Fix potential DoS

[duggalsu]

• Added upload file size limits
• This fixes https://github.com/tattle-made/security/issues/14

[ghost]

👇 Click on the image for a new way to code review

Legend

[dennyabrain]

Thanks. Will take me some time to test this. Will keep you posted.

[duggalsu]

@dennyabrain There is a limit of 8mb file size now. So if you try uploading an image greater than 8mb, it should fail

[dennyabrain]

really cool :)
I still need to check the API, right? or were you able to verify this works?

[duggalsu]

No, I can't test this from my end. You will have to test this.

[dennyabrain]

@aatmanvaidya We need to test this code block basically :

Uli/browser-extension/api-server/index.js

Lines 120 to 161 in 93eab95

	app.post("/archive", upload.single("screenshot"), async (req, res) => {
	console.log("archive POST request");
	try {
	const fileName = req.file.key;
	const s3URL = req.file.location;
	const { url } = req.body;
	const user = req.user;
	await post.create({
	userId: user.id,
	sourceUrl: url,
	permanentUrl: null,
	tags: null,
	screenshot: fileName,
	});
	const result = await preference.findOne({
	where: {
	userId: user.id,
	},
	});
	resultPlain = result.get({ plain: true });
	resultPlain = { ...resultPlain, email: decrypt(resultPlain.email) };
	console.log({ resultPlain });
	if (
	(result != null && resultPlain.email != undefined) ||
	resultPlain.email != null
	) {
	await sendArchiveEmail(
	resultPlain.email,
	url,
	`https://uli-media.tattle.co.in/${fileName}`
	);
	}
	res.send({ msg: "Tweet Archived" });
	} catch (err) {
	res.status(501).send({ msg: "Error archiving tweet" });
	}
	});

its an POST endpoint called /archive
This allows us to send an image. This handler also uploads this image to aws S3 and sends an email using aws SES. So this exercise will be helpful for you to get used to those services. Just follow the code in this function to get a working understanding of the services. I will share the credentials you have to use

@duggalsu can you share the cURL command here we came up with here?

[duggalsu]

@dennyabrain Here is the curl command

$ curl -v -H "Authorization: token <ACTUAL-TOKEN>" -H "Content-Type: multipart/form-data" -F url="anything" -F screenshot="screenshot.png" localhost:3000/archive

You can get the accessToken by running this command

$ curl GET http://localhost:3000/auth/register

[dennyabrain]

We learnt that multer multipart upload doesn't play well with curl - expressjs/multer#666
we were able to test using Hoppscotch that the 8mb file limit is indeed respected.

Closing this.