2 files changed, 91 insertions, 0 deletions

diff --git a/server/helpers/custom-validators/misc.ts b/server/helpers/custom-validators/misc.ts
index 3a3deab0c..f72513c1c 100644
--- a/server/helpers/custom-validators/misc.ts
+++ b/server/helpers/custom-validators/misc.ts
@@ -1,10 +1,18 @@
 import 'multer'
 import * as validator from 'validator'
+import { sep } from 'path'
 
 function exists (value: any) {
   return value !== undefined && value !== null
 }
 
+function isSafePath (p: string) {
+  return exists(p) &&
+    (p + '').split(sep).every(part => {
+      return [ '', '.', '..' ].includes(part) === false
+    })
+}
+
 function isArray (value: any) {
   return Array.isArray(value)
 }
@@ -97,6 +105,7 @@ export {
   isNotEmptyIntArray,
   isArray,
   isIdValid,
+  isSafePath,
   isUUIDValid,
   isIdOrUUIDValid,
   isDateValid,
diff --git a/server/helpers/custom-validators/plugins.ts b/server/helpers/custom-validators/plugins.ts
new file mode 100644
index 000000000..ff687dc3f
--- /dev/null
+++ b/server/helpers/custom-validators/plugins.ts
@@ -0,0 +1,82 @@
+import { exists, isArray, isSafePath } from './misc'
+import * as validator from 'validator'
+import { PluginType } from '../../../shared/models/plugins/plugin.type'
+import { CONSTRAINTS_FIELDS } from '../../initializers/constants'
+import { PluginPackageJson } from '../../../shared/models/plugins/plugin-package-json.model'
+import { isUrlValid } from './activitypub/misc'
+
+const PLUGINS_CONSTRAINTS_FIELDS = CONSTRAINTS_FIELDS.PLUGINS
+
+function isPluginTypeValid (value: any) {
+  return exists(value) && validator.isInt('' + value) && PluginType[value] !== undefined
+}
+
+function isPluginNameValid (value: string) {
+  return exists(value) &&
+    validator.isLength(value, PLUGINS_CONSTRAINTS_FIELDS.NAME) &&
+    validator.matches(value, /^[a-z\-]+$/)
+}
+
+function isPluginDescriptionValid (value: string) {
+  return exists(value) && validator.isLength(value, PLUGINS_CONSTRAINTS_FIELDS.DESCRIPTION)
+}
+
+function isPluginVersionValid (value: string) {
+  if (!exists(value)) return false
+
+  const parts = (value + '').split('.')
+
+  return parts.length === 3 && parts.every(p => validator.isInt(p))
+}
+
+function isPluginEngineValid (engine: any) {
+  return exists(engine) && exists(engine.peertube)
+}
+
+function isStaticDirectoriesValid (staticDirs: any) {
+  if (!exists(staticDirs) || typeof staticDirs !== 'object') return false
+
+  for (const key of Object.keys(staticDirs)) {
+    if (!isSafePath(staticDirs[key])) return false
+  }
+
+  return true
+}
+
+function isClientScriptsValid (clientScripts: any[]) {
+  return isArray(clientScripts) &&
+    clientScripts.every(c => {
+      return isSafePath(c.script) && isArray(c.scopes)
+    })
+}
+
+function isCSSPathsValid (css: any[]) {
+  return isArray(css) && css.every(c => isSafePath(c))
+}
+
+function isPackageJSONValid (packageJSON: PluginPackageJson, pluginType: PluginType) {
+  return isPluginNameValid(packageJSON.name) &&
+    isPluginDescriptionValid(packageJSON.description) &&
+    isPluginEngineValid(packageJSON.engine) &&
+    isUrlValid(packageJSON.homepage) &&
+    exists(packageJSON.author) &&
+    isUrlValid(packageJSON.bugs) &&
+    (pluginType === PluginType.THEME || isSafePath(packageJSON.library)) &&
+    isStaticDirectoriesValid(packageJSON.staticDirs) &&
+    isCSSPathsValid(packageJSON.css) &&
+    isClientScriptsValid(packageJSON.clientScripts)
+}
+
+function isLibraryCodeValid (library: any) {
+  return typeof library.register === 'function'
+    && typeof library.unregister === 'function'
+}
+
+export {
+  isPluginTypeValid,
+  isPackageJSONValid,
+  isPluginVersionValid,
+  isPluginNameValid,
+  isPluginDescriptionValid,
+  isLibraryCodeValid
+}