FilesExpand file tree

main

/

handle-invalid-paths.js

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

65 lines (54 loc) · 2.07 KB

main

/

handle-invalid-paths.js

Copy path

Top

File metadata and controls

• Code
• Blame

65 lines (54 loc) · 2.07 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

import patterns from '../lib/patterns.js'

import statsd from '../lib/statsd.js'

const STATSD_KEY = 'middleware.handle_invalid_paths'

export default function handleInvalidPaths(req, res, next) {

// prevent open redirect vulnerability

if (req.path.match(patterns.multipleSlashes)) {

statsd.increment(STATSD_KEY, 1, ['check:multiple-slashes'])

return next(404)

}

// Prevent Express from blowing up with `URIError: Failed to decode param`

// for paths like /%7B%

try {

decodeURIComponent(req.path)

} catch (err) {

if (process.env.NODE_ENV !== 'test') {

console.error('unable to decode path', req.path, err)

}

statsd.increment(STATSD_KEY, 1, ['check:decodeURIComponent'])

return res.sendStatus(400)

}

// Prevent spammy request URLs from getting through by checking how they

// handle being normalized twice in a row

try {

const origin = 'https://docs.github.com'

const normalizedPath = new URL(req.path, origin).pathname

// This may also throw an error with code `ERR_INVALID_URL`

const reNormalizedPath = new URL(normalizedPath, origin).pathname

if (reNormalizedPath !== normalizedPath) {

throw new Error('URI keeps changing')

}

} catch (err) {

if (process.env.NODE_ENV !== 'test') {

console.error('unable to normalize path', req.path, err)

}

statsd.increment(STATSD_KEY, 1, ['check:ERR_INVALID_URL'])

return res.sendStatus(400)

}

// Prevent some script tag injection attacks

if (req.path.match(/<script/i)) {

statsd.increment(STATSD_KEY, 1, ['check:script-tag-injection'])

return res.sendStatus(400)

}

// Prevent some injection attacks targeting Fastly

if (req.path.match(/<esi:include/i)) {

statsd.increment(STATSD_KEY, 1, ['check:esi-injection-attack'])

return res.sendStatus(400)

}

// Prevent various malicious injection attacks targeting Next.js

if (req.path.match(/^\/_next[^/]/) || req.path === '/_next/data' || req.path === '/_next/data/') {

statsd.increment(STATSD_KEY, 1, ['check:nextjs-injection-attack'])

return next(404)

}

return next()

}