EVOLUTION-MANAGER

Edit File: http_lint.lua

--
-- (C) 2017-24 - ntop.org
--

local clock_start = os.clock()

local dirs = ntop.getDirs()
package.path = dirs.installdir .. "/scripts/lua/modules/?.lua;" .. package.path

local http_lint = {}

local json = require "dkjson"
local tracker = require "tracker"
local locales_utils = require "locales_utils"
require "ntop_utils"

-- #################################################################

-- TRACKER HOOK (ntop.*, interface.*)

tracker.track_ntop()
tracker.track_interface()

-- #################################################################

-- UTILITY FUNCTIONS

function starts(String, Start)
   if ((String == nil) or (Start == nil)) then
      return (false)
   end

return string.sub(String, 1, string.len(Start)) == Start
end

-- Searches into the keys of the table
local function validateChoiceByKeys(defaults, v)
   if defaults[v] ~= nil then
      return true
   else
      return false
   end
end

-- Placeholder for pcap file validation
local function validatePcap(defaults, v)
   return true
end

-- Searches into the value of the table
-- Optional key can be used to access fields of the array element
local function validateChoice(defaults, v, key)
   for _, d in pairs(defaults) do
      if key ~= nil then
	 if d[key] == v then
	    return true
	 end
      else
	 if d == v then
	    return true
	 end
      end
   end

return false
end

local function validateChoiceInline(choices)
   return function(choice)
      if (validateChoice(choices, choice)) then
	 return true
      else
	 return false
      end
   end
end
http_lint.validateChoiceInline = validateChoiceInline

local function validateListOfType(l, validate_callback, separator)
   local separator = separator or ","

if (isEmptyString(l) or (l == "-1")) then
      return true
   end

local items = split(l, separator)

for _, item in pairs(items) do
      if item and item ~= "" then
	 if not validate_callback(item) then
	    return false
	 end
      end
   end

return true
end

local function validateEmpty(s)
   if s == "" then
      return true
   else
      return false
   end
end

local function validateEmptyOr(other_validation)
   return function(s)
      if (validateEmpty(s) or other_validation(s)) then
	 return true
      else
	 return false
      end
   end
end
http_lint.validateEmptyOr = validateEmptyOr

-- #################################################################

-- FRONT-END VALIDATORS

local function validateSNMPIfidNumber(p)
   -- integer SNMP Ifid validation

if p == "*" then
      return true
   end

local num = tonumber(p)

if (num == nil) then
      return false
   end

if math.floor(num) == num then
      return true
   else
      -- this is a float number
      return false
   end
end
http_lint.validateSNMPIfidNumber = validateSNMPIfidNumber

-- #################################################################

-- FRONT-END VALIDATORS

local function validateNumber(p)
   -- integer number validation
   local num = tonumber(p)

if (num == nil) then
      return false
   end

if math.floor(num) == num then
      return true
   else
      -- this is a float number
      return false
   end
end
http_lint.validateNumber = validateNumber

-- #################################################################

-- FRONT-END VALIDATORS

local function validateVlan(p)
   -- integer number validation
   if (validateNumber(p)) then
      local num = tonumber(p)
      if (-1 <= num and num < 4095) then
	 return true
      end
   end

return false
end
http_lint.validateVlan = validateVlan

-- ##############################################

local function validateFloat(p)
   -- integer number validation
   local num = tonumber(p)

if (num == nil) then
      return false
   end

return true
end

-- ##############################################

local function validateSyslogFormat(p)
   if p == "plaintext" or p == "plaintextrfc" or p == "json" or p == "ecs" or p == "checkmk" then
      return true
   end

return false
end
http_lint.validateSyslogFormat = validateSyslogFormat

-- ##############################################

local function validateHostInfoType(p)
   if p == "minimal_one_host" or p == "minimal_all_host" or p == "more_one_host" or p == "more_all_host" then
      return true
   end

return false
end

local function validateFlowType(p)
   if p == "peers" or p == "description" then
      return true
   end

return false
end

local function validateInterfaceType(p)
   if p == "show" then
      return true
   end

return false
end

local function validatePort(p)
   local items = split(p, "/")

if(items == nil) then
      return false
   else
      p = items[1]

if(items[2] ~= nil) then
	 if((items[2] == "tcp") or (items[2] == "udp")) then
	    -- Good: example 80/tcp
	 else
	    return false
	 end
      end
   end

if not validateNumber(p) then
      return false
   end

local n = tonumber(p)
   if ((n ~= nil) and (n >= 0) and (n <= 65535)) then
      return true
   else
      return false
   end
end
http_lint.validatePort = validatePort

-- ##############################################
local function validateASN(p)
   -- Unique case in which the asn has 'No ASN' as value
   return (validateNumber(p) or p == "No ASN")
end

local function validateUnquoted(p)
   -- This function only verifies that value does not contain single quotes, but
   -- does not perform any type validation, so it should be used with care.
   -- Double quotes are already handled by the C side.
   if (string.find(p, "'") ~= nil) then
      return false
   else
      return true
   end
end
http_lint.validateUnquoted = validateUnquoted

local function validateLuaScriptPath(p)
   local os_utils = require("os_utils")

if (string.find(p, "'") ~= nil) then
      return false
   end
   return (starts(p, os_utils.getPathDivider() .. "scripts"))
end
http_lint.validateLuaScriptPath = validateLuaScriptPath

local function validateUploadedFile(p)
   local os_utils = require("os_utils")
   local dirs = ntop.getDirs()

return (starts(p, dirs.workingdir .. os_utils.getPathDivider() .. "tmp" .. os_utils.getPathDivider() .. "upload"))
end
http_lint.validateLuaScriptPath = validateLuaScriptPath

local function validateUnchecked(p)
   -- This function does not perform any validation, so only the C side validation takes place.
   -- In particular, single quotes are allowed so they must be handled explicitly by the programmer in
   -- order to avoid injection.
   return true
end
http_lint.validateUnchecked = validateUnchecked

local function validateAuthProto(p)
   return (p == "pap" or p == "chap")
end
http_lint.validateAuthProto = validateAuthProto

local function validateSingleWord(w)
   if (string.find(w, "% ") ~= nil) then
      return false
   else
      return validateUnquoted(w)
   end
end
http_lint.validateSingleWord = validateSingleWord

-- ##############################################

-- @brief Returns true if inputstr is inside alert, function used to check
--        if the filter is right or not
local function validateScriptFilter(inputstr)
   inputstr = inputstr:gsub(" ", "")
   return validateListOfType(inputstr, validateSingleWord)
end
http_lint.validateScriptFilter = validateScriptFilter

-- ##############################################

local function validateMessage(w)
   return true
end
http_lint.validateSingleWord = validateMessage

local function validateSingleAlphanumericWord(w)
   if (w:match("%W")) then
      return false
   else
      return validateSingleWord(w)
   end
end

local function validateTrafficRecordingProvider(w)
   if w == "ntopng" or (w:starts("n2disk@") and validateSingleWord(w)) then
      return true
   end

return false
end

local function validateUsername(p)
   -- A username (e.g. used in ntopng authentication)
   return (validateSingleWord(p))
end

local function licenseCleanup(p)
   return p -- don't touch passwords (checks against valid fs paths already performed)
end

local function passwordCleanup(p)
   return p -- don't touch passwords (checks against valid fs paths already performed)
end

local function webhookCleanup(p)
   local allowed_prefixes = {"https://", "http://"}

for _, prefix in pairs(allowed_prefixes) do
      if p and p:match("^" .. prefix) then
	 -- Only allow the prefix to go through unpurified
	 local purified = prefix .. ntop.httpPurifyParam(p:gsub("^" .. prefix, ''))

return purified
      end
   end

-- If there's no matching prefix, purify everything
   return ntop.httpPurifyParam(p)
end
http_lint.webhookCleanup = webhookCleanup

local function jsonCleanup(json_payload)
   -- can't touch the json payload or it could be broken
   return json_payload
end

local function whereCleanup(p)
   -- SQL where
   -- A-Za-z0-9!=<>()
   return (p:gsub('%W><!()', '_'))
end

-- NOTE: keep in sync with getLicensePattern()
local function validateLicense(p)
   return string.match(p, "[%l%u%d/+=]+") == p or validateEmpty(p)
end

local function validatePassword(p)
   -- A password (e.g. used in ntopng authentication)
   return true
end

local function validateAbsolutePath(p)
   -- An absolute path. Let it pass for now
   return validateUnquoted(p)
end

local function validateNumMinutes(m)
   return (m == "custom") or validateNumber(m)
end

local function validateJSON(j)
   if(j == "") then return true end
   return (json.decode(j) ~= nil)
end

local function validateMeasurement(p)
   --[[ FIXX include loop check (pragma_once_checks)
      local am_utils = require "am_utils"

if am_utils then
      local available_measurements = am_utils.getMeasurementsInfo()

return(available_measurements[p] ~= nil)
      end

return(false)
   --]]
   return validateSingleWord(p)
end

-- #################################################################

local function validateOnOff(mode)
   local modes = {"on", "off"}