Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion components/amorphic/HISTORY.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
## 11.0.2
* Small update to change wording to allowlist and denylist
## 11.0.1
* Restrict loggingLevel passing to backend to log functions.
## 11.0.0
Expand All @@ -12,7 +14,7 @@
* A new `setApiContextMiddleware` middleware is also introduced to allow client passed loggers run some middleware code
on server calls. This middleware may also have different functionalities that can be controlled using a new boolean `generateAmorphicServerLogContextIfMissing` config.
## 10.3.0
* Add validator middleware to express server, config settings for whitelist, blacklist, escape
* Add validator middleware to express server, config settings for allowlist, denylist, escape
## 10.2.1
* bump nconf version due to security vulnerability.
## 10.2.0
Expand Down
16 changes: 8 additions & 8 deletions components/amorphic/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -76,23 +76,23 @@ The Amorphic server has validation middleware that will validate requests coming
There are four fields to put in the config.json for the amorphic app. These fields are:

```
validatorAllowList: characters that are allowed in the request, a white list
validatorDenyList: characters that are not allowed in the request, a black list
validatorLog: boolean for logging whenever a request is blacklisted, whitelisted, or has HTML values escaped
validatorAllowList: characters that are allowed in the request
validatorDenyList: characters that are not allowed in the request
validatorLog: boolean for logging whenever a request is denylisted, allowlisted, or has HTML values escaped
validatorEscapeHTML: boolean for allowing HTML characters to be escaped
```

The whitelist and blacklist fields follow the format here: https://www.npmjs.com/package/validator
The allowlist and denylist fields follow the format here: https://www.npmjs.com/package/validator

The whitelist field is especially dangerous to use as it will only allow characters that match the format to pass the validator.
The allowlist field is especially dangerous to use as it will only allow characters that match the format to pass the validator.

The blacklist field also has certain characters that should not be blocked, such as '-', as that will most likely corrupt the amorphic message and cause problems.
The denylist field also has certain characters that should not be blocked, such as '-', as that will most likely corrupt the amorphic message and cause problems.

The order that this validation is performed is blacklist, escape, whitelist.
The order that this validation is performed is denylist, escape, allowlist.

The config.json found for the amorphic postgres unit test found here: components/amorphic/test/postgres/apps/test/config.json, contains examples of how these fields should be used.

There is also a counter under statsd for 'amorphic.server.validator.whitelist.counter', 'amorphic.server.validator.blacklist.counter', and 'amorphic.server.validator.escape.counter' that will count the times requests are blacklisted, whitelisted, or escaped.
There is also a counter under statsd for 'amorphic.server.validator.allowlist.counter', 'amorphic.server.validator.denylist.counter', and 'amorphic.server.validator.escape.counter' that will count the times requests are denylisted, allowlisted, or escaped.

## Testing

Expand Down
4 changes: 2 additions & 2 deletions components/amorphic/lib/utils/InputValidator.ts
Original file line number Diff line number Diff line change
Expand Up @@ -103,13 +103,13 @@ export class InputValidator {
const validatorEscapeHTML = getBoolean(appConfig.appConfig.validatorEscapeHTML);

if (denyList) {
value = this.logAndCounterValue(value, validator.blacklist(value, denyList), validatorLog, 'blacklist', { denyList: denyList });
value = this.logAndCounterValue(value, validator.blacklist(value, denyList), validatorLog, 'denylist', { denyList: denyList });
}
if (validatorEscapeHTML) {
value = this.logAndCounterValue(value, validator.escape(value), validatorLog, 'escape', {});
}
if (allowList) {
value = this.logAndCounterValue(value, validator.whitelist(value, allowList), validatorLog, 'whitelist', { allowList: allowList });
value = this.logAndCounterValue(value, validator.whitelist(value, allowList), validatorLog, 'allowlist', { allowList: allowList });
}

return value;
Expand Down
4 changes: 2 additions & 2 deletions components/amorphic/package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion components/amorphic/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
"homepage": "https://github.com/haven-life/amorphic",
"main": "dist/index.js",
"types": "dist/index.d.ts",
"version": "11.0.1",
"version": "11.0.2",
"dependencies": {
"@haventech/persistor": "9.x",
"@haventech/semotus": "7.x",
Expand Down