diff options
Diffstat (limited to 'node_modules/csurf')
| -rw-r--r-- | node_modules/csurf/HISTORY.md | 158 | ||||
| -rw-r--r-- | node_modules/csurf/LICENSE | 23 | ||||
| -rw-r--r-- | node_modules/csurf/README.md | 238 | ||||
| -rw-r--r-- | node_modules/csurf/index.js | 306 | ||||
| -rw-r--r-- | node_modules/csurf/package.json | 135 |
5 files changed, 860 insertions, 0 deletions
diff --git a/node_modules/csurf/HISTORY.md b/node_modules/csurf/HISTORY.md new file mode 100644 index 0000000..06019ed --- /dev/null +++ b/node_modules/csurf/HISTORY.md @@ -0,0 +1,158 @@ +1.9.0 / 2016-05-27 +================== + + * Pass invalid csrf token error to `next()` instead of throwing + * Pass misconfigured error to `next()` instead of throwing + * Provide misconfigured error when using cookies without cookie-parser + * deps: cookie@0.3.1 + - Add `sameSite` option + - Fix cookie `Max-Age` to never be a floating point number + - Improve error message when `expires` is not a `Date` + - Throw better error for invalid argument to parse + - Throw on invalid values provided to `serialize` + - perf: enable strict mode + - perf: hoist regular expression + - perf: use for loop in parse + - perf: use string concatination for serialization + * deps: csrf@~3.0.3 + - Use `tsscmp` module for timing-safe token verification + - deps: base64-url@1.2.2 + - deps: rndm@1.2.0 + - deps: uid-safe@2.1.1 + * deps: http-errors@~1.5.0 + - Add `HttpError` export, for `err instanceof createError.HttpError` + - Support new code `421 Misdirected Request` + - Use `setprototypeof` module to replace `__proto__` setting + - deps: inherits@2.0.1 + - deps: statuses@'>= 1.3.0 < 2' + - perf: enable strict mode + * perf: enable strict mode + * perf: remove argument reassignment + +1.8.3 / 2015-06-10 +================== + + * deps: cookie@0.1.3 + - Slight optimizations + +1.8.2 / 2015-05-09 +================== + + * deps: csrf@~3.0.0 + - deps: uid-safe@~2.0.0 + +1.8.1 / 2015-05-03 +================== + + * deps: csrf@~2.0.7 + - Fix compatibility with `crypto.DEFAULT_ENCODING` global changes + +1.8.0 / 2015-04-07 +================== + + * Add `sessionKey` option + +1.7.0 / 2015-02-15 +================== + + * Accept `CSRF-Token` and `XSRF-Token` request headers + * Default `cookie.path` to `'/'`, if using cookies + * deps: cookie-signature@1.0.6 + * deps: csrf@~2.0.6 + - deps: base64-url@1.2.1 + - deps: uid-safe@~1.1.0 + * deps: http-errors@~1.3.1 + - Construct errors using defined constructors from `createError` + - Fix error names that are not identifiers + - Set a meaningful `name` property on constructed errors + +1.6.6 / 2015-01-31 +================== + + * deps: csrf@~2.0.5 + - deps: base64-url@1.2.0 + - deps: uid-safe@~1.0.3 + +1.6.5 / 2015-01-08 +================== + + * deps: csrf@~2.0.4 + - deps: uid-safe@~1.0.2 + +1.6.4 / 2014-12-30 +================== + + * deps: csrf@~2.0.3 + - Slight speed improvement for `verify` + - deps: base64-url@1.1.0 + - deps: rndm@~1.1.0 + * deps: http-errors@~1.2.8 + - Fix stack trace from exported function + +1.6.3 / 2014-11-09 +================== + + * deps: csrf@~2.0.2 + - deps: scmp@1.0.0 + * deps: http-errors@~1.2.7 + - Remove duplicate line + +1.6.2 / 2014-10-14 +================== + + * Fix cookie name when using `cookie: true` + * deps: http-errors@~1.2.6 + - Fix `expose` to be `true` for `ClientError` constructor + - Use `inherits` instead of `util` + - deps: statuses@1 + +1.6.1 / 2014-09-05 +================== + + * deps: cookie-signature@1.0.5 + +1.6.0 / 2014-09-03 +================== + + * Set `code` property on CSRF token errors + +1.5.0 / 2014-08-24 +================== + + * Add `ignoreMethods` option + +1.4.1 / 2014-08-22 +================== + + * Use `csrf-tokens` instead of `csrf` + +1.4.0 / 2014-07-30 +================== + + * Support changing `req.session` after `csurf` middleware + - Calling `res.csrfToken()` after `req.session.destroy()` will now work + +1.3.0 / 2014-07-03 +================== + + * Add support for environments without `res.cookie` (connect@3) + +1.2.2 / 2014-06-18 +================== + + * deps: csrf-tokens@~2.0.0 + +1.2.1 / 2014-06-09 +================== + + * Refactor to use `csrf-tokens` module + +1.2.0 / 2014-05-13 +================== + + * Add support for double-submit cookie + +1.1.0 / 2014-04-06 +================== + + * Add constant-time string compare diff --git a/node_modules/csurf/LICENSE b/node_modules/csurf/LICENSE new file mode 100644 index 0000000..4abfea8 --- /dev/null +++ b/node_modules/csurf/LICENSE @@ -0,0 +1,23 @@ +(The MIT License) + +Copyright (c) 2014 Jonathan Ong <me@jongleberry.com> +Copyright (c) 2014-2016 Douglas Christopher Wilson <doug@somethingdoug.com> + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +'Software'), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, +TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE +SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/node_modules/csurf/README.md b/node_modules/csurf/README.md new file mode 100644 index 0000000..dc88802 --- /dev/null +++ b/node_modules/csurf/README.md @@ -0,0 +1,238 @@ +# csurf + +[![NPM Version][npm-image]][npm-url] +[![NPM Downloads][downloads-image]][downloads-url] +[![Build status][travis-image]][travis-url] +[![Test coverage][coveralls-image]][coveralls-url] +[![Gratipay][gratipay-image]][gratipay-url] + +Node.js [CSRF](https://en.wikipedia.org/wiki/Cross-site_request_forgery) protection middleware. + +Requires either a session middleware or [cookie-parser](https://www.npmjs.com/package/cookie-parser) to be initialized first. + + * If you are setting the ["cookie" option](#cookie) to a non-`false` value, + then you must use [cookie-parser](https://www.npmjs.com/package/cookie-parser) + before this module. + * Otherwise, you must use a session middleware before this module. For example: + - [express-session](https://www.npmjs.com/package/express-session) + - [cookie-session](https://www.npmjs.com/package/cookie-session) + +If you have questions on how this module is implemented, please read +[Understanding CSRF](https://github.com/pillarjs/understanding-csrf). + +## Installation + +```sh +$ npm install csurf +``` + +## API + +```js +var csurf = require('csurf') +``` + +### csurf([options]) + +Create a middleware for CSRF token creation and validation. This middleware +adds a `req.csrfToken()` function to make a token which should be added to +requests which mutate state, within a hidden form field, query-string etc. +This token is validated against the visitor's session or csrf cookie. + +#### Options + +The `csurf` function takes an optional `options` object that may contain +any of the following keys: + +##### cookie + +Determines if the token secret for the user should be stored in a cookie +or in `req.session`. Defaults to `false`. + +When set to `true` (or an object of options for the cookie), then the module +changes behavior and no longer uses `req.session`. This means you _are no +longer required to use a session middleware_. Instead, you do need to use the +[cookie-parser](https://www.npmjs.com/package/cookie-parser) middleware in +your app before this middleware. + +When set to an object, cookie storage of the secret is enabled and the +object contains options for this functionality (when set to `true`, the +defaults for the options are used). The options may contain any of the +following keys: + + - `key` - the name of the cookie to use to store the token secret + (defaults to `'_csrf'`). + - `path` - the path of the cookie (defaults to `'/'`). + - any other [res.cookie](http://expressjs.com/4x/api.html#res.cookie) + option can be set. + +##### ignoreMethods + +An array of the methods for which CSRF token checking will disabled. +Defaults to `['GET', 'HEAD', 'OPTIONS']`. + +##### sessionKey + +Determines what property ("key") on `req` the session object is located. +Defaults to `'session'` (i.e. looks at `req.session`). The CSRF secret +from this library is stored and read as `req[sessionKey].csrfSecret`. + +If the ["cookie" option](#cookie) is not `false`, then this option does +nothing. + +##### value + +Provide a function that the middleware will invoke to read the token from +the request for validation. The function is called as `value(req)` and is +expected to return the token as a string. + +The default value is a function that reads the token from the following +locations, in order: + + - `req.body._csrf` - typically generated by the `body-parser` module. + - `req.query._csrf` - a built-in from Express.js to read from the URL + query string. + - `req.headers['csrf-token']` - the `CSRF-Token` HTTP request header. + - `req.headers['xsrf-token']` - the `XSRF-Token` HTTP request header. + - `req.headers['x-csrf-token']` - the `X-CSRF-Token` HTTP request header. + - `req.headers['x-xsrf-token']` - the `X-XSRF-Token` HTTP request header. + +## Example + +### Simple express example + +The following is an example of some server-side code that generates a form +that requires a CSRF token to post back. + +```js +var cookieParser = require('cookie-parser') +var csrf = require('csurf') +var bodyParser = require('body-parser') +var express = require('express') + +// setup route middlewares +var csrfProtection = csrf({ cookie: true }) +var parseForm = bodyParser.urlencoded({ extended: false }) + +// create express app +var app = express() + +// parse cookies +// we need this because "cookie" is true in csrfProtection +app.use(cookieParser()) + +app.get('/form', csrfProtection, function(req, res) { + // pass the csrfToken to the view + res.render('send', { csrfToken: req.csrfToken() }) +}) + +app.post('/process', parseForm, csrfProtection, function(req, res) { + res.send('data is being processed') +}) +``` + +Inside the view (depending on your template language; handlebars-style +is demonstrated here), set the `csrfToken` value as the value of a hidden +input field named `_csrf`: + +```html +<form action="/process" method="POST"> + <input type="hidden" name="_csrf" value="{{csrfToken}}"> + + Favorite color: <input type="text" name="favoriteColor"> + <button type="submit">Submit</button> +</form> +``` + +### Ignoring Routes + +**Note** CSRF checks should only be disabled for requests that you expect to +come from outside of your website. Do not disable CSRF checks for requests +that you expect to only come from your website. An existing session, even if +it belongs to an authenticated user, is not enough to protect against CSRF +attacks. + +The following is an example of how to order your routes so that certain endpoints +do not check for a valid CSRF token. + +```js +var cookieParser = require('cookie-parser') +var csrf = require('csurf') +var bodyParser = require('body-parser') +var express = require('express') + +// create express app +var app = express() + +// create api router +var api = createApiRouter() + +// mount api before csrf is appended to the app stack +app.use('/api', api) + +// now add csrf and other middlewares, after the "/api" was mounted +app.use(bodyParser.urlencoded({ extended: false })) +app.use(cookieParser()) +app.use(csrf({ cookie: true })) + +app.get('/form', function(req, res) { + // pass the csrfToken to the view + res.render('send', { csrfToken: req.csrfToken() }) +}) + +app.post('/process', function(req, res) { + res.send('csrf was required to get here') +}) + +function createApiRouter() { + var router = new express.Router() + + router.post('/getProfile', function(req, res) { + res.send('no csrf to get here') + }) + + return router +} +``` + +### Custom error handling + +When the CSRF token validation fails, an error is thrown that has +`err.code === 'EBADCSRFTOKEN'`. This can be used to display custom +error messages. + +```js +var bodyParser = require('body-parser') +var cookieParser = require('cookie-parser') +var csrf = require('csurf') +var express = require('express') + +var app = express() +app.use(bodyParser.urlencoded({ extended: false })) +app.use(cookieParser()) +app.use(csrf({ cookie: true })) + +// error handler +app.use(function (err, req, res, next) { + if (err.code !== 'EBADCSRFTOKEN') return next(err) + + // handle CSRF token errors here + res.status(403) + res.send('form tampered with') +}) +``` + +## License + +[MIT](LICENSE) + +[npm-image]: https://img.shields.io/npm/v/csurf.svg +[npm-url]: https://npmjs.org/package/csurf +[travis-image]: https://img.shields.io/travis/expressjs/csurf/master.svg +[travis-url]: https://travis-ci.org/expressjs/csurf +[coveralls-image]: https://img.shields.io/coveralls/expressjs/csurf/master.svg +[coveralls-url]: https://coveralls.io/r/expressjs/csurf?branch=master +[downloads-image]: https://img.shields.io/npm/dm/csurf.svg +[downloads-url]: https://npmjs.org/package/csurf +[gratipay-image]: https://img.shields.io/gratipay/dougwilson.svg +[gratipay-url]: https://gratipay.com/dougwilson/ diff --git a/node_modules/csurf/index.js b/node_modules/csurf/index.js new file mode 100644 index 0000000..9b8c19e --- /dev/null +++ b/node_modules/csurf/index.js @@ -0,0 +1,306 @@ +/*! + * csurf + * Copyright(c) 2011 Sencha Inc. + * Copyright(c) 2014 Jonathan Ong + * Copyright(c) 2014-2016 Douglas Christopher Wilson + * MIT Licensed + */ + +'use strict' + +/** + * Module dependencies. + * @private + */ + +var Cookie = require('cookie') +var createError = require('http-errors') +var sign = require('cookie-signature').sign +var Tokens = require('csrf') + +/** + * Module exports. + * @public + */ + +module.exports = csurf + +/** + * CSRF protection middleware. + * + * This middleware adds a `req.csrfToken()` function to make a token + * which should be added to requests which mutate + * state, within a hidden form field, query-string etc. This + * token is validated against the visitor's session. + * + * @param {Object} options + * @return {Function} middleware + * @public + */ + +function csurf (options) { + var opts = options || {} + + // get cookie options + var cookie = getCookieOptions(opts.cookie) + + // get session options + var sessionKey = opts.sessionKey || 'session' + + // get value getter + var value = opts.value || defaultValue + + // token repo + var tokens = new Tokens(opts) + + // ignored methods + var ignoreMethods = opts.ignoreMethods === undefined + ? ['GET', 'HEAD', 'OPTIONS'] + : opts.ignoreMethods + + if (!Array.isArray(ignoreMethods)) { + throw new TypeError('option ignoreMethods must be an array') + } + + // generate lookup + var ignoreMethod = getIgnoredMethods(ignoreMethods) + + return function csrf (req, res, next) { + // validate the configuration against request + if (!verifyConfiguration(req, sessionKey, cookie)) { + return next(new Error('misconfigured csrf')) + } + + // get the secret from the request + var secret = getSecret(req, sessionKey, cookie) + var token + + // lazy-load token getter + req.csrfToken = function csrfToken () { + var sec = !cookie + ? getSecret(req, sessionKey, cookie) + : secret + + // use cached token if secret has not changed + if (token && sec === secret) { + return token + } + + // generate & set new secret + if (sec === undefined) { + sec = tokens.secretSync() + setSecret(req, res, sessionKey, sec, cookie) + } + + // update changed secret + secret = sec + + // create new token + token = tokens.create(secret) + + return token + } + + // generate & set secret + if (!secret) { + secret = tokens.secretSync() + setSecret(req, res, sessionKey, secret, cookie) + } + + // verify the incoming token + if (!ignoreMethod[req.method] && !tokens.verify(secret, value(req))) { + return next(createError(403, 'invalid csrf token', { + code: 'EBADCSRFTOKEN' + })) + } + + next() + } +} + +/** + * Default value function, checking the `req.body` + * and `req.query` for the CSRF token. + * + * @param {IncomingMessage} req + * @return {String} + * @api private + */ + +function defaultValue (req) { + return (req.body && req.body._csrf) || + (req.query && req.query._csrf) || + (req.headers['csrf-token']) || + (req.headers['xsrf-token']) || + (req.headers['x-csrf-token']) || + (req.headers['x-xsrf-token']) +} + +/** + * Get options for cookie. + * + * @param {boolean|object} [options] + * @returns {object} + * @api private + */ + +function getCookieOptions (options) { + if (options !== true && typeof options !== 'object') { + return undefined + } + + var opts = { + key: '_csrf', + path: '/' + } + + if (options && typeof options === 'object') { + for (var prop in options) { + var val = options[prop] + + if (val !== undefined) { + opts[prop] = val + } + } + } + + return opts +} + +/** + * Get a lookup of ignored methods. + * + * @param {array} methods + * @returns {object} + * @api private + */ + +function getIgnoredMethods (methods) { + var obj = Object.create(null) + + for (var i = 0; i < methods.length; i++) { + var method = methods[i].toUpperCase() + obj[method] = true + } + + return obj +} + +/** + * Get the token secret from the request. + * + * @param {IncomingMessage} req + * @param {String} sessionKey + * @param {Object} [cookie] + * @api private + */ + +function getSecret (req, sessionKey, cookie) { + // get the bag & key + var bag = getSecretBag(req, sessionKey, cookie) + var key = cookie ? cookie.key : 'csrfSecret' + + if (!bag) { + /* istanbul ignore next: should never actually run */ + throw new Error('misconfigured csrf') + } + + // return secret from bag + return bag[key] +} + +/** + * Get the token secret bag from the request. + * + * @param {IncomingMessage} req + * @param {String} sessionKey + * @param {Object} [cookie] + * @api private + */ + +function getSecretBag (req, sessionKey, cookie) { + if (cookie) { + // get secret from cookie + var cookieKey = cookie.signed + ? 'signedCookies' + : 'cookies' + + return req[cookieKey] + } else { + // get secret from session + return req[sessionKey] + } +} + +/** + * Set a cookie on the HTTP response. + * + * @param {OutgoingMessage} res + * @param {string} name + * @param {string} val + * @param {Object} [options] + * @api private + */ + +function setCookie (res, name, val, options) { + var data = Cookie.serialize(name, val, options) + + var prev = res.getHeader('set-cookie') || [] + var header = Array.isArray(prev) ? prev.concat(data) + : Array.isArray(data) ? [prev].concat(data) + : [prev, data] + + res.setHeader('set-cookie', header) +} + +/** + * Set the token secret on the request. + * + * @param {IncomingMessage} req + * @param {OutgoingMessage} res + * @param {string} sessionKey + * @param {string} val + * @param {Object} [cookie] + * @api private + */ + +function setSecret (req, res, sessionKey, val, cookie) { + if (cookie) { + // set secret on cookie + if (cookie.signed) { + var secret = req.secret + + if (!secret) { + /* istanbul ignore next: should never actually run */ + throw new Error('misconfigured csrf') + } + + val = 's:' + sign(val, secret) + } + + setCookie(res, cookie.key, val, cookie) + } else if (req[sessionKey]) { + // set secret on session + req[sessionKey].csrfSecret = val + } else { + /* istanbul ignore next: should never actually run */ + throw new Error('misconfigured csrf') + } +} + +/** + * Verify the configuration against the request. + * @private + */ + +function verifyConfiguration (req, sessionKey, cookie) { + if (!getSecretBag(req, sessionKey, cookie)) { + return false + } + + if (cookie && cookie.signed && !req.secret) { + return false + } + + return true +} diff --git a/node_modules/csurf/package.json b/node_modules/csurf/package.json new file mode 100644 index 0000000..073330b --- /dev/null +++ b/node_modules/csurf/package.json @@ -0,0 +1,135 @@ +{ + "_args": [ + [ + "csurf", + "/home/humair/School/csc309/a4/solutions_repo" + ] + ], + "_from": "csurf@latest", + "_id": "csurf@1.9.0", + "_inCache": true, + "_installable": true, + "_location": "/csurf", + "_npmOperationalInternal": { + "host": "packages-12-west.internal.npmjs.com", + "tmp": "tmp/csurf-1.9.0.tgz_1464369669689_0.553399148164317" + }, + "_npmUser": { + "email": "doug@somethingdoug.com", + "name": "dougwilson" + }, + "_npmVersion": "1.4.28", + "_phantomChildren": {}, + "_requested": { + "name": "csurf", + "raw": "csurf", + "rawSpec": "", + "scope": null, + "spec": "latest", + "type": "tag" + }, + "_requiredBy": [ + "/" + ], + "_resolved": "https://registry.npmjs.org/csurf/-/csurf-1.9.0.tgz", + "_shasum": "49d2c6925ffcec7b7de559597c153fa533364133", + "_shrinkwrap": null, + "_spec": "csurf", + "_where": "/home/humair/School/csc309/a4/solutions_repo", + "author": { + "email": "me@jongleberry.com", + "name": "Jonathan Ong", + "url": "http://jongleberry.com" + }, + "bugs": { + "url": "https://github.com/expressjs/csurf/issues" + }, + "contributors": [ + { + "name": "Douglas Christopher Wilson", + "email": "doug@somethingdoug.com" + } + ], + "dependencies": { + "cookie": "0.3.1", + "cookie-signature": "1.0.6", + "csrf": "~3.0.3", + "http-errors": "~1.5.0" + }, + "description": "CSRF token middleware", + "devDependencies": { + "body-parser": "1.15.1", + "connect": "3.4.1", + "cookie-parser": "1.4.3", + "cookie-session": "~1.1.0", + "eslint": "2.10.2", + "eslint-config-standard": "5.3.1", + "eslint-plugin-promise": "1.3.1", + "eslint-plugin-standard": "1.3.2", + "istanbul": "0.4.3", + "mocha": "2.5.3", + "supertest": "1.1.0" + }, + "directories": {}, + "dist": { + "shasum": "49d2c6925ffcec7b7de559597c153fa533364133", + "tarball": "https://registry.npmjs.org/csurf/-/csurf-1.9.0.tgz" + }, + "engines": { + "node": ">= 0.8.0" + }, + "files": [ + "HISTORY.md", + "LICENSE", + "index.js" + ], + "gitHead": "6359a0298e1e3e937abb96c21958b2a4419d0301", + "homepage": "https://github.com/expressjs/csurf", + "keywords": [ + "csrf", + "express", + "middleware", + "tokens" + ], + "license": "MIT", + "maintainers": [ + { + "name": "defunctzombie", + "email": "shtylman@gmail.com" + }, + { + "name": "dougwilson", + "email": "doug@somethingdoug.com" + }, + { + "name": "fishrock123", + "email": "fishrock123@rocketmail.com" + }, + { + "name": "jongleberry", + "email": "jonathanrichardong@gmail.com" + }, + { + "name": "mscdex", + "email": "mscdex@mscdex.net" + }, + { + "name": "tjholowaychuk", + "email": "tj@vision-media.ca" + } + ], + "name": "csurf", + "optionalDependencies": {}, + "readme": "ERROR: No README data found!", + "repository": { + "type": "git", + "url": "git+https://github.com/expressjs/csurf.git" + }, + "scripts": { + "lint": "eslint **/*.js", + "test": "mocha --check-leaks --reporter spec --bail test/", + "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --check-leaks --reporter dot test/", + "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --check-leaks --reporter spec test/" + }, + "version": "1.9.0" +} |