check-referrer/index.js at master · therobwatson/check-referrer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
module.exports = function(_rules, _redirect) {
  var rules;
  var blacklist = [];
  var whitelist = [];

  function parseRules(_rules) {
    var rules = _rules.split(',');

    if (_rules.search(/\+/) === -1 && _rules.search('-*,') === -1) {
      blacklist.push(/.*/);
    }

    rules.forEach(function(rule){
      if (rule.search(/\-/) === 0) {
        whitelist.push(new RegExp(rule.replace('-', '')));
      } else if (rule.search(/\+/) === 0) {
        blacklist.push(new RegExp(rule.replace('+', '')));
      }
    });
  }

  function redirect(res) {
    if (!_redirect) {
      return false;
    }

    return res.redirect(_redirect);
  }

  function checkReferrer(req, res, next){
    var referrer;
    var blacklisted;
    var whitelisted;

    if (req.path === _redirect) {
      return next();
    }

    referrer = req.header('Referrer');

    if (!referrer) {
      return redirect(res) || next();
    }

    whitelisted = whitelist.some(function(pattern){
      return pattern.test(referrer);
    });

    if (whitelisted) {
      req.fromAllowedReferrer = true;
      return next();
    }

    blacklisted = blacklist.some(function(pattern){
      return pattern.test(referrer);
    });

    if (blacklisted) {
      return redirect(res) || next();
    }

    next();
  }

  parseRules(_rules);
  return checkReferrer;
}