server/helpers/custom-validators/plugins.ts

   1 import validator from 'validator'
   2 import { PluginPackageJSON } from '../../../shared/models/plugins/plugin-package-json.model'
   3 import { PluginType } from '../../../shared/models/plugins/plugin.type'
   4 import { CONSTRAINTS_FIELDS } from '../../initializers/constants'
   5 import { isUrlValid } from './activitypub/misc'
   6 import { exists, isArray, isSafePath } from './misc'
   7
   8 const PLUGINS_CONSTRAINTS_FIELDS = CONSTRAINTS_FIELDS.PLUGINS
   9
  10 function isPluginTypeValid (value: any) {
  11   return exists(value) &&
  12     (value === PluginType.PLUGIN || value === PluginType.THEME)
  13 }
  14
  15 function isPluginNameValid (value: string) {
  16   return exists(value) &&
  17     validator.isLength(value, PLUGINS_CONSTRAINTS_FIELDS.NAME) &&
  18     validator.matches(value, /^[a-z-0-9]+$/)
  19 }
  20
  21 function isNpmPluginNameValid (value: string) {
  22   return exists(value) &&
  23     validator.isLength(value, PLUGINS_CONSTRAINTS_FIELDS.NAME) &&
  24     validator.matches(value, /^[a-z\-._0-9]+$/) &&
  25     (value.startsWith('peertube-plugin-') || value.startsWith('peertube-theme-'))
  26 }
  27
  28 function isPluginDescriptionValid (value: string) {
  29   return exists(value) && validator.isLength(value, PLUGINS_CONSTRAINTS_FIELDS.DESCRIPTION)
  30 }
  31
  32 function isPluginStableVersionValid (value: string) {
  33   if (!exists(value)) return false
  34
  35   const parts = (value + '').split('.')
  36
  37   return parts.length === 3 && parts.every(p => validator.isInt(p))
  38 }
  39
  40 function isPluginStableOrUnstableVersionValid (value: string) {
  41   if (!exists(value)) return false
  42
  43   // suffix is beta.x or alpha.x
  44   const [ stable, suffix ] = value.split('-')
  45   if (!isPluginStableVersionValid(stable)) return false
  46
  47   const suffixRegex = /^(rc|alpha|beta)\.\d+$/
  48   if (suffix && !suffixRegex.test(suffix)) return false
  49
  50   return true
  51 }
  52
  53 function isPluginEngineValid (engine: any) {
  54   return exists(engine) && exists(engine.peertube)
  55 }
  56
  57 function isPluginHomepage (value: string) {
  58   return exists(value) && (!value || isUrlValid(value))
  59 }
  60
  61 function isPluginBugs (value: string) {
  62   return exists(value) && (!value || isUrlValid(value))
  63 }
  64
  65 function areStaticDirectoriesValid (staticDirs: any) {
  66   if (!exists(staticDirs) || typeof staticDirs !== 'object') return false
  67
  68   for (const key of Object.keys(staticDirs)) {
  69     if (!isSafePath(staticDirs[key])) return false
  70   }
  71
  72   return true
  73 }
  74
  75 function areClientScriptsValid (clientScripts: any[]) {
  76   return isArray(clientScripts) &&
  77     clientScripts.every(c => {
  78       return isSafePath(c.script) && isArray(c.scopes)
  79     })
  80 }
  81
  82 function areTranslationPathsValid (translations: any) {
  83   if (!exists(translations) || typeof translations !== 'object') return false
  84
  85   for (const key of Object.keys(translations)) {
  86     if (!isSafePath(translations[key])) return false
  87   }
  88
  89   return true
  90 }
  91
  92 function areCSSPathsValid (css: any[]) {
  93   return isArray(css) && css.every(c => isSafePath(c))
  94 }
  95
  96 function isThemeNameValid (name: string) {
  97   return isPluginNameValid(name)
  98 }
  99
 100 function isPackageJSONValid (packageJSON: PluginPackageJSON, pluginType: PluginType) {
 101   let result = true
 102   const badFields: string[] = []
 103
 104   if (!isNpmPluginNameValid(packageJSON.name)) {
 105     result = false
 106     badFields.push('name')
 107   }
 108
 109   if (!isPluginDescriptionValid(packageJSON.description)) {
 110     result = false
 111     badFields.push('description')
 112   }
 113
 114   if (!isPluginEngineValid(packageJSON.engine)) {
 115     result = false
 116     badFields.push('engine')
 117   }
 118
 119   if (!isPluginHomepage(packageJSON.homepage)) {
 120     result = false
 121     badFields.push('homepage')
 122   }
 123
 124   if (!exists(packageJSON.author)) {
 125     result = false
 126     badFields.push('author')
 127   }
 128
 129   if (!isPluginBugs(packageJSON.bugs)) {
 130     result = false
 131     badFields.push('bugs')
 132   }
 133
 134   if (pluginType === PluginType.PLUGIN && !isSafePath(packageJSON.library)) {
 135     result = false
 136     badFields.push('library')
 137   }
 138
 139   if (!areStaticDirectoriesValid(packageJSON.staticDirs)) {
 140     result = false
 141     badFields.push('staticDirs')
 142   }
 143
 144   if (!areCSSPathsValid(packageJSON.css)) {
 145     result = false
 146     badFields.push('css')
 147   }
 148
 149   if (!areClientScriptsValid(packageJSON.clientScripts)) {
 150     result = false
 151     badFields.push('clientScripts')
 152   }
 153
 154   if (!areTranslationPathsValid(packageJSON.translations)) {
 155     result = false
 156     badFields.push('translations')
 157   }
 158
 159   return { result, badFields }
 160 }
 161
 162 function isLibraryCodeValid (library: any) {
 163   return typeof library.register === 'function' &&
 164     typeof library.unregister === 'function'
 165 }
 166
 167 export {
 168   isPluginTypeValid,
 169   isPackageJSONValid,
 170   isThemeNameValid,
 171   isPluginHomepage,
 172   isPluginStableVersionValid,
 173   isPluginStableOrUnstableVersionValid,
 174   isPluginNameValid,
 175   isPluginDescriptionValid,
 176   isLibraryCodeValid,
 177   isNpmPluginNameValid
 178 }