Sven laptop
124 lines
3.7 KiB
JavaScript
124 lines
3.7 KiB
JavaScript
const { isDisposableEmail } = require('fakeout');
|
|
|
|
const LIMITS = {
|
|
name: 100,
|
|
username: 50,
|
|
email: 254,
|
|
password: 128,
|
|
};
|
|
|
|
const MIN_PASSWORD_LENGTH = 12;
|
|
const COMMON_PASSWORDS = new Set([
|
|
'123456789', 'password', 'password123', 'qwerty',
|
|
'qwertyuiop', 'letmein', 'welcome', 'admin',
|
|
'iloveyou', 'monkey', 'dragon', 'abc123',
|
|
]);
|
|
|
|
function cleanText(value, { trim = true } = {}) {
|
|
if (typeof value !== 'string') {
|
|
return '';
|
|
}
|
|
|
|
const cleaned = value.replace(/[\u0000-\u001F\u007F]/g, '');
|
|
return trim ? cleaned.trim() : cleaned;
|
|
}
|
|
|
|
function cleanPersonInput(input) {
|
|
return {
|
|
name: cleanText(input.name),
|
|
username: cleanText(input.username),
|
|
email: cleanText(input.email).toLowerCase(),
|
|
// Password whitespace is preserved, but control characters are removed.
|
|
password: cleanText(input.password, { trim: false }),
|
|
};
|
|
}
|
|
|
|
function validateCommonFields(values, { requireName = true } = {}) {
|
|
const fields = requireName
|
|
? ['name', 'username', 'email', 'password']
|
|
: ['email', 'password'];
|
|
|
|
for (const field of fields) {
|
|
if (!values[field] || values[field].length > LIMITS[field]) {
|
|
throw new Error(`${field} must be between 1 and ${LIMITS[field]} characters`);
|
|
}
|
|
}
|
|
|
|
if (/\s/.test(values.username)) {
|
|
throw new Error('username must not contain spaces');
|
|
}
|
|
|
|
if (/\s/.test(values.email)) {
|
|
throw new Error('email must not contain spaces');
|
|
}
|
|
|
|
if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(values.email)) {
|
|
throw new Error('email must be a valid email address');
|
|
}
|
|
}
|
|
|
|
function validateRegistrationInput(values) {
|
|
validateCommonFields(values);
|
|
|
|
if (values.password.length < MIN_PASSWORD_LENGTH) {
|
|
throw new Error(`password must be at least ${MIN_PASSWORD_LENGTH} characters`);
|
|
}
|
|
|
|
const passwordLower = values.password.toLowerCase();
|
|
const normalizedPassword = passwordLower.replace(/[^a-z0-9]/g, '');
|
|
const emailLocalPart = values.email.split('@')[0];
|
|
if (
|
|
COMMON_PASSWORDS.has(normalizedPassword) ||
|
|
passwordLower.includes(values.username.toLowerCase()) ||
|
|
passwordLower.includes(emailLocalPart)
|
|
) {
|
|
throw new Error('password is too common or contains account details');
|
|
}
|
|
|
|
if (!/[a-z]/.test(values.password) || !/[A-Z]/.test(values.password)) {
|
|
throw new Error('password must contain lowercase and uppercase letters');
|
|
}
|
|
|
|
if (!/[0-9]/.test(values.password)) {
|
|
throw new Error('password must contain a number');
|
|
}
|
|
|
|
if (!/[^a-zA-Z0-9\s]/.test(values.password)) {
|
|
throw new Error('password must contain a special character');
|
|
}
|
|
|
|
if (/(.)\1\1/.test(values.password) || /(0123|1234|2345|3456|4567|5678|6789|abcd|bcde|cdef)/i.test(values.password)) {
|
|
throw new Error('password must not contain obvious repeated or sequential characters');
|
|
}
|
|
|
|
if (isDisposableEmail(values.email)) {
|
|
throw new Error('temporary email addresses are not allowed');
|
|
}
|
|
}
|
|
|
|
function sanitizePersonInput(req, res, next) {
|
|
try {
|
|
const values = cleanPersonInput(req.body || {});
|
|
validateRegistrationInput(values);
|
|
req.person = values;
|
|
next();
|
|
}
|
|
catch (err) {
|
|
res.status(400).send(err.message);
|
|
}
|
|
}
|
|
|
|
function sanitizeLoginInput(req, res, next) {
|
|
try {
|
|
const values = cleanPersonInput(req.body || {});
|
|
validateCommonFields(values, { requireName: false });
|
|
req.loginInput = { email: values.email, password: values.password };
|
|
next();
|
|
}
|
|
catch (err) {
|
|
res.status(400).send(err.message);
|
|
}
|
|
}
|
|
|
|
module.exports = { sanitizePersonInput, sanitizeLoginInput };
|