"{item.notes}"
- Don't have an account?{" "} + Don't have an account?{" "} Sign up here diff --git a/app/Lullaby/page.js b/app/Lullaby/page.js index 1c1fcbb..617decf 100644 --- a/app/Lullaby/page.js +++ b/app/Lullaby/page.js @@ -367,9 +367,9 @@ export default function LullabyPage() {
Keep track of your baby's vaccination schedule and essential medical contacts for quick access.
Enter your baby's birth date to automatically generate the standard vaccination schedule.
{vaccine.description || "No description"}
"{vaccine.notes}"
- Supporting parents through their baby's first year with expert guidance, AI tools, and a loving community. + Supporting parents through their baby's first year with expert guidance, AI tools, and a loving community.
"{contact.description}"
- Please log in to access your baby's personalized {sectionName} and track their progress with our comprehensive tools. + Please log in to access your baby's personalized {sectionName} and track their progress with our comprehensive tools.
- Don't have an account?{" "} + Don't have an account?{" "} {lullabies.length === 0 && ( - No lullabies found. Let's add some magic! + No lullabies found. Let's add some magic! )} {lullabies.map(lullaby => ( diff --git a/app/components/NotificationBell.js b/app/components/NotificationBell.js index ef98853..851668a 100644 --- a/app/components/NotificationBell.js +++ b/app/components/NotificationBell.js @@ -106,7 +106,7 @@ const NotificationBell = () => { No notifications yet - We'll notify you about important updates + We'll notify you about important updates ) : ( diff --git a/app/components/SpeechRecognition.js b/app/components/SpeechRecognition.js index 3ac25bf..27054ec 100644 --- a/app/components/SpeechRecognition.js +++ b/app/components/SpeechRecognition.js @@ -4,6 +4,22 @@ import { useState, useEffect, useRef } from "react"; import { Mic, MicOff } from "lucide-react"; import { Button } from "./ui/Button"; +// Utility function to sanitize transcript output +const sanitizeTranscript = (transcript) => { + if (!transcript || typeof transcript !== 'string') return ''; + // Remove HTML tags and potentially dangerous characters + return transcript.replace(/<[^>]*>/g, '').replace(/[<>"'&]/g, (match) => { + const entities = { + '<': '<', + '>': '>', + '"': '"', + "'": ''', + '&': '&' + }; + return entities[match] || match; + }).trim(); +}; + const SpeechRecognition = ({ onTranscript, isListening, setIsListening, disabled = false }) => { const [isSupported, setIsSupported] = useState(false); const [error, setError] = useState(""); @@ -38,10 +54,17 @@ const SpeechRecognition = ({ onTranscript, isListening, setIsListening, disabled } if (finalTranscript) { - setIsListening(false); - setShowSuccess(true); - setTimeout(() => setShowSuccess(false), 2000); - onTranscript(finalTranscript); + // Sanitize the transcript before passing it to the callback + const sanitizedTranscript = sanitizeTranscript(finalTranscript); + if (sanitizedTranscript) { + setIsListening(false); + setShowSuccess(true); + setTimeout(() => setShowSuccess(false), 2000); + onTranscript(sanitizedTranscript); + } else { + setError("Invalid speech input detected"); + setIsListening(false); + } } }; diff --git a/app/components/TextToSpeech.js b/app/components/TextToSpeech.js index 2b04b7c..94c1d71 100644 --- a/app/components/TextToSpeech.js +++ b/app/components/TextToSpeech.js @@ -4,6 +4,22 @@ import { useState, useEffect } from "react"; import { Volume2, VolumeX } from "lucide-react"; import { Button } from "./ui/Button"; +// Utility function to sanitize text input +const sanitizeText = (text) => { + if (!text || typeof text !== 'string') return ''; + // Remove HTML tags and potentially dangerous characters + return text.replace(/<[^>]*>/g, '').replace(/[<>"'&]/g, (match) => { + const entities = { + '<': '<', + '>': '>', + '"': '"', + "'": ''', + '&': '&' + }; + return entities[match] || match; + }).trim(); +}; + const TextToSpeech = ({ text, disabled = false }) => { const [isSpeaking, setIsSpeaking] = useState(false); const [isSupported, setIsSupported] = useState(false); @@ -24,12 +40,19 @@ const TextToSpeech = ({ text, disabled = false }) => { const speak = () => { if (!isSupported || !text || disabled) return; + // Sanitize the text input to prevent XSS + const sanitizedText = sanitizeText(text); + if (!sanitizedText) { + setError("Invalid text input"); + return; + } + try { // Stop any current speech window.speechSynthesis.cancel(); - // Create speech utterance - const utterance = new SpeechSynthesisUtterance(text); + // Create speech utterance with sanitized text + const utterance = new SpeechSynthesisUtterance(sanitizedText); // Configure speech settings utterance.lang = "en-US"; diff --git a/app/context/NotificationContext.js b/app/context/NotificationContext.js index 5405d79..d08492f 100644 --- a/app/context/NotificationContext.js +++ b/app/context/NotificationContext.js @@ -1,6 +1,6 @@ "use client"; -import React, { createContext, useContext, useState, useEffect } from "react"; +import React, { createContext, useContext, useState, useEffect, useCallback } from "react"; import { useAuth } from "./AuthContext"; import { toast } from "sonner"; @@ -21,7 +21,7 @@ export const NotificationProvider = ({ children }) => { const { isAuth } = useAuth(); // Fetch notifications from API - const fetchNotifications = async () => { + const fetchNotifications = useCallback(async () => { if (!isAuth) return; try { @@ -43,7 +43,7 @@ export const NotificationProvider = ({ children }) => { } finally { setIsLoading(false); } - }; + }, [isAuth]); // Create a new notification const createNotification = async (notificationData) => { @@ -254,7 +254,7 @@ export const NotificationProvider = ({ children }) => { setNotifications([]); setUnreadCount(0); } - }, [isAuth]); + }, [isAuth, fetchNotifications]); const value = { notifications, diff --git a/app/signupbaby/page.js b/app/signupbaby/page.js index 3b070e4..d16ad48 100644 --- a/app/signupbaby/page.js +++ b/app/signupbaby/page.js @@ -40,11 +40,11 @@ export default function SignupBabyPage() { // Initialize babyErrors and babiesTouched arrays when noOfBabies changes useEffect(() => { - setBabyErrors( - Array.from({ length: noOfBabies }, (_, i) => babyErrors[i] || {}) + setBabyErrors(prevErrors => + Array.from({ length: noOfBabies }, (_, i) => prevErrors[i] || {}) ); - setBabiesTouched( - Array.from({ length: noOfBabies }, (_, i) => babiesTouched[i] || false) + setBabiesTouched(prevTouched => + Array.from({ length: noOfBabies }, (_, i) => prevTouched[i] || false) ); }, [noOfBabies]); @@ -415,7 +415,7 @@ export default function SignupBabyPage() { {/* Baby Name */} - Baby's Name + Baby's Name maxLength) return false; + // Basic XSS prevention + if (type === 'string' && / byte.toString(16).padStart(2, '0')).join(''); + } + + /** + * Clear tokens (for logout) + */ + clearTokens() { + this.token = null; + this.sessionToken = null; + if (typeof window !== 'undefined') { + sessionStorage.removeItem('csrf_token'); + sessionStorage.removeItem('session_token'); + } + } +} + +// Create singleton instance +const csrfManager = new CSRFTokenManager(); + +/** + * Secure fetch wrapper that includes CSRF tokens and other security headers + * @param {string} url - Request URL + * @param {Object} options - Fetch options + * @returns {Promise} Fetch response + */ +export async function secureFetch(url, options = {}) { + const { csrfToken, sessionToken } = csrfManager.getTokens(); + + // Prepare secure headers + const secureHeaders = { + 'Content-Type': 'application/json', + 'X-Requested-With': 'XMLHttpRequest', + ...options.headers + }; + + // Add CSRF tokens for state-changing requests + if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(options.method?.toUpperCase())) { + secureHeaders['X-CSRF-Token'] = csrfToken; + secureHeaders['X-Session-Token'] = sessionToken; + } + + // Add authorization header if token exists + const authToken = typeof window !== 'undefined' ? localStorage.getItem('token') : null; + if (authToken) { + secureHeaders['Authorization'] = `Bearer ${authToken}`; + } + + const secureOptions = { + ...options, + headers: secureHeaders, + credentials: 'same-origin' // Include cookies for same-origin requests + }; + + try { + const response = await fetch(url, secureOptions); + + // Handle common security responses + if (response.status === 403 && response.headers.get('X-CSRF-Error')) { + // CSRF token expired, generate new ones and retry + csrfManager.generateTokens(); + const retryHeaders = { ...secureHeaders }; + const { csrfToken: newCsrf, sessionToken: newSession } = csrfManager.getTokens(); + retryHeaders['X-CSRF-Token'] = newCsrf; + retryHeaders['X-Session-Token'] = newSession; + + return await fetch(url, { ...secureOptions, headers: retryHeaders }); + } + + return response; + } catch (error) { + console.error('Secure fetch error:', error); + throw error; + } +} + +/** + * Input sanitization for client-side use + * @param {string} input - Input to sanitize + * @returns {string} Sanitized input + */ +export function sanitizeInput(input) { + if (typeof input !== 'string') return input; + + return input + .replace(/[<>\"'&]/g, (match) => { + const entities = { + '<': '<', + '>': '>', + '"': '"', + "'": ''', + '&': '&' + }; + return entities[match] || match; + }) + .trim(); +} + +/** + * Validate email format + * @param {string} email - Email to validate + * @returns {boolean} Whether email is valid + */ +export function validateEmail(email) { + const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/; + return emailRegex.test(email); +} + +/** + * Validate password strength + * @param {string} password - Password to validate + * @returns {Object} Validation result with strength score + */ +export function validatePassword(password) { + const result = { + isValid: false, + strength: 0, + feedback: [] + }; + + if (!password) { + result.feedback.push('Password is required'); + return result; + } + + if (password.length < 8) { + result.feedback.push('Password must be at least 8 characters long'); + } else { + result.strength += 1; + } + + if (!/[a-z]/.test(password)) { + result.feedback.push('Password must contain lowercase letters'); + } else { + result.strength += 1; + } + + if (!/[A-Z]/.test(password)) { + result.feedback.push('Password must contain uppercase letters'); + } else { + result.strength += 1; + } + + if (!/\d/.test(password)) { + result.feedback.push('Password must contain numbers'); + } else { + result.strength += 1; + } + + if (!/[!@#$%^&*(),.?":{}|<>]/.test(password)) { + result.feedback.push('Password must contain special characters'); + } else { + result.strength += 1; + } + + result.isValid = result.strength >= 3 && password.length >= 8; + return result; +} + +/** + * Initialize security on page load + */ +export function initializeSecurity() { + // Generate initial CSRF tokens + csrfManager.generateTokens(); + + // Set up security headers for all requests + if (typeof window !== 'undefined') { + // Override default fetch to include security measures + const originalFetch = window.fetch; + window.fetch = function(url, options = {}) { + return secureFetch(url, options); + }; + } +} + +/** + * Clear all security tokens (for logout) + */ +export function clearSecurityTokens() { + csrfManager.clearTokens(); + if (typeof window !== 'undefined') { + localStorage.removeItem('token'); + sessionStorage.clear(); + } +} + +// Auto-initialize on module load +if (typeof window !== 'undefined') { + // Initialize when DOM is ready + if (document.readyState === 'loading') { + document.addEventListener('DOMContentLoaded', initializeSecurity); + } else { + initializeSecurity(); + } +} + +export { csrfManager }; \ No newline at end of file diff --git a/lib/connectDB.js b/lib/connectDB.js index d3fa548..728dc11 100644 --- a/lib/connectDB.js +++ b/lib/connectDB.js @@ -35,6 +35,10 @@ if (!cached) { } async function connectDB() { + if (!MONGODB_URI) { + throw new Error('Please define the MONGODB_URI environment variable'); + } + if (cached.conn) return cached.conn; if (!cached.promise) { diff --git a/lib/csrf.js b/lib/csrf.js new file mode 100644 index 0000000..fa42b64 --- /dev/null +++ b/lib/csrf.js @@ -0,0 +1,78 @@ +import crypto from 'crypto'; + +// Generate CSRF token +export function generateCSRFToken() { + return crypto.randomBytes(32).toString('hex'); +} + +// Verify CSRF token +export function verifyCSRFToken(token, sessionToken) { + if (!token || !sessionToken) { + return false; + } + return crypto.timingSafeEqual( + Buffer.from(token, 'hex'), + Buffer.from(sessionToken, 'hex') + ); +} + +// CSRF middleware for API routes +export async function csrfProtection(req) { + const method = req.method; + + // Skip CSRF check for GET requests + if (method === 'GET') { + return { success: true }; + } + + const csrfToken = req.headers.get('x-csrf-token'); + const sessionToken = req.headers.get('x-session-token'); + + if (!csrfToken || !sessionToken) { + return { + error: 'CSRF token missing', + status: 403 + }; + } + + if (!verifyCSRFToken(csrfToken, sessionToken)) { + return { + error: 'Invalid CSRF token', + status: 403 + }; + } + + return { success: true }; +} + +// Enhanced authentication with CSRF protection +export async function authenticateWithCSRF(req) { + // First check CSRF protection + const csrfCheck = await csrfProtection(req); + if (csrfCheck.error) { + return csrfCheck; + } + + // Then check authentication + const authHeader = req.headers.get('authorization'); + + if (!authHeader || !authHeader.startsWith('Bearer ')) { + return { + error: 'Authorization token missing or malformed', + status: 401 + }; + } + + const token = authHeader.split(' ')[1]; + + try { + const jwt = await import('jsonwebtoken'); + const decoded = jwt.verify(token, process.env.JWT_SECRET); + return { user: decoded, success: true }; + } catch (error) { + return { + error: 'Invalid or expired token', + status: 401 + }; + } +} \ No newline at end of file diff --git a/lib/i18n.js b/lib/i18n.js new file mode 100644 index 0000000..8dd38eb --- /dev/null +++ b/lib/i18n.js @@ -0,0 +1,195 @@ +// Internationalization utility for NeoNest +// This provides a foundation for multi-language support + +const translations = { + en: { + // Common labels + 'name': 'Name', + 'email': 'Email', + 'password': 'Password', + 'login': 'Login', + 'signup': 'Sign Up', + 'save': 'Save', + 'cancel': 'Cancel', + 'delete': 'Delete', + 'edit': 'Edit', + 'add': 'Add', + 'update': 'Update', + 'submit': 'Submit', + 'close': 'Close', + 'back': 'Back', + 'next': 'Next', + 'previous': 'Previous', + 'loading': 'Loading...', + 'error': 'Error', + 'success': 'Success', + 'warning': 'Warning', + 'info': 'Information', + + // Medical page labels + 'vaccine_name': 'Vaccine Name', + 'vaccine_date': 'Vaccine Date', + 'next_due': 'Next Due', + 'doctor_notes': 'Doctor Notes', + 'medical_records': 'Medical Records', + 'vaccination_schedule': 'Vaccination Schedule', + + // Essentials page labels + 'item_name': 'Item Name', + 'category': 'Category', + 'quantity': 'Quantity', + 'low_stock_alert': 'Low Stock Alert', + 'baby_essentials': 'Baby Essentials', + 'add_item': 'Add Item', + + // Feeding page labels + 'feeding_time': 'Feeding Time', + 'amount': 'Amount', + 'feeding_type': 'Feeding Type', + 'notes': 'Notes', + 'feeding_log': 'Feeding Log', + + // Sleep page labels + 'sleep_start': 'Sleep Start', + 'sleep_end': 'Sleep End', + 'duration': 'Duration', + 'sleep_quality': 'Sleep Quality', + 'sleep_log': 'Sleep Log', + + // Growth page labels + 'weight': 'Weight', + 'height': 'Height', + 'head_circumference': 'Head Circumference', + 'growth_chart': 'Growth Chart', + 'milestone': 'Milestone', + + // Lullaby page labels + 'play': 'Play', + 'pause': 'Pause', + 'volume': 'Volume', + 'playlist': 'Playlist', + + // Contact labels + 'emergency_contact': 'Emergency Contact', + 'pediatrician': 'Pediatrician', + 'hospital': 'Hospital', + 'pharmacy': 'Pharmacy' + }, + + // Add more languages as needed + es: { + 'name': 'Nombre', + 'email': 'Correo electrónico', + 'password': 'Contraseña', + 'login': 'Iniciar sesión', + 'signup': 'Registrarse', + 'save': 'Guardar', + 'cancel': 'Cancelar', + // ... add more Spanish translations + }, + + hi: { + 'name': 'नाम', + 'email': 'ईमेल', + 'password': 'पासवर्ड', + 'login': 'लॉगिन', + 'signup': 'साइन अप', + 'save': 'सेव करें', + 'cancel': 'रद्द करें', + // ... add more Hindi translations + } +}; + +// Default language +let currentLanguage = 'en'; + +/** + * Set the current language + * @param {string} language - Language code (e.g., 'en', 'es', 'hi') + */ +export function setLanguage(language) { + if (translations[language]) { + currentLanguage = language; + // Store in localStorage for persistence + if (typeof window !== 'undefined') { + localStorage.setItem('neonest_language', language); + } + } +} + +/** + * Get the current language + * @returns {string} Current language code + */ +export function getCurrentLanguage() { + return currentLanguage; +} + +/** + * Initialize language from localStorage or browser preference + */ +export function initializeLanguage() { + if (typeof window !== 'undefined') { + // Try to get from localStorage first + const savedLanguage = localStorage.getItem('neonest_language'); + if (savedLanguage && translations[savedLanguage]) { + currentLanguage = savedLanguage; + return; + } + + // Fall back to browser language + const browserLanguage = navigator.language.split('-')[0]; + if (translations[browserLanguage]) { + currentLanguage = browserLanguage; + } + } +} + +/** + * Translate a key to the current language + * @param {string} key - Translation key + * @param {string} fallback - Fallback text if translation not found + * @returns {string} Translated text + */ +export function t(key, fallback = key) { + const translation = translations[currentLanguage]?.[key]; + return translation || fallback; +} + +/** + * Get all available languages + * @returns {Array} Array of language objects with code and name + */ +export function getAvailableLanguages() { + return [ + { code: 'en', name: 'English' }, + { code: 'es', name: 'Español' }, + { code: 'hi', name: 'हिंदी' } + ]; +} + +/** + * Check if a language is supported + * @param {string} language - Language code to check + * @returns {boolean} Whether the language is supported + */ +export function isLanguageSupported(language) { + return !!translations[language]; +} + +/** + * Add translations for a specific language + * @param {string} language - Language code + * @param {Object} newTranslations - Object with translation key-value pairs + */ +export function addTranslations(language, newTranslations) { + if (!translations[language]) { + translations[language] = {}; + } + translations[language] = { ...translations[language], ...newTranslations }; +} + +// Initialize language on module load +if (typeof window !== 'undefined') { + initializeLanguage(); +} \ No newline at end of file diff --git a/lib/security.js b/lib/security.js new file mode 100644 index 0000000..dec9fa5 --- /dev/null +++ b/lib/security.js @@ -0,0 +1,269 @@ +import { csrfProtection, generateCSRFToken } from './csrf.js'; +import { validateURL, safeFetch } from './urlValidator.js'; +import { validateInput } from './auth.js'; + +/** + * Comprehensive security middleware for API routes + * Combines CSRF protection, input validation, and rate limiting + */ +export class SecurityMiddleware { + constructor() { + this.rateLimitMap = new Map(); + this.maxRequestsPerMinute = 60; + this.blockDuration = 15 * 60 * 1000; // 15 minutes + } + + /** + * Rate limiting implementation + * @param {string} identifier - IP address or user ID + * @returns {Object} Rate limit result + */ + checkRateLimit(identifier) { + const now = Date.now(); + const windowStart = now - 60000; // 1 minute window + + if (!this.rateLimitMap.has(identifier)) { + this.rateLimitMap.set(identifier, []); + } + + const requests = this.rateLimitMap.get(identifier); + + // Remove old requests outside the window + const recentRequests = requests.filter(timestamp => timestamp > windowStart); + this.rateLimitMap.set(identifier, recentRequests); + + // Check if rate limit exceeded + if (recentRequests.length >= this.maxRequestsPerMinute) { + return { + allowed: false, + error: 'Rate limit exceeded. Please try again later.', + retryAfter: 60 + }; + } + + // Add current request + recentRequests.push(now); + return { allowed: true }; + } + + /** + * Sanitize request body to prevent XSS and injection attacks + * @param {Object} body - Request body object + * @returns {Object} Sanitized body + */ + sanitizeRequestBody(body) { + if (!body || typeof body !== 'object') { + return body; + } + + const sanitized = {}; + + for (const [key, value] of Object.entries(body)) { + if (typeof value === 'string') { + // Remove HTML tags and dangerous characters + sanitized[key] = value + .replace(/<[^>]*>/g, '') // Remove HTML tags + .replace(/[<>\"'&]/g, (match) => { + const entities = { + '<': '<', + '>': '>', + '"': '"', + "'": ''', + '&': '&' + }; + return entities[match] || match; + }) + .trim(); + } else if (Array.isArray(value)) { + sanitized[key] = value.map(item => + typeof item === 'string' ? this.sanitizeRequestBody({ temp: item }).temp : item + ); + } else if (typeof value === 'object' && value !== null) { + sanitized[key] = this.sanitizeRequestBody(value); + } else { + sanitized[key] = value; + } + } + + return sanitized; + } + + /** + * Validate request headers for security + * @param {Request} req - Request object + * @returns {Object} Validation result + */ + validateHeaders(req) { + const contentType = req.headers.get('content-type'); + const userAgent = req.headers.get('user-agent'); + const origin = req.headers.get('origin'); + + // Check for suspicious user agents + if (userAgent && /bot|crawler|spider|scraper/i.test(userAgent)) { + return { + valid: false, + error: 'Automated requests not allowed' + }; + } + + // Validate content type for POST/PUT requests + if (['POST', 'PUT', 'PATCH'].includes(req.method)) { + if (!contentType || !contentType.includes('application/json')) { + return { + valid: false, + error: 'Invalid content type' + }; + } + } + + return { valid: true }; + } + + /** + * Main security check function + * @param {Request} req - Request object + * @returns {Object} Security check result + */ + async performSecurityChecks(req) { + try { + // Get client identifier (IP address) + const clientIP = req.headers.get('x-forwarded-for') || + req.headers.get('x-real-ip') || + 'unknown'; + + // Rate limiting + const rateLimitResult = this.checkRateLimit(clientIP); + if (!rateLimitResult.allowed) { + return { + passed: false, + status: 429, + error: rateLimitResult.error, + headers: { + 'Retry-After': rateLimitResult.retryAfter.toString() + } + }; + } + + // Header validation + const headerValidation = this.validateHeaders(req); + if (!headerValidation.valid) { + return { + passed: false, + status: 400, + error: headerValidation.error + }; + } + + // CSRF protection for state-changing requests + if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method)) { + const csrfResult = await csrfProtection(req); + if (csrfResult.error) { + return { + passed: false, + status: csrfResult.status || 403, + error: csrfResult.error + }; + } + } + + return { passed: true }; + } catch (error) { + console.error('Security check error:', error); + return { + passed: false, + status: 500, + error: 'Security validation failed' + }; + } + } + + /** + * Secure API wrapper that applies all security measures + * @param {Function} handler - Original API handler + * @returns {Function} Secured API handler + */ + secureAPI(handler) { + return async (req) => { + try { + // Perform security checks + const securityResult = await this.performSecurityChecks(req); + + if (!securityResult.passed) { + return Response.json( + { error: securityResult.error }, + { + status: securityResult.status, + headers: securityResult.headers || {} + } + ); + } + + // Sanitize request body if present + if (req.body) { + const body = await req.json(); + const sanitizedBody = this.sanitizeRequestBody(body); + + // Create new request with sanitized body + const sanitizedReq = new Request(req.url, { + method: req.method, + headers: req.headers, + body: JSON.stringify(sanitizedBody) + }); + + return await handler(sanitizedReq); + } + + return await handler(req); + } catch (error) { + console.error('Secure API error:', error); + return Response.json( + { error: 'Internal server error' }, + { status: 500 } + ); + } + }; + } +} + +// Create singleton instance +const securityMiddleware = new SecurityMiddleware(); + +/** + * Easy-to-use security wrapper for API routes + * @param {Function} handler - API route handler + * @returns {Function} Secured handler + */ +export function withSecurity(handler) { + return securityMiddleware.secureAPI(handler); +} + +/** + * Generate CSRF token for client-side use + * @returns {string} CSRF token + */ +export function getCSRFToken() { + return generateCSRFToken(); +} + +/** + * Validate and sanitize user input + * @param {any} input - Input to validate + * @param {string} type - Expected type + * @param {number} maxLength - Maximum length for strings + * @returns {boolean} Whether input is valid + */ +export function validateAndSanitizeInput(input, type = 'string', maxLength = 1000) { + return validateInput(input, type, maxLength); +} + +/** + * Safe external request wrapper + * @param {string} url - URL to fetch + * @param {Object} options - Fetch options + * @returns {Promise} Fetch response + */ +export async function makeSecureRequest(url, options = {}) { + return await safeFetch(url, options); +} + +export { validateURL, securityMiddleware }; \ No newline at end of file diff --git a/lib/urlValidator.js b/lib/urlValidator.js new file mode 100644 index 0000000..242f664 --- /dev/null +++ b/lib/urlValidator.js @@ -0,0 +1,130 @@ +import { URL } from 'url'; + +// Allowed domains for external requests +const ALLOWED_DOMAINS = [ + 'api.openai.com', + 'generativelanguage.googleapis.com', + 'cloudinary.com', + 'res.cloudinary.com', + 'api.cloudinary.com' +]; + +// Blocked IP ranges (private networks) +const BLOCKED_IP_RANGES = [ + /^127\./, // localhost + /^10\./, // private class A + /^172\.(1[6-9]|2[0-9]|3[0-1])\./, // private class B + /^192\.168\./, // private class C + /^169\.254\./, // link-local + /^::1$/, // IPv6 localhost + /^fc00:/, // IPv6 private + /^fe80:/ // IPv6 link-local +]; + +/** + * Validates if a URL is safe for external requests + * @param {string} urlString - The URL to validate + * @returns {Object} - {isValid: boolean, error?: string, url?: URL} + */ +export function validateURL(urlString) { + try { + if (!urlString || typeof urlString !== 'string') { + return { isValid: false, error: 'Invalid URL format' }; + } + + // Basic URL validation + const url = new URL(urlString); + + // Only allow HTTPS for external requests + if (url.protocol !== 'https:') { + return { isValid: false, error: 'Only HTTPS URLs are allowed' }; + } + + // Check if domain is in allowed list + const hostname = url.hostname.toLowerCase(); + const isAllowedDomain = ALLOWED_DOMAINS.some(domain => + hostname === domain || hostname.endsWith('.' + domain) + ); + + if (!isAllowedDomain) { + return { isValid: false, error: 'Domain not in allowed list' }; + } + + // Check for blocked IP ranges + const isBlockedIP = BLOCKED_IP_RANGES.some(range => range.test(hostname)); + if (isBlockedIP) { + return { isValid: false, error: 'Access to private networks is not allowed' }; + } + + // Additional security checks + if (url.username || url.password) { + return { isValid: false, error: 'URLs with credentials are not allowed' }; + } + + return { isValid: true, url }; + } catch (error) { + return { isValid: false, error: 'Invalid URL format' }; + } +} + +/** + * Safe fetch wrapper with URL validation + * @param {string} url - The URL to fetch + * @param {Object} options - Fetch options + * @returns {Promise} - Fetch response or error + */ +export async function safeFetch(url, options = {}) { + const validation = validateURL(url); + + if (!validation.isValid) { + throw new Error(`URL validation failed: ${validation.error}`); + } + + // Add security headers and timeout + const secureOptions = { + ...options, + headers: { + 'User-Agent': 'NeoNest/1.0', + ...options.headers + }, + // Add timeout to prevent hanging requests + signal: AbortSignal.timeout(30000) // 30 seconds + }; + + try { + const response = await fetch(validation.url.toString(), secureOptions); + return response; + } catch (error) { + if (error.name === 'TimeoutError') { + throw new Error('Request timeout'); + } + throw error; + } +} + +/** + * Sanitize and validate file upload URLs + * @param {string} url - The upload URL + * @returns {Object} - Validation result + */ +export function validateUploadURL(url) { + const validation = validateURL(url); + + if (!validation.isValid) { + return validation; + } + + // Additional checks for upload URLs + const allowedUploadDomains = ['cloudinary.com', 'res.cloudinary.com', 'api.cloudinary.com']; + const hostname = validation.url.hostname.toLowerCase(); + + const isAllowedUpload = allowedUploadDomains.some(domain => + hostname === domain || hostname.endsWith('.' + domain) + ); + + if (!isAllowedUpload) { + return { isValid: false, error: 'Upload domain not allowed' }; + } + + return validation; +} \ No newline at end of file diff --git a/next.config.mjs b/next.config.mjs index f5cbc38..653b47d 100644 --- a/next.config.mjs +++ b/next.config.mjs @@ -8,6 +8,20 @@ const nextConfig = { }, images: { unoptimized: true, + domains: ['res.cloudinary.com'], + }, + serverExternalPackages: ['mongoose'], + env: { + MONGODB_URI: process.env.MONGODB_URI || 'mongodb://localhost:27017/neonest', + NEXTAUTH_SECRET: process.env.NEXTAUTH_SECRET || 'fallback-secret', + NEXTAUTH_URL: process.env.NEXTAUTH_URL || 'http://localhost:3000', + }, + webpack: (config) => { + config.externals.push({ + 'utf-8-validate': 'commonjs utf-8-validate', + 'bufferutil': 'commonjs bufferutil', + }); + return config; }, } diff --git a/tailwind.config.js b/tailwind.config.js index 985e68a..b41e808 100644 --- a/tailwind.config.js +++ b/tailwind.config.js @@ -1,5 +1,4 @@ -const plugin = require("tailwindcss/plugin"); - +/** @type {import('tailwindcss').Config} */ module.exports = { darkMode: ["class"], content: [ @@ -83,5 +82,7 @@ module.exports = { }, }, }, - plugins: [require("tailwindcss-animate")], + plugins: [ + require("tailwindcss-animate") + ], }; diff --git a/vercel.json b/vercel.json new file mode 100644 index 0000000..f16d292 --- /dev/null +++ b/vercel.json @@ -0,0 +1,7 @@ +{ + "version": 2, + "buildCommand": "npm run build", + "outputDirectory": ".next", + "framework": "nextjs", + "installCommand": "npm install" +} \ No newline at end of file
No lullabies found. Let's add some magic!
No notifications yet
We'll notify you about important updates