|
| 1 | +import { z } from "zod"; |
| 2 | + |
| 3 | +// Common validation patterns |
| 4 | +export const commonValidations = { |
| 5 | + // Email validation with comprehensive checks |
| 6 | + email: z |
| 7 | + .string() |
| 8 | + .min(1, "Email is required") |
| 9 | + .max(254, "Email must be no more than 254 characters") |
| 10 | + .email("Please provide a valid email address") |
| 11 | + .toLowerCase() |
| 12 | + .trim() |
| 13 | + .refine( |
| 14 | + (email) => { |
| 15 | + |
| 16 | + const suspiciousPatterns = [ |
| 17 | + /<script/i, |
| 18 | + /javascript:/i, |
| 19 | + /on\w+\s*=/i, |
| 20 | + /data:/i, |
| 21 | + ]; |
| 22 | + return !suspiciousPatterns.some(pattern => pattern.test(email)); |
| 23 | + }, |
| 24 | + "Email contains invalid characters" |
| 25 | + ), |
| 26 | + |
| 27 | + // Strong password validation |
| 28 | + password: z |
| 29 | + .string() |
| 30 | + .min(8, "Password must be at least 8 characters long") |
| 31 | + .max(128, "Password must be no more than 128 characters") |
| 32 | + .regex( |
| 33 | + /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]/, |
| 34 | + "Password must contain at least one uppercase letter, one lowercase letter, one number, and one special character" |
| 35 | + ) |
| 36 | + .refine( |
| 37 | + (password) => { |
| 38 | + // Check for common weak passwords |
| 39 | + const commonPasswords = [ |
| 40 | + "password", "123456", "qwerty", "abc123", "password123", |
| 41 | + "admin", "letmein", "welcome", "monkey", "dragon" |
| 42 | + ]; |
| 43 | + return !commonPasswords.includes(password.toLowerCase()); |
| 44 | + }, |
| 45 | + "Password is too common, please choose a stronger password" |
| 46 | + ), |
| 47 | + |
| 48 | + // Request size validation |
| 49 | + validateRequestSize: (contentLength: number | null) => { |
| 50 | + const MAX_REQUEST_SIZE = 1024 * 1024; // 1MB limit |
| 51 | + if (contentLength && contentLength > MAX_REQUEST_SIZE) { |
| 52 | + throw new Error("Request payload too large"); |
| 53 | + } |
| 54 | + }, |
| 55 | + |
| 56 | + // Rate limiting helper (basic implementation) |
| 57 | + rateLimit: new Map<string, { count: number; resetTime: number }>(), |
| 58 | + |
| 59 | + checkRateLimit: (identifier: string, maxRequests: number = 5, windowMs: number = 15 * 60 * 1000) => { |
| 60 | + const now = Date.now(); |
| 61 | + const userLimit = commonValidations.rateLimit.get(identifier); |
| 62 | + |
| 63 | + if (!userLimit || now > userLimit.resetTime) { |
| 64 | + commonValidations.rateLimit.set(identifier, { count: 1, resetTime: now + windowMs }); |
| 65 | + return true; |
| 66 | + } |
| 67 | + |
| 68 | + if (userLimit.count >= maxRequests) { |
| 69 | + return false; |
| 70 | + } |
| 71 | + |
| 72 | + userLimit.count++; |
| 73 | + return true; |
| 74 | + } |
| 75 | +}; |
| 76 | + |
| 77 | +// Sanitization helpers |
| 78 | +export const sanitizeInput = { |
| 79 | + // Remove potentially dangerous characters |
| 80 | + sanitizeString: (input: string): string => { |
| 81 | + return input |
| 82 | + .replace(/[<>]/g, '') // Remove < and > |
| 83 | + .replace(/javascript:/gi, '') // Remove javascript: protocol |
| 84 | + .replace(/on\w+\s*=/gi, '') // Remove event handlers |
| 85 | + .trim(); |
| 86 | + }, |
| 87 | + |
| 88 | + // Validate and sanitize JSON input |
| 89 | + validateJsonInput: async (request: Request) => { |
| 90 | + const contentLength = request.headers.get("content-length"); |
| 91 | + commonValidations.validateRequestSize(contentLength ? parseInt(contentLength) : null); |
| 92 | + |
| 93 | + try { |
| 94 | + return await request.json(); |
| 95 | + } catch (error) { |
| 96 | + throw new Error("Invalid JSON format"); |
| 97 | + } |
| 98 | + } |
| 99 | +}; |
0 commit comments