386704

Committed 22 Mar 2024 05:17PM UTC coverage: 67.551% (-0.02%) from 67.572%

Build # 386704

Build Type

push

Azure DevOps

Committed by

web-flow

Commit Message

Security: address TLS/FS issues (#2456)

* Security: address TLS/FS issues

* Fix tests

---------

Co-authored-by: Eugene Olonov <v-eolonov@microsoft.com>

Run Details

2632 of 4558 branches covered (57.74%)

Branch coverage included in aggregate %.

7 of 10 new or added lines in 2 files covered. (70.0%)

1 existing line in 1 file now uncovered.

6971 of 9658 relevant lines covered (72.18%)

11.83 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

33.78

/packages/app/main/src/server/routes/directLine/handlers/upload.ts

//
// Copyright (c) Microsoft. All rights reserved.
// Licensed under the MIT license.
//
// Microsoft Bot Framework: http://botframework.com
//
// Bot Framework Emulator Github:
// https://github.com/Microsoft/BotFramwork-Emulator
//
// Copyright (c) Microsoft Corporation
// All rights reserved.
//
// MIT License:
// Permission is hereby granted, free of charge, to any person obtaining
// a copy of this software and associated documentation files (the
// "Software"), to deal in the Software without restriction, including
// without limitation the rights to use, copy, modify, merge, publish,
// distribute, sublicense, and/or sell copies of the Software, and to
// permit persons to whom the Software is furnished to do so, subject to
// the following conditions:
//
// The above copyright notice and this permission notice shall be
// included in all copies or substantial portions of the Software.
//
// THE SOFTWARE IS PROVIDED ""AS IS"", WITHOUT WARRANTY OF ANY KIND,
// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
//

import * as fs from 'fs';

import { LogLevel, textItem } from '@bfemulator/sdk-shared';
import { Attachment, AttachmentData } from 'botframework-schema';
import * as Formidable from 'formidable';
import * as HttpStatus from 'http-status-codes';
import { Next, Request, Response } from 'restify';

import { BotEndpoint } from '../../../state/botEndpoint';
import { Conversation } from '../../../state/conversation';
import { sendErrorResponse } from '../../../utils/sendErrorResponse';
import { EmulatorRestServer } from '../../../restServer';
import { WebSocketServer } from '../../../webSocketServer';

export function createUploadHandler(emulatorServer: EmulatorRestServer) {
  const {
    logger: { logMessage },
    state,
  } = emulatorServer;

  return (req: Request, res: Response, next: Next): any => {
    if (req.params.conversationId.includes('transcript')) {
      res.end();
      next();
      return;
    }

    const conversation: Conversation = (req as any).conversation;
    const botEndpoint: BotEndpoint = (req as any).botEndpoint;

    if (!conversation) {
      res.send(HttpStatus.NOT_FOUND, 'conversation not found');
      res.end();
      logMessage(req.params.conversationId, textItem(LogLevel.Error, 'Cannot upload file. Conversation not found.'));
      next();
      return;
    }

    if (req.getContentType() !== 'multipart/form-data' || (req.getContentLength() === 0 && !req.isChunked())) {
      next();
      return;
    }

    const form = new Formidable.IncomingForm({ keepExtensions: true, multiples: true });

    // TODO: Override form.onPart handler so it doesn't write temp files to disk.
    form.parse(req, async (err: any, fields: any, files: any) => {
      const ROOT_PATH = '';

      try {
        // eslint-disable-next-line security/detect-non-literal-fs-filename
        const activity = JSON.parse(fs.readFileSync(path.resolve(ROOT_PATH, files.activity.path), 'utf8'));
        let uploads = files.file;

        if (!Array.isArray(uploads)) {
          uploads = [uploads];
        }
        if (uploads && uploads.length) {
          const serviceUrl = await emulatorServer.getServiceUrl(botEndpoint.botUrl);
          activity.attachments = [];
          uploads.forEach(upload1 => {
            const name = (upload1 as any).name || 'file.dat';
            const type = upload1.type;
            const path = upload1.path;
            // eslint-disable-next-line security/detect-non-literal-fs-filename
            const base64EncodedContent = fs.readFileSync(path.resolve(ROOT_PATH, path), { encoding: 'base64' });
            const base64Buf = Buffer.from(base64EncodedContent, 'base64');
            const attachmentData: AttachmentData = {
              type,
              name,
              originalBase64: new Uint8Array(base64Buf),
              thumbnailBase64: new Uint8Array(base64Buf),
            };
            const attachmentId = state.attachments.uploadAttachment(attachmentData);
            const attachment: Attachment = {
              name,
              contentType: type,
              contentUrl: `${serviceUrl}/v3/attachments/${attachmentId}/views/original`,
            };

            activity.attachments.push(attachment);
          });

          try {
            const { updatedActivity, statusCode, response } = await conversation.postActivityToBot(activity, true);

            if (~~statusCode === 0 && ~~statusCode > 300) {
              res.send(statusCode || HttpStatus.INTERNAL_SERVER_ERROR, await response.text());
              res.end();
            } else {
              res.send(statusCode, { id: updatedActivity.id });
              res.end();
              WebSocketServer.sendToSubscribers(conversation.conversationId, updatedActivity);
            }
          } catch (err) {
            sendErrorResponse(req, res, next, err);
          }
        } else {
          res.send(HttpStatus.BAD_REQUEST, 'no file uploaded');
          res.end();
        }
      } catch (e) {
        sendErrorResponse(req, res, next, e);
      }

      next();
    });
  };
}

1	//
2	// Copyright (c) Microsoft. All rights reserved.
3	// Licensed under the MIT license.
4	//
5	// Microsoft Bot Framework: http://botframework.com
6	//
7	// Bot Framework Emulator Github:
8	// https://github.com/Microsoft/BotFramwork-Emulator
9	//
10	// Copyright (c) Microsoft Corporation
11	// All rights reserved.
12	//
13	// MIT License:
14	// Permission is hereby granted, free of charge, to any person obtaining
15	// a copy of this software and associated documentation files (the
16	// "Software"), to deal in the Software without restriction, including
17	// without limitation the rights to use, copy, modify, merge, publish,
18	// distribute, sublicense, and/or sell copies of the Software, and to
19	// permit persons to whom the Software is furnished to do so, subject to
20	// the following conditions:
21	//
22	// The above copyright notice and this permission notice shall be
23	// included in all copies or substantial portions of the Software.
24	//
25	// THE SOFTWARE IS PROVIDED ""AS IS"", WITHOUT WARRANTY OF ANY KIND,
26	// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
27	// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
28	// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
29	// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
30	// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
31	// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
32	//
33
34	import * as fs from 'fs';
35
36	import { LogLevel, textItem } from '@bfemulator/sdk-shared';
37	import { Attachment, AttachmentData } from 'botframework-schema';
38	import * as Formidable from 'formidable';
39	import * as HttpStatus from 'http-status-codes';
40	import { Next, Request, Response } from 'restify';
41
42	import { BotEndpoint } from '../../../state/botEndpoint';
43	import { Conversation } from '../../../state/conversation';
44	import { sendErrorResponse } from '../../../utils/sendErrorResponse';
45	import { EmulatorRestServer } from '../../../restServer';
46	import { WebSocketServer } from '../../../webSocketServer';
47
48	export function createUploadHandler(emulatorServer: EmulatorRestServer) {
49	const {
50	logger: { logMessage },
51	state,
52	} = emulatorServer;	4✔
53
54	return (req: Request, res: Response, next: Next): any => {	4✔
55	if (req.params.conversationId.includes('transcript')) {	4✔
56	res.end();	1✔
57	next();	1✔
58	return;	1✔
59	}
60
61	const conversation: Conversation = (req as any).conversation;	3✔
62	const botEndpoint: BotEndpoint = (req as any).botEndpoint;	3✔
63
64	if (!conversation) {	3✔
65	res.send(HttpStatus.NOT_FOUND, 'conversation not found');	1✔
66	res.end();	1✔
67	logMessage(req.params.conversationId, textItem(LogLevel.Error, 'Cannot upload file. Conversation not found.'));	1✔
68	next();	1✔
69	return;	1✔
70	}
71
72	if (req.getContentType() !== 'multipart/form-data' \|\| (req.getContentLength() === 0 && !req.isChunked())) {	2!
73	next();	2✔
74	return;	2✔
75	}
76
77	const form = new Formidable.IncomingForm({ keepExtensions: true, multiples: true });	×
78
79	// TODO: Override form.onPart handler so it doesn't write temp files to disk.
80	form.parse(req, async (err: any, fields: any, files: any) => {	×
NEW 81	const ROOT_PATH = '';	×
82
83	try {	×
84	// eslint-disable-next-line security/detect-non-literal-fs-filename
NEW 85	const activity = JSON.parse(fs.readFileSync(path.resolve(ROOT_PATH, files.activity.path), 'utf8'));	×
UNCOV 86	let uploads = files.file;	×
87
88	if (!Array.isArray(uploads)) {	×
89	uploads = [uploads];	×
90	}
91	if (uploads && uploads.length) {	×
92	const serviceUrl = await emulatorServer.getServiceUrl(botEndpoint.botUrl);	×
93	activity.attachments = [];	×
94	uploads.forEach(upload1 => {	×
95	const name = (upload1 as any).name \|\| 'file.dat';	×
96	const type = upload1.type;	×
97	const path = upload1.path;	×
98	// eslint-disable-next-line security/detect-non-literal-fs-filename
NEW 99	const base64EncodedContent = fs.readFileSync(path.resolve(ROOT_PATH, path), { encoding: 'base64' });	×
100	const base64Buf = Buffer.from(base64EncodedContent, 'base64');	×
101	const attachmentData: AttachmentData = {	×
102	type,
103	name,
104	originalBase64: new Uint8Array(base64Buf),
105	thumbnailBase64: new Uint8Array(base64Buf),
106	};
107	const attachmentId = state.attachments.uploadAttachment(attachmentData);	×
108	const attachment: Attachment = {	×
109	name,
110	contentType: type,
111	contentUrl: `${serviceUrl}/v3/attachments/${attachmentId}/views/original`,
112	};
113
114	activity.attachments.push(attachment);	×
115	});
116
117	try {	×
118	const { updatedActivity, statusCode, response } = await conversation.postActivityToBot(activity, true);	×
119
120	if (~~statusCode === 0 && ~~statusCode > 300) {	×
121	res.send(statusCode \|\| HttpStatus.INTERNAL_SERVER_ERROR, await response.text());	×
122	res.end();	×
123	} else {
124	res.send(statusCode, { id: updatedActivity.id });	×
125	res.end();	×
126	WebSocketServer.sendToSubscribers(conversation.conversationId, updatedActivity);	×
127	}
128	} catch (err) {
129	sendErrorResponse(req, res, next, err);	×
130	}
131	} else {
132	res.send(HttpStatus.BAD_REQUEST, 'no file uploaded');	×
133	res.end();	×
134	}
135	} catch (e) {
136	sendErrorResponse(req, res, next, e);	×
137	}
138
139	next();	×
140	});
141	};
142	}

Microsoft / BotFramework-Emulator / 386704

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous