 @@
+/**
+ * Removes all NUL characters from a string
+ * @param str The string to sanitize
+ * @returns The sanitized string if it includes NUL character(s), otherwise the original string
+ */
+export function stripNullCharactersFromString(str: string): string {
+  return str.replace(/\u0000/g, ''); // eslint-disable-line no-control-regex
+}
+
+/**
+ * Recursively sanitize JSON-like data (strings, arrays, plain objects)
+ * @param value The value to sanitize
+ * @returns The sanitized value if a string otherwise the original value
+ */
+export function sanitize<T>(value: T): T | string {
+  // Strip NUL characters from strings
+  if (typeof value === 'string') return stripNullCharactersFromString(value);
+
+  // Recursively sanitize arrays items
+  if (Array.isArray(value)) {
+    for (let i = 0; i < value.length; i++) {
+      value[i] = sanitize(value[i]);
+    }
+    return value;
+  }
+
+  // Recursively sanitize plain objects
+  if (value && typeof value === 'object') {
+    for (const [k, v] of Object.entries(value)) (value as Record<string, unknown>)[k] = sanitize(v);
+    return value;
+  }
+
+  return value;
+}

app/src/middleware/utils.ts

@@ -2,6 +2,7 @@ import axios from 'axios';
 import config from 'config';
 
 import { Action } from '../utils/enums/application';
+import { Problem, uuidValidateV4 } from '../utils';
 
 import type { AxiosInstance, AxiosRequestConfig } from 'axios';
 
@@ -48,31 +49,19 @@ const service = {
   },
 
   /**
-   * @function getObject
    * Get an object
-   * @param {string} bearerToken The bearer token of the authorized user
-   * @param {string} objectId The id for the object to get
+   * @param bearerToken The bearer token of the authorized user
+   * @param objectId The id for the object to get
    */
   async getObject(bearerToken: string, objectId: string) {
+    if (!uuidValidateV4(objectId)) {
+      throw new Problem(422, { detail: 'Invalid objectId parameter' });
+    }
     const { status, headers, data } = await comsAxios({
       responseType: 'arraybuffer',
       headers: { Authorization: `Bearer ${bearerToken}` }
     }).get(`/object/${objectId}`);
     return { status, headers, data };
-  },
-
-  /**
-   * @function getObjects
-   * Gets a list of objects
-   * @param {string} bearerToken The bearer token of the authorized user
-   * @param {string[]} objectIds Array of object ids to get
-   */
-  async getObjects(bearerToken: string, objectIds: Array<string>) {
-    const { data } = await comsAxios({ headers: { Authorization: `Bearer ${bearerToken}` } }).get('/object', {
-      params: { objectId: objectIds }
-    });
-
-    return data;
   }
 };
 

app/src/services/coms.ts

@@ -1,6 +1,5 @@
 export type IdpAttributes = {
-  identityKey: string;
   idp: string;
-  name: string;
+  kind: string;
   username: string;
 };

app/src/types/IdpAttributes.ts

@@ -1 +1,2 @@
 export { default as Problem } from './problem';
+export * from './utils';