Mirrors/xsshunter
2
0
Fork 0
mirror of https://github.com/trufflesecurity/xsshunter synced 2024-11-10 06:44:13 +00:00
Code Issues Projects Releases Packages Wiki Activity

moving route

Browse source
This commit is contained in:
counter 2023-01-18 20:05:37 -08:00
parent 00d96e1b78
commit 1b73be6bdb
2 changed files with 54 additions and 53 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

53
api.js
View file

@ -1,4 +1,5 @@
const bcrypt = require('bcrypt');
const { Storage } = require('@google-cloud/storage');
const express = require('express');
const cors = require('cors');
const path = require('path');
@ -24,6 +25,8 @@ const {OAuth2Client} = require('google-auth-library');
const SCREENSHOTS_DIR = path.resolve(process.env.SCREENSHOTS_DIR);
const client = new OAuth2Client(process.env.CLIENT_ID, process.env.CLIENT_SECRET, `https://${process.env.HOSTNAME}/oauth-login`);
const SCREENSHOT_FILENAME_REGEX = new RegExp(/^[0-9A-F]{8}-[0-9A-F]{4}-4[0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}\.png$/i);
var sessions_middleware = false;
var sessions_settings_object = {
@ -114,6 +117,7 @@ async function set_up_api_server(app) {
constants.API_BASE_PATH + 'settings',
constants.API_BASE_PATH + 'xss-uri',
constants.API_BASE_PATH + 'user-path',
'/screenshots/:screenshotFilename'
];
@ -181,6 +185,55 @@ async function set_up_api_server(app) {
}
});
app.get('/screenshots/:screenshotFilename', async (req, res) => {
const screenshot_filename = req.params.screenshotFilename;
// Come correct or don't come at all.
if(!SCREENSHOT_FILENAME_REGEX.test(screenshot_filename)) {
return res.sendStatus(404);
}
const gz_image_path = `${SCREENSHOTS_DIR}/${screenshot_filename}.gz`;
if (process.env.USE_CLOUD_STORAGE == "true"){
const storage = new Storage();
const bucket = storage.bucket(process.env.BUCKET_NAME);
const file = bucket.file(gz_image_path);
try {
// Download the gzipped image
const [image] = await file.download();
// Send the gzipped image in the response
res.set('Content-Encoding', 'gzip');
res.set('Content-Type', 'application/gzip');
res.send(image);
} catch (error) {
console.error(error);
res.status(404).send(`Error retrieving image from GCS`);
}
}else{
const image_exists = await check_file_exists(gz_image_path);
if(!image_exists) {
return res.sendStatus(404);
}
// Return the gzipped image file with the appropriate
// Content-Encoding header, should be widely supported.
res.sendFile(gz_image_path, {
// Why leak anything you don't have to?
lastModified: false,
acceptRanges: false,
cacheControl: true,
headers: {
"Content-Type": "image/png",
"Content-Encoding": "gzip"
}
})
}
});
// Serve the front-end
app.use('/app/', express.static(

54
app.js
View file

@ -281,59 +281,7 @@ async function get_app_server() {
}
});
app.get('/screenshots/:screenshotFilename', async (req, res) => {
if (! req.session.authenticated === true){
res.status(401).send('Unauthorized');
}
const screenshot_filename = req.params.screenshotFilename;
// Come correct or don't come at all.
if(!SCREENSHOT_FILENAME_REGEX.test(screenshot_filename)) {
return res.sendStatus(404);
}
const gz_image_path = `${SCREENSHOTS_DIR}/${screenshot_filename}.gz`;
if (process.env.USE_CLOUD_STORAGE == "true"){
const storage = new Storage();
const bucket = storage.bucket(process.env.BUCKET_NAME);
const file = bucket.file(gz_image_path);
try {
// Download the gzipped image
const [image] = await file.download();
// Send the gzipped image in the response
res.set('Content-Encoding', 'gzip');
res.set('Content-Type', 'application/gzip');
res.send(image);
} catch (error) {
console.error(error);
res.status(404).send(`Error retrieving image from GCS`);
}
}else{
const image_exists = await check_file_exists(gz_image_path);
if(!image_exists) {
return res.sendStatus(404);
}
// Return the gzipped image file with the appropriate
// Content-Encoding header, should be widely supported.
res.sendFile(gz_image_path, {
// Why leak anything you don't have to?
lastModified: false,
acceptRanges: false,
cacheControl: true,
headers: {
"Content-Type": "image/png",
"Content-Encoding": "gzip"
}
})
}
});
// Set up /health handler so the user can
// do uptime checks and appropriate alerting.
app.get('/health', async (req, res) => {