#+--------------------------------------------------------------------+
# Security.coffee
#+--------------------------------------------------------------------+
# Copyright DarkOverlordOfData (c) 2012
#+--------------------------------------------------------------------+
#
# This file is a part of Exspresso
#
# Exspresso is free software you can copy, modify, and distribute
# it under the terms of the MIT License
#
#+--------------------------------------------------------------------+
#
# Security Class
#
#
module.exports = class system.core.Security
querystring = require('querystring')
_xss_hash : '' # Random Hash for protecting URLs
_csrf_hash : '' # Random Hash for Cross Site Request Forgery Protection Cookie
_csrf_expire : 7200 # Expiration time for Cross Site Request Forgery Protection Cookie
_csrf_token_name : 'ex_csrf_token' # Token name for Cross Site Request Forgery Protection Cookie
_csrf_cookie_name : 'ex_csrf_token' # Cookie name for Cross Site Request Forgery Protection Cookie
_never_allowed_str : # List of never allowed strings
'document.cookie' : '[removed]'
'document.write' : '[removed]'
'.parentNode' : '[removed]'
'.innerHTML' : '[removed]'
'window.location' : '[removed]'
'-moz-binding' : '[removed]'
'' : '-->'
'' : '<comment>'
_never_allowed_regex : [ # List of never allowed regex replacement
/javascript\s*:/i # javascript
/expression\s*(\(|&\#40;)/i # CSS and IE
/vbscript\s*:/i # IE
/Redirect\s+302/i # Redirects
/([\"'])?data\s*:[^\\1]*?base64[^\\1]*?,[^\\1]*?\\1?/i
]
#
# Constructor
#
# @param [Object] req http request object
# @param [Object] res http response object
#
constructor : ($req, $res) ->
defineProperties @,
req : {writeable: false, value: $req}
res : {writeable: false, value: $res}
# Is CSRF protection enabled?
if config_item('csrf_protection') is true
# CSRF config
for $key in ['csrf_expire', 'csrf_token_name', 'csrf_cookie_name']
if false isnt ($val = config_item($key))
@['_' + $key] = $val
# Append application specific cookie prefix
if config_item('cookie_prefix')
@_csrf_cookie_name = config_item('cookie_prefix') + @_csrf_cookie_name
# Set the CSRF hash
@_csrf_set_hash()
log_message 'debug', "Security Class Initialized"
#
# Verify Cross Site Request Forgery Protection
#
# @return [Void]
#
csrfVerify : ->
# If it's not a POST request we will set the CSRF cookie
if @req.method.toUpperCase() isnt 'POST'
return @csrfSetCookie()
# Do the tokens exist in both the POST and COOKIE arrays?
if not (@req.body[@_csrf_token_name]? and @req.cookies[@_csrf_cookie_name]?)
@csrfShowError()
# Do the tokens match?
if @req.body[@_csrf_token_name] isnt @req.cookies[@_csrf_cookie_name]
@csrfShowError()
# We kill this since we're done and we don't want to
# polute the POST array
delete @req.body[@_csrf_token_name]
# Nothing should last forever
delete @req.cookies[@_csrf_cookie_name]
@_csrf_set_hash()
@csrfSetCookie()
log_message 'debug', 'CSRF token verified'
@
#
# Set Cross Site Request Forgery Protection Cookie
#
# @return [Void]
#
csrfSetCookie : ->
$expire = time() + @_csrf_expire
$secure_cookie = if config_item('cookie_secure') is true then 1 else 0
return false if $secure_cookie and (not $req.connection.encrypted)
@res.cookie @_csrf_cookie_name, @_csrf_hash,
expires : $expire
domain : config_item('cookie_domain')
path : config_item('cookie_path')
secure : $secure_cookie
log_message 'debug', "CRSF cookie Set"
@
#
# Show CSRF Error
#
# display's 'The action you have requested is not allowed.'
#
# @return [Void]
#
csrfShowError : ->
show_error('The action you have requested is not allowed.')
#
# Get CSRF Hash
#
# @return [String] the csrf hash value used
#
getCsrfHash : ->
return @_csrf_hash
#
# Get CSRF Token Name
#
# @return [String] the csrf token name used
#
getCsrfTokenName : ->
return @_csrf_token_name
#
# XSS Clean
#
# Sanitizes data so that Cross Site Scripting Hacks can be
# prevented. This function does a fair amount of work but
# it is extremely thorough, designed to prevent even the
# most obscure XSS attempts. Nothing is ever 100% foolproof,
# of course, but I haven't been able to get anything passed
# the filter.
#
# Note: This function should only be used to deal with data
# upon submission. It's not something that should
# be used for general runtime processing.
#
# This function was based in part on some code and ideas I
# got from Bitflux: http://channel.bitflux.ch/wiki/XSS_Prevention
#
# To help develop this script I used this great list of
# vulnerabilities along with a few other hacks I've
# harvested from examining vulnerabilities in other programs:
# http://ha.ckers.org/xss.html
#
# @param [String] str string to clean
# @param [Boolean] is_image is it an image?
# @return [String] cleaned string
#
xssClean : ($str, $is_image = false) ->
#
# Is the string an array?
#
#
if is_array($str)
for $key, $val of $str
$str[$key] = @xssClean($val)
return $str
#
# Remove Invisible Characters
#
$str = remove_invisible_characters($str)
## Validate Entities in URLs#
$str = @_validate_entities($str)
# URL Decode
#
# Just in case stuff like this is submitted:
#
# Google
#
$str = querystring.unescape($str)
##
# Convert character entities to ASCII
#
# This permits our tests below to work reliably.
# We only convert entities that are within tags since
# these are the ones that will pose security problems.
#
##
$str = $str.replace(/[a-z]+=([\'\"]).*?\1/mig, @_convert_attribute)
$str = $str.replace(/<\w+.*/mig, @_decode_entity)
# Remove Invisible Characters Again!
$str = remove_invisible_characters($str)
##
# Convert all tabs to spaces
#
#
if $str.indexOf('\t') isnt -1 then $str = $str.replace(/\t/mg, ' ')
# Capture converted string for later comparison
$converted_string = $str
## Remove Strings that are never allowed
$str = @_do_never_allowed($str)
##
# Compact any exploded words
#
# This corrects words like: j a v a s c r i p t
# These words are compacted back to their correct state.
##
$words = [
'javascript', 'expression', 'vbscript', 'script', 'base64',
'applet', 'alert', 'document', 'write', 'cookie', 'window'
]
for $word in $words
$temp = ''
$wordlen = $word.length
for $i in [0...$wordlen]
$temp+=$word.substr($i, 1) + "\\s*"
$str = $str.replace(RegExp('(' + $temp.substr(0, - 3) + ')(\\W)', 'im'), @_compact_exploded_words)
# Remove disallowed Javascript in links or img tags
#
while true
# We only want to do this when it is followed by a non-word character
# That way valid stuff like "dealer to" does not become "dealerto"
$original = $str
if /]*?)(>|$)/mig, @_js_link_removal)
if /![]()
]*?)(\s?\/?>|$)/mig, @_js_img_removal)
if /script/i.test($str) or /xss/i.test($str) then $str = $str.replace(/<(\/*)(script|xss)(.*?)\\>/mig, @removed)
break unless $original isnt $str
# delete $original
# Remove evil attributes such as style, onclick and xmlns
$str = @_remove_evil_attributes($str, $is_image)
#
# Sanitize naughty HTML elements
#
# If a tag containing any of the words in the list
# below is found, the tag gets converted to entities.
#
# So this: