CCD-6861 Enhance and Test Payload Validation Middleware (payloadGuard)

.eslintrc.json

@@ -9,7 +9,7 @@
     "extends": "eslint:recommended",
     "parserOptions": {
         "sourceType": "module",
-        "ecmaVersion": 2017
+        "ecmaVersion": 2022
     },
     "plugins": ["mocha"],
     "rules": {

.yarnrc.yml

@@ -9,4 +9,4 @@ enableScripts: true
 
 nodeLinker: node-modules
 
-yarnPath: .yarn/releases/yarn-4.16.0.cjs
+yarnPath: .yarn/releases/yarn-4.17.0.cjs

app.js

@@ -1,27 +1,28 @@
-const enableAppInsights = require('./app/app-insights/app-insights');
+import enableAppInsights from './app/app-insights/app-insights.js';
+import payloadGuard from './app/service/service-payloadGuard.js';
+
+import express from 'express';
+import cookieParser from 'cookie-parser';
+import { legacyCreateProxyMiddleware as proxy } from 'http-proxy-middleware';
+import config from 'config';
+import loggingPkg from '@hmcts/nodejs-logging';
+const { Express: ExpressLogger, Logger } = loggingPkg;
+import {authCheckerUserOnlyFilter, mapFetchErrors} from './app/user/auth-checker-user-only-filter.js';
+import addressLookup from './app/address/address-lookup.js';
+import serviceFilter from './app/service/service-filter.js';
+import corsHandler from './app/security/cors.js';
+import handleTiming from './app/security/timing.js';
+import hstsHandler from './app/security/hsts.js';
+import healthcheck from '@hmcts/nodejs-healthcheck';
+import routes from '@hmcts/nodejs-healthcheck/healthcheck/routes.js';
+import {oauth2Route} from './app/oauth2/oauth2-route.js';
+import {logoutRoute} from './app/oauth2/logout-route.js';
+import noCache from 'nocache';
+import noSniff from 'dont-sniff-mimetype';
 
 enableAppInsights();
 
-let express = require('express');
-let cookieParser = require('cookie-parser');
-const { legacyCreateProxyMiddleware: proxy } = require('http-proxy-middleware');
-const config = require('config');
-const { Express: ExpressLogger, Logger } = require('@hmcts/nodejs-logging');
-const {authCheckerUserOnlyFilter} = require('./app/user/auth-checker-user-only-filter');
-const {mapFetchErrors} = require('./app/user/auth-checker-user-only-filter');
-const addressLookup = require('./app/address/address-lookup');
-const serviceFilter = require('./app/service/service-filter');
-const corsHandler = require('./app/security/cors');
-const handleTiming = require('./app/security/timing');
-const hstsHandler = require('./app/security/hsts');
-const healthcheck = require('@hmcts/nodejs-healthcheck');
-const routes = require('@hmcts/nodejs-healthcheck/healthcheck/routes');
-const oauth2Route = require('./app/oauth2/oauth2-route').oauth2Route;
-const logoutRoute = require('./app/oauth2/logout-route').logoutRoute;
-const noCache = require('nocache');
-const noSniff = require('dont-sniff-mimetype');
-
-let app = express();
+const app = express();
 const appHealth = express();
 const logger = Logger.getLogger('app');
 
@@ -77,6 +78,18 @@ app.get('/logout', logoutRoute);
 
 app.use(serviceFilter);
 
+// parsing + basic size limits (protects DoS)
+app.use('/data', express.json({ limit: '1mb', strict: true }));
+app.use('/data', express.urlencoded({ limit: '1mb', extended: false }));
+
+// lightweight safety/validation middleware
+app.use('/data', payloadGuard({
+  allowContentTypes: ['application/json'],
+  maxArrayLength: 10000,           // sanity cap
+  rejectPathTraversal: true,
+  rejectObviousScriptTags: true
+}));
+
 app.get('/addresses',(req, res, next) => {
   addressLookup(req.query.postcode)
       .then(result => res.send(result))
@@ -163,7 +176,7 @@ app.use(function (err, req, res, next) { // eslint-disable-line no-unused-vars
   res.locals.error = req.app.get('env') === 'development' ? err : {};
 
   // render the error page
-  let status = isNaN(err.status) ? 500 : err.status;
+  let status = Number.isNaN(err.status) ? 500 : err.status;
   res.status(status);
   res.json({
     error: err.error || 'Unauthorized',
@@ -172,4 +185,4 @@ app.use(function (err, req, res, next) { // eslint-disable-line no-unused-vars
   });
 });
 
-module.exports = app;
+export default app;

app/address/address-lookup.js

@@ -1,9 +1,10 @@
-const config = require('config');
-const fetch = require('node-fetch').default;
-const { HttpsProxyAgent } = require('https-proxy-agent');
-const { Logger } = require('@hmcts/nodejs-logging');
+import config from 'config';
+import fetch from 'node-fetch';
+import {HttpsProxyAgent} from 'https-proxy-agent';
+import {Logger} from '@hmcts/nodejs-logging';
+
 const logger = Logger.getLogger('addressLookup');
-const crypto = require('crypto');
+import crypto from 'crypto';
 
 function addressLookup(postcode) {
 
@@ -50,4 +51,4 @@ function badResponse(res, body) {
   throw errorObj(`An error response was received from the Postcode Service. Status=${res.status}, Body=${body}`, res.status);
 }
 
-module.exports = addressLookup;
+export default addressLookup;

app/app-insights/app-insights.js

@@ -1,5 +1,5 @@
-const config = require('config');
-const appInsights = require('applicationinsights');
+import config from 'config';
+import appInsights from 'applicationinsights';
 
 const enabled = config.get('appInsights.enabled');
 
@@ -26,4 +26,4 @@ const enableAppInsights = () => {
   }
 };
 
-module.exports = enableAppInsights;
+export default enableAppInsights;

app/cache/cache-config.js

@@ -1,10 +1,10 @@
-const CacheService = require('./cache-service');
-const config = require('config');
+import CacheService from './cache-service.js';
+import config from 'config';
 
 // TTL for userInfoCache should always be set to lower value than the actual token's TTL
 // to limit risk/time of an expired token still returning details - config default is 10 mins
 const userInfoCache = new CacheService('UserInfoCache', config.get('cache.user_info_ttl'), config.get('cache.user_info_check_period'));
 
-module.exports = { 
-  userInfoCache 
+export {
+  userInfoCache
 };

app/cache/cache-service.js

@@ -1,11 +1,12 @@
-const NodeCache = require('node-cache');
-const { Logger } = require('@hmcts/nodejs-logging');
+import NodeCache from 'node-cache';
+import {Logger} from '@hmcts/nodejs-logging';
+
 const logger = Logger.getLogger('CacheService');
 
 class Cache {
 
   constructor(name, ttlSeconds, checkPeriodSeconds) {
-    this.cache = new NodeCache({ stdTTL: ttlSeconds, checkperiod: checkPeriodSeconds });
+    this.cache = new NodeCache({stdTTL: ttlSeconds, checkperiod: checkPeriodSeconds});
     this.name = name;
   }
 
@@ -41,4 +42,4 @@ class Cache {
   }
 }
 
-module.exports = Cache;
+export default Cache;

app/oauth2/access-token-request.js

@@ -1,7 +1,7 @@
-const config = require('config');
-const fetch = require('node-fetch').default;
-const { URL } = require('url');
-const { Logger } = require('@hmcts/nodejs-logging');
+import config from 'config';
+import fetch from 'node-fetch';
+import {URL} from 'url';
+import {Logger} from '@hmcts/nodejs-logging';
 
 const logger = Logger.getLogger('accessTokenRequest');
 
@@ -50,4 +50,4 @@ function accessTokenRequest(request) {
       throw error;
     });
 }
-module.exports = accessTokenRequest;
+export default accessTokenRequest;

app/oauth2/logout-route.js

@@ -1,8 +1,9 @@
-const config = require('config');
-const fetch = require('node-fetch').default;
-const COOKIE_ACCESS_TOKEN = require('./oauth2-route').COOKIE_ACCESS_TOKEN;
+import config from 'config';
+import fetch from 'node-fetch';
+import {COOKIE_ACCESS_TOKEN} from './oauth2-route.js';
+
 const TOKEN_PLACEHOLDER = ':token';
-const { userInfoCache } = require('../cache/cache-config');
+import {userInfoCache} from '../cache/cache-config.js';
 
 const logoutRoute = (req, res, next) => {
   const accessToken = req.cookies && req.cookies[COOKIE_ACCESS_TOKEN];
@@ -33,6 +34,6 @@ const logoutRoute = (req, res, next) => {
   }
 };
 
-module.exports = {
+export {
   logoutRoute
 };

app/oauth2/oauth2-route.js

@@ -1,26 +1,27 @@
-const accessTokenRequest = require('./access-token-request');
-const config = require('config');
+import accessTokenRequest from './access-token-request.js';
+import config from 'config';
+
 const COOKIE_ACCESS_TOKEN = 'accessToken';
 
 const oauth2Route = (req, res, next) => {
   accessTokenRequest(req)
     .then(result => {
-      if( result.status === 200 ) {
+      if (result.status === 200) {
 
-        result.json().then ( jsonResult => {
+        result.json().then(jsonResult => {
 
-          res.cookie(COOKIE_ACCESS_TOKEN, jsonResult.access_token,
-            {
-              maxAge: jsonResult.expires_in * 1000,
-              httpOnly: true,
-              secure: config.get('security.secure_auth_cookie_enabled')
-            });
-          res.status(204).send();
+            res.cookie(COOKIE_ACCESS_TOKEN, jsonResult.access_token,
+              {
+                maxAge: jsonResult.expires_in * 1000,
+                httpOnly: true,
+                secure: config.get('security.secure_auth_cookie_enabled')
+              });
+            res.status(204).send();
           }
         );
       } else {
         next({
-          status:  502,
+          status: 502,
           message: 'Internal Server Error'
         });
       }
@@ -29,7 +30,7 @@ const oauth2Route = (req, res, next) => {
     .catch(err => next(err));
 };
 
-module.exports = {
+export {
   COOKIE_ACCESS_TOKEN,
   oauth2Route
 };

app/security/cors.js

@@ -1,5 +1,5 @@
-const config = require('config');
-const sanitize = require('../util/sanitize');
+import config from 'config';
+import {sanitizeData} from '../util/sanitize.js';
 
 const WILDCARD = '*';
 
@@ -23,7 +23,7 @@ const handleCors = (req, res, next) => {
     if (corsOptions.allowOrigin) {
         const origin = req.get('origin');
         if (corsOptions.allowOrigin(origin)) {
-            res.set('Access-Control-Allow-Origin', sanitize.sanitizeData(origin));
+            res.set('Access-Control-Allow-Origin', sanitizeData(origin));
         }
     } else {
         res.set('Access-Control-Allow-Origin', '*');
@@ -34,7 +34,7 @@ const handleCors = (req, res, next) => {
     if (corsOptions.allowMethods) {
         res.set('Access-Control-Allow-Methods', corsOptions.allowMethods);
     }
-    res.set('Access-Control-Allow-Headers', sanitize.sanitizeData(req.get('Access-Control-Request-Headers')));
+    res.set('Access-Control-Allow-Headers', sanitizeData(req.get('Access-Control-Request-Headers')));
     if('OPTIONS' === req.method) {
         res
             .status(200)
@@ -44,4 +44,4 @@ const handleCors = (req, res, next) => {
     }
 };
 
-module.exports = handleCors;
+export default handleCors;

app/security/hsts.js

@@ -3,4 +3,4 @@ const handleHSTS = (req, res, next) => {
     next();
 };
 
-module.exports = handleHSTS;
+export default handleHSTS;

app/security/timing.js

@@ -1,8 +1,8 @@
-const config = require('config');
+import config from 'config';
 
 const handleTiming = (req, res, next) => {
   res.set('Timing-Allow-Origin', config.get('security.timing-allow-origin'));
   next();
 };
 
-module.exports = handleTiming;
+export default handleTiming;

app/service/service-filter.js

@@ -1,5 +1,5 @@
-const serviceTokenGenerator = require('./service-token-generator');
-const { Logger } = require('@hmcts/nodejs-logging');
+import serviceTokenGenerator from './service-token-generator.js';
+import {Logger} from '@hmcts/nodejs-logging';
 
 const logger = Logger.getLogger('serviceFilter');
 
@@ -26,4 +26,4 @@ const serviceFilter = (req, res, next) => {
     });
 };
 
-module.exports = serviceFilter;
+export default serviceFilter;