Leahnaya/miiverse-api
1
0
Fork 0
mirror of https://github.com/PretendoNetwork/miiverse-api.git synced 2026-07-19 00:56:27 -05:00
Code Issues Actions Packages Projects Releases Wiki Activity

chore: reject bad post bodies rather than modify

Browse Source
This commit is contained in:
Jonathan Barrow 2024-02-12 16:32:36 -05:00
parent 69ada7ff1a
commit d91540fdae
No known key found for this signature in database
GPG Key ID: E86E9FE9049C741F
4 changed files with 37 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/models/post.ts
View File

@ -1,6 +1,7 @@
import crypto from 'node:crypto';
import moment from 'moment';
import { Schema, model } from 'mongoose';
import { INVALID_POST_BODY_REGEX } from '@/util';
import { HydratedPostDocument, IPost, IPostMethods, PostModel } from '@/types/mongoose/post';
import { HydratedCommunityDocument } from '@/types/mongoose/community';
import { PostToJSONOptions } from '@/types/mongoose/post-to-json-options';
@ -107,7 +108,7 @@ PostSchema.method<HydratedPostDocument>('generatePostUID', async function genera
});
PostSchema.method<HydratedPostDocument>('cleanedBody', function cleanedBody(): string {
return this.body ? this.body.replace(/[^\p{L}\p{P}\d\n\r~$^¨←→↑↓√¦⇒⇔¤¢€£¥™©®+×÷=±∞˘˙¸˛˜°¹²³♭♪¬¯¼½¾♡♥●◆■▲▼☆★♀♂<>]/gu, '').replace(/[\n\r]+/gm, '') : '';
return this.body ? this.body.replace(INVALID_POST_BODY_REGEX, '').replace(/[\n\r]+/gm, '') : '';
});
PostSchema.method<HydratedPostDocument>('cleanedMiiData', function cleanedMiiData(): string {

23
src/services/api/routes/friend_messages.ts
View File

@ -5,7 +5,14 @@ import moment from 'moment';
import xmlbuilder from 'xmlbuilder';
import { z } from 'zod';
import { GetUserDataResponse } from '@pretendonetwork/grpc/account/get_user_data_rpc';
import { getUserFriendPIDs, getUserAccountData, processPainting, uploadCDNAsset, getValueFromQueryString } from '@/util';
import {
getUserFriendPIDs,
getUserAccountData,
processPainting,
uploadCDNAsset,
getValueFromQueryString,
INVALID_POST_BODY_REGEX
} from '@/util';
import { getConversationByUsers, getUserSettings, getFriendMessages } from '@/database';
import { LOG_WARN } from '@/logger';
import { Post } from '@/models/post';
@ -39,7 +46,7 @@ router.post('/', upload.none(), async function (request: express.Request, respon
}
const recipientPID = bodyCheck.data.message_to_pid;
let messageBody = bodyCheck.data.body || '';
const messageBody = bodyCheck.data.body?.trim() || '';
const painting = bodyCheck.data.painting?.replace(/\0/g, '').trim() || '';
const screenshot = bodyCheck.data.screenshot?.trim().replace(/\0/g, '').trim() || '';
const appData = bodyCheck.data.app_data?.replace(/[^A-Za-z0-9+/=\s]/g, '').trim() || '';
@ -150,12 +157,16 @@ router.post('/', upload.none(), async function (request: express.Request, respon
break;
}
if (messageBody) {
messageBody = messageBody.replace(/[^\p{L}\p{P}\d\n\r~$^¨←→↑↓√¦⇒⇔¤¢€£¥™©®+×÷=±∞˘˙¸˛˜°¹²³♭♪¬¯¼½¾♡♥●◆■▲▼☆★♀♂<>]/gu, '');
if (messageBody && INVALID_POST_BODY_REGEX.test(messageBody)) {
// TODO - Log this error
response.sendStatus(400);
return;
}
if (messageBody.length > 280) {
messageBody = messageBody.substring(0, 280);
if (messageBody && messageBody.length > 280) {
// TODO - Log this error
response.sendStatus(400);
return;
}
if (messageBody === '' && painting === '' && screenshot === '') {

20
src/services/api/routes/posts.ts
View File

@ -3,7 +3,13 @@ import multer from 'multer';
import xmlbuilder from 'xmlbuilder';
import { z } from 'zod';
import { GetUserDataResponse } from '@pretendonetwork/grpc/account/get_user_data_rpc';
import { getUserAccountData, processPainting, uploadCDNAsset, getValueFromQueryString } from '@/util';
import {
getUserAccountData,
processPainting,
uploadCDNAsset,
getValueFromQueryString,
INVALID_POST_BODY_REGEX
} from '@/util';
import {
getPostByID,
getUserContent,
@ -235,7 +241,7 @@ async function newPost(request: express.Request, response: express.Response): Pr
}
const communityID = bodyCheck.data.community_id || '';
let messageBody = bodyCheck.data.body;
const messageBody = bodyCheck.data.body?.trim();
const painting = bodyCheck.data.painting?.replace(/\0/g, '').trim() || '';
const screenshot = bodyCheck.data.screenshot?.replace(/\0/g, '').trim() || '';
const appData = bodyCheck.data.app_data?.replace(/[^A-Za-z0-9+/=\s]/g, '').trim() || '';
@ -317,12 +323,16 @@ async function newPost(request: express.Request, response: express.Response): Pr
break;
}
if (messageBody) {
messageBody = messageBody.replace(/[^\p{L}\p{P}\d\n\r~$^¨←→↑↓√¦⇒⇔¤¢€£¥™©®+×÷=±∞˘˙¸˛˜°¹²³♭♪¬¯¼½¾♡♥●◆■▲▼☆★♀♂<>]/gu, '');
if (messageBody && INVALID_POST_BODY_REGEX.test(messageBody)) {
// TODO - Log this error
response.sendStatus(400);
return;
}
if (messageBody && messageBody.length > 280) {
messageBody = messageBody.substring(0, 280);
// TODO - Log this error
response.sendStatus(400);
return;
}
if ((!messageBody || messageBody === '') && painting === '' && screenshot === '') {

3
src/util.ts
View File

@ -31,6 +31,9 @@ const s3 = new aws.S3({
secretAccessKey: config.s3.secret
});
// TODO - This doesn't really belong here
export const INVALID_POST_BODY_REGEX = /[^\p{L}\p{P}\d\n\r$^¨←→↑↓√¦⇒⇔¤¢€£¥™©®+×÷=±∞˘˙¸˛˜°¹²³♭♪¬¯¼½¾♡♥●◆■▲▼☆★♀♂<> ]/gu;
export function decodeParamPack(paramPack: string): ParamPack {
const values = Buffer.from(paramPack, 'base64').toString().split('\\');
const entries = values.filter(value => value).reduce((entries: string[][], value: string, index: number) => {