[mirotalksfu] - add Validator, update dep

app/src/Server.js

@@ -44,7 +44,7 @@ dependencies: {
  * @license For commercial or closed source, contact us at license.mirotalk@gmail.com or purchase directly via CodeCanyon
  * @license CodeCanyon: https://codecanyon.net/item/mirotalk-sfu-webrtc-realtime-video-conferences/40769970
  * @author  Miroslav Pejic - miroslav.pejic.85@gmail.com
- * @version 1.5.39
+ * @version 1.5.40
  *
  */
 
@@ -69,6 +69,7 @@ const Room = require('./Room');
 const Peer = require('./Peer');
 const ServerApi = require('./ServerApi');
 const Logger = require('./Logger');
+const Validator = require('./Validator');
 const log = new Logger('Server');
 const yaml = require('js-yaml');
 const swaggerUi = require('swagger-ui-express');
@@ -467,6 +468,15 @@ function startServer() {
                 req.query,
             );
 
+            if (!Validator.isValidRoomName(room)) {
+                return res
+                    .status(401)
+                    .json({
+                        message:
+                            'Invalid Room name! Must be a UUID4 or an alphanumeric string without special characters or spaces.',
+                    });
+            }
+
             let peerUsername = '';
             let peerPassword = '';
             let isPeerValid = false;
@@ -534,14 +544,14 @@ function startServer() {
     // join room by id
     app.get('/join/:roomId', (req, res) => {
         //
-        const allowRoomAccess = isAllowedRoomAccess(
-            '/join/:roomId',
-            req,
-            hostCfg,
-            authHost,
-            roomList,
-            req.params.roomId,
-        );
+        const roomId = req.params.roomId;
+
+        if (!Validator.isValidRoomName(roomId)) {
+            log.warn('/join/:roomId invalid', roomId);
+            return res.redirect('/');
+        }
+
+        const allowRoomAccess = isAllowedRoomAccess('/join/:roomId', req, hostCfg, authHost, roomList, roomId);
 
         if (allowRoomAccess) {
             if (hostCfg.protected) authHost.setRoomActive();
@@ -659,9 +669,7 @@ function startServer() {
                     return res.status(400).send('Filename not provided');
                 }
 
-                // Rec_test_2024_08_03_16_17_01.webm
-
-                if (!fileName.startsWith('Rec_') && !fileName.endsWith('.webm')) {
+                if (!Validator.isValidRecFileNameFormat(fileName)) {
                     log.warn('[RecSync] - Invalid file name', fileName);
                     return res.status(400).send('Invalid file name');
                 }
@@ -1185,6 +1193,11 @@ function startServer() {
 
             log.info('User joined', data);
 
+            if (!Validator.isValidRoomName(socket.room_id)) {
+                log.warn('[Join] - Invalid room name', socket.room_id);
+                return cb('invalid');
+            }
+
             const room = roomList.get(socket.room_id);
 
             const { peer_name, peer_id, peer_uuid, peer_token, os_name, os_version, browser_name, browser_version } =

app/src/Validator.js

@@ -0,0 +1,24 @@
+'use strict';
+
+function isValidRoomName(input) {
+    if (typeof input !== 'string') {
+        return false;
+    }
+    const pattern =
+        /^(?:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|[A-Za-z0-9-_]+)$/;
+    return pattern.test(input);
+}
+
+function isValidRecFileNameFormat(input) {
+    if (typeof input !== 'string') {
+        return false;
+    }
+    const pattern =
+        /^Rec_(?:[A-Za-z0-9-_]+|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})_\d{4}_\d{2}_\d{2}_\d{2}_\d{2}_\d{2}\.(webm)$/;
+    return pattern.test(input);
+}
+
+module.exports = {
+    isValidRoomName,
+    isValidRecFileNameFormat,
+};