|
| 1 | +import { NO_FAVICON } from './consts'; |
| 2 | + |
| 3 | +/** |
| 4 | + * Security utilities for input validation and sanitization |
| 5 | + */ |
| 6 | + |
| 7 | +/** |
| 8 | + * Validates if a URL is safe for redirection |
| 9 | + * Only allows http/https protocols and optionally validates against whitelist |
| 10 | + */ |
| 11 | +export function isValidRedirectUrl(url: string): boolean { |
| 12 | + if (!url || typeof url !== 'string') { |
| 13 | + return false; |
| 14 | + } |
| 15 | + |
| 16 | + try { |
| 17 | + const urlObj = new URL(url); |
| 18 | + |
| 19 | + // Only allow http/https protocols to prevent javascript:, data:, etc. |
| 20 | + if (!['http:', 'https:'].includes(urlObj.protocol)) { |
| 21 | + return false; |
| 22 | + } |
| 23 | + |
| 24 | + // Check for dangerous schemes in the URL string (case-insensitive) |
| 25 | + const lowerUrl = url.toLowerCase(); |
| 26 | + if ( |
| 27 | + lowerUrl.includes('javascript:') || |
| 28 | + lowerUrl.includes('data:') || |
| 29 | + lowerUrl.includes('vbscript:') || |
| 30 | + lowerUrl.includes('file:') |
| 31 | + ) { |
| 32 | + return false; |
| 33 | + } |
| 34 | + |
| 35 | + return true; |
| 36 | + } catch { |
| 37 | + return false; |
| 38 | + } |
| 39 | +} |
| 40 | + |
| 41 | +/** |
| 42 | + * Sanitizes and validates favicon URLs |
| 43 | + * Returns NO_FAVICON constant for invalid URLs |
| 44 | + */ |
| 45 | +export function sanitizeFaviconUrl(favicon: string | null): string { |
| 46 | + if (!favicon || typeof favicon !== 'string') { |
| 47 | + return NO_FAVICON; |
| 48 | + } |
| 49 | + |
| 50 | + try { |
| 51 | + const url = new URL(favicon); |
| 52 | + |
| 53 | + // Only allow http/https protocols |
| 54 | + if (!['http:', 'https:'].includes(url.protocol)) { |
| 55 | + return NO_FAVICON; |
| 56 | + } |
| 57 | + |
| 58 | + // Check for dangerous schemes |
| 59 | + const lowerUrl = favicon.toLowerCase(); |
| 60 | + if ( |
| 61 | + lowerUrl.includes('javascript:') || |
| 62 | + lowerUrl.includes('data:') || |
| 63 | + lowerUrl.includes('vbscript:') |
| 64 | + ) { |
| 65 | + return NO_FAVICON; |
| 66 | + } |
| 67 | + |
| 68 | + return favicon; |
| 69 | + } catch { |
| 70 | + // Invalid URL |
| 71 | + return NO_FAVICON; |
| 72 | + } |
| 73 | +} |
| 74 | + |
| 75 | +/** |
| 76 | + * Sanitizes user input to prevent XSS and other injection attacks |
| 77 | + */ |
| 78 | +export function sanitizeUserInput(input: string): string { |
| 79 | + if (typeof input !== 'string') { |
| 80 | + return ''; |
| 81 | + } |
| 82 | + |
| 83 | + // Remove dangerous characters and scripts |
| 84 | + return input |
| 85 | + .replace(/<script[^>]*>.*?<\/script>/gi, '') // Remove script tags |
| 86 | + .replace(/javascript:/gi, '') // Remove javascript: protocol |
| 87 | + .replace(/data:/gi, '') // Remove data: protocol |
| 88 | + .replace(/vbscript:/gi, '') // Remove vbscript: protocol |
| 89 | + .replace(/on\w+\s*=/gi, '') // Remove event handlers like onclick= |
| 90 | + .replace(/<[^>]*>/g, '') // Remove all HTML tags |
| 91 | + .trim() |
| 92 | + .substring(0, 1000); // Limit length to prevent DoS |
| 93 | +} |
| 94 | + |
| 95 | +/** |
| 96 | + * Validates backup data structure to prevent code injection |
| 97 | + */ |
| 98 | +export function isValidBackupData(data: any): boolean { |
| 99 | + if (!Array.isArray(data)) { |
| 100 | + return false; |
| 101 | + } |
| 102 | + |
| 103 | + return data.every(item => { |
| 104 | + return ( |
| 105 | + typeof item === 'object' && |
| 106 | + item !== null && |
| 107 | + typeof item.url === 'string' && |
| 108 | + typeof item.summaryTime === 'number' && |
| 109 | + item.summaryTime >= 0 |
| 110 | + ); |
| 111 | + }); |
| 112 | +} |
| 113 | + |
| 114 | +/** |
| 115 | + * Sanitizes backup data to ensure safety |
| 116 | + */ |
| 117 | +export function sanitizeBackupData(data: any[]): any[] { |
| 118 | + return data.map(item => ({ |
| 119 | + url: sanitizeUserInput(item.url || ''), |
| 120 | + summaryTime: Math.max(0, Math.floor(Number(item.summaryTime) || 0)), |
| 121 | + counter: Math.max(0, Math.floor(Number(item.counter) || 0)), |
| 122 | + favicon: sanitizeFaviconUrl(item.favicon), |
| 123 | + days: Array.isArray(item.days) ? item.days.map(sanitizeDayData) : [], |
| 124 | + })); |
| 125 | +} |
| 126 | + |
| 127 | +/** |
| 128 | + * Sanitizes day data within backup |
| 129 | + */ |
| 130 | +function sanitizeDayData(day: any): any { |
| 131 | + return { |
| 132 | + date: sanitizeUserInput(day.date || ''), |
| 133 | + summary: Math.max(0, Math.floor(Number(day.summary) || 0)), |
| 134 | + counter: Math.max(0, Math.floor(Number(day.counter) || 0)), |
| 135 | + }; |
| 136 | +} |
| 137 | + |
| 138 | +/** |
| 139 | + * Validates that a message has the expected structure |
| 140 | + */ |
| 141 | +export function isValidMessage(message: any): boolean { |
| 142 | + return ( |
| 143 | + message && |
| 144 | + (typeof message === 'string' || |
| 145 | + (typeof message === 'object' && (message.type || message.message))) |
| 146 | + ); |
| 147 | +} |
0 commit comments