fix(core): Fix XSS validation and separate URL validation

packages/cli/package.json

@@ -155,6 +155,7 @@
     "reflect-metadata": "0.2.2",
     "replacestream": "4.0.3",
     "samlify": "2.8.9",
+    "sanitize-html": "2.12.1",
     "semver": "7.5.4",
     "shelljs": "0.8.5",
     "simple-git": "3.17.0",

packages/cli/src/GenericHelpers.ts

@@ -9,7 +9,7 @@ import type {
 	UserUpdatePayload,
 } from '@/requests';
 import { BadRequestError } from './errors/response-errors/bad-request.error';
-import { NoXss } from './databases/utils/customValidators';
+import { NoXss } from '@/databases/utils/no-xss.validator';
 
 export async function validateEntity(
 	entity:

packages/cli/src/databases/entities/User.ts

@@ -13,7 +13,7 @@ import { IsEmail, IsString, Length } from 'class-validator';
 import type { IUser, IUserSettings } from 'n8n-workflow';
 import type { SharedWorkflow } from './SharedWorkflow';
 import type { SharedCredentials } from './SharedCredentials';
-import { NoXss } from '../utils/customValidators';
+import { NoXss } from '@db/utils/no-xss.validator';
 import { objectRetriever, lowerCaser } from '../utils/transformers';
 import { WithTimestamps, jsonColumnType } from './AbstractEntity';
 import type { IPersonalizationSurveyAnswers } from '@/Interfaces';

packages/cli/src/databases/utils/__tests__/no-xss.validator.test.ts

@@ -0,0 +1,70 @@
+import { NoXss } from '../no-xss.validator';
+import { validate } from 'class-validator';
+
+describe('NoXss', () => {
+	class Entity {
+		@NoXss()
+		name = '';
+
+		@NoXss()
+		timestamp = '';
+
+		@NoXss()
+		version = '';
+	}
+
+	const entity = new Entity();
+
+	describe('Scripts and URLs', () => {
+		const MALICIOUS_STRINGS = ['http://google.com', '<script src/>', 'www.domain.tld'];
+
+		for (const str of MALICIOUS_STRINGS) {
+			test(`should block ${str}`, async () => {
+				entity.name = str;
+				const [error] = await validate(entity);
+				expect(error.property).toEqual('name');
+				expect(error.constraints).toEqual({ NoXss: 'Potentially malicious string' });
+			});
+		}
+	});
+
+	describe('Names', () => {
+		const VALID_NAMES = [
+			'Johann Strauß',
+			'Вагиф Сәмәдоғлу',
+			'René Magritte',
+			'সুকুমার রায়',
+			'མགོན་པོ་རྡོ་རྗེ།',
+			'عبدالحليم حافظ',
+		];
+
+		for (const name of VALID_NAMES) {
+			test(`should allow ${name}`, async () => {
+				entity.name = name;
+				expect(await validate(entity)).toBeEmptyArray();
+			});
+		}
+	});
+
+	describe('ISO-8601 timestamps', () => {
+		const VALID_TIMESTAMPS = ['2022-01-01T00:00:00.000Z', '2022-01-01T00:00:00.000+02:00'];
+
+		for (const timestamp of VALID_TIMESTAMPS) {
+			test(`should allow ${timestamp}`, async () => {
+				entity.timestamp = timestamp;
+				await expect(validate(entity)).resolves.toBeEmptyArray();
+			});
+		}
+	});
+
+	describe('Semver versions', () => {
+		const VALID_VERSIONS = ['1.0.0', '1.0.0-alpha.1'];
+
+		for (const version of VALID_VERSIONS) {
+			test(`should allow ${version}`, async () => {
+				entity.version = version;
+				await expect(validate(entity)).resolves.toBeEmptyArray();
+			});
+		}
+	});
+});

packages/cli/src/databases/utils/no-xss.validator.ts

@@ -0,0 +1,32 @@
+import type { ValidationOptions, ValidatorConstraintInterface } from 'class-validator';
+import { registerDecorator, ValidatorConstraint } from 'class-validator';
+import sanitizeHtml from 'sanitize-html';
+
+const URL_REGEX = /^(https?:\/\/|www\.)/i;
+
+@ValidatorConstraint({ name: 'NoXss', async: false })
+class NoXssConstraint implements ValidatorConstraintInterface {
+	validate(value: string) {
+		const sanitized = sanitizeHtml(value, { allowedTags: [], allowedAttributes: {} });
+
+		if (sanitized !== value) return false;
+
+		return !URL_REGEX.test(value);
+	}
+
+	defaultMessage() {
+		return 'Potentially malicious string';
+	}
+}
+
+export function NoXss(options?: ValidationOptions) {
+	return function (object: object, propertyName: string) {
+		registerDecorator({
+			name: 'NoXss',
+			target: object.constructor,
+			propertyName,
+			options,
+			validator: NoXssConstraint,
+		});
+	};
+}

packages/cli/src/requests.ts

@@ -13,7 +13,7 @@ import type {
 
 import { Expose } from 'class-transformer';
 import { IsBoolean, IsEmail, IsIn, IsOptional, IsString, Length } from 'class-validator';
-import { NoXss } from '@db/utils/customValidators';
+import { NoXss } from '@db/utils/no-xss.validator';
 import type { PublicUser, SecretsProvider, SecretsProviderState } from '@/Interfaces';
 import { AssignableRole } from '@db/entities/User';
 import type { GlobalRole, User } from '@db/entities/User';