juice-shop

1
/*
2
 * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
3
 * SPDX-License-Identifier: MIT
4
 */
5

6
import fs = require('fs')
7
import { type Request, type Response, type NextFunction } from 'express'
8
import logger from '../lib/logger'
9

10
import { UserModel } from '../models/user'
11
import * as utils from '../lib/utils'
12
const security = require('../lib/insecurity')
13
const request = require('request')
14

15
module.exports = function profileImageUrlUpload () {
16
  return (req: Request, res: Response, next: NextFunction) => {
17
    if (req.body.imageUrl !== undefined) {
18
      const url = req.body.imageUrl
19
      if (url.match(/(.)*solve\/challenges\/server-side(.)*/) !== null) req.app.locals.abused_ssrf_bug = true
20
      const loggedInUser = security.authenticatedUsers.get(req.cookies.token)
21
      if (loggedInUser) {
22
        const imageRequest = request
23
          .get(url)
24
          .on('error', function (err: unknown) {
25
            UserModel.findByPk(loggedInUser.data.id).then(async (user: UserModel | null) => { return await user?.update({ profileImage: url }) }).catch((error: Error) => { next(error) })
26
            logger.warn(`Error retrieving user profile image: ${utils.getErrorMessage(err)}; using image link directly`)
27
          })
28
          .on('response', function (res: Response) {
29
            if (res.statusCode === 200) {
30
              const ext = ['jpg', 'jpeg', 'png', 'svg', 'gif'].includes(url.split('.').slice(-1)[0].toLowerCase()) ? url.split('.').slice(-1)[0].toLowerCase() : 'jpg'
31
              imageRequest.pipe(fs.createWriteStream(`frontend/dist/frontend/assets/public/images/uploads/${loggedInUser.data.id}.${ext}`))
32
              UserModel.findByPk(loggedInUser.data.id).then(async (user: UserModel | null) => { return await user?.update({ profileImage: `/assets/public/images/uploads/${loggedInUser.data.id}.${ext}` }) }).catch((error: Error) => { next(error) })
33
            } else UserModel.findByPk(loggedInUser.data.id).then(async (user: UserModel | null) => { return await user?.update({ profileImage: url }) }).catch((error: Error) => { next(error) })
34
          })
35
      } else {
36
        next(new Error('Blocked illegal activity by ' + req.socket.remoteAddress))
37
      }
38
    }
39
    res.location(process.env.BASE_PATH + '/profile')
40
    res.redirect(process.env.BASE_PATH + '/profile')
41
  }
42
}
43