보안?

보안의 기본을 배웠당

var http = require('http');
var fs = require('fs');
var url = require('url');
var qs = require('querystring');
var template = require('./lib/template.js')
var path = require('path')
var sanitizeHtml = require('sanitize-html')


var app = http.createServer(function(request,response){
    var _url = request.url;
    var queryData = url.parse(_url, true).query;
    var pathname = url.parse(_url, true).pathname;
    if(pathname === '/'){
      if(queryData.id === undefined){
        fs.readdir('./data', function(error, filelist){
          var title = 'Welcome';
          var description = 'Hello, Node.js';
          var list = template.list(filelist);
          var html = template.HTML(title, list, `<h2>${title}</h2>${description}`,`<a href="/create">create</a>`);
          response.writeHead(200);
          response.end(html);
        });
      } else {
        fs.readdir('./data', function(error, filelist){
          
          //path를 parse하여 그중 base만을 이용한다. 이렇게 하면, ../**을 다양한 접근에 의해
          //내가 원치않는 디렉토리에 대한 접근을 막을 수 있었다. 
          var filter = path.parse(queryData.id).base
          fs.readFile(`data/${filter}`, 'utf8', function(err, description){
            var title = queryData.id;
            var list = template.list(filelist);
            
            //npm의 모듈인 sanitize-html을 사용하여 화면에 출력되는 것들을 sanitize하였다. 따라서
            //<'blabla'>형태의 입력을 차단시켰다. <h1>과 같은 태그는 기본적으로 allowed 되어있었다
            var sanitizedtitle = sanitizeHtml(title);
            var sanitizeddes = sanitizeHtml(description);
            var html = template.HTML(title, list, `<h2>${sanitizedtitle}</h2>${sanitizeddes}`,
              `<a href="/create">create</a>
               <a href='/update?id=${sanitizedtitle}'>update</a>
               <form action = 'delete_process' method='post'>
                <input type = 'hidden' name = 'id' value = '${sanitizedtitle}'>
                <input type=  'submit' value = 'delete'>
               </form>
               `
          );
            response.writeHead(200);
            response.end(html);
          });
        });
      }
    } else if(pathname === '/create'){
      fs.readdir('./data', function(error, filelist){
        var title = 'WEB - create';
        var list = template.list(filelist);
        var html = template.HTML(title, list, `
          <form action="/create_process" method="post">
            <p><input type="text" name="title" placeholder="title"></p>
            <p>
              <textarea name="description" placeholder="description"></textarea>
            </p>
            <p>
              <input type="submit">
            </p>
          </form>
        `,'');
        response.writeHead(200);
        response.end(html);
      });
    } else if(pathname === '/create_process'){
      var body = '';
      request.on('data', function(data){
          body = body + data;
      });
      request.on('end', function(){
          var post = qs.parse(body);
          var title = post.title;
          var description = post.description;
          var filter = path.parse(title).base
          fs.writeFile(`data/${filter.trim()}`, description, 'utf8', function(err){
            response.writeHead(302, {'Location': `/?id=${qs.escape(title)}`});
            response.end();
          })
      });
    } else if(pathname === '/update'){
      fs.readdir('./data', function(error, filelist){
        var filter = path.parse(queryData.id).base
        fs.readFile(`data/${filter}`, 'utf8', function(err, description){
          var title = queryData.id;
          var list = template.list(filelist);
          var html = template.HTML(title, list,
            `
            <form action="/update_process" method="post">
              <input type = 'hidden' name = 'id' value = '${title}'
              <p><input type="text" name="title" placeholder="title" value = '${title}'></p>
              <p>
                <textarea name="description" >${description}</textarea>
              </p>
              <p>
                <input type="submit">
              </p>
            </form>
            `,
            `<a href="/create">create</a> <a href='/update?id=${title}'>update</a>`
          );
          response.writeHead(200);
          response.end(html);
        });
      });
    } else if(pathname === '/update_process'){
      var body = '';
      request.on('data', function(data){
          body = body + data;
      });
      request.on('end', function(){
          var post = qs.parse(body);
          var title = post.title;
          var id = post.id;
          var filter = path.parse(id).base
          var filter2 = path.parse(title).base
          var description = post.description;
          fs.rename(`./data/${filter}`,`./data/${filter2}`,function(err){
            fs.writeFile(`data/${filter2}`, description, 'utf8', function(err){
              response.writeHead(302, {'Location': `/?id=${qs.escape(title)}`});
              response.end();
            });
          });
        });
    } else if (pathname === '/delete_process'){
      var body = '';
      request.on('data', function(data){
          body = body + data;
      });
      request.on('end', function(){
          var post = qs.parse(body);
          var id = post.id;
          var filter = path.parse(id).base

          fs.unlink(`./data/${filter}`,function(err){
            response.writeHead(302, {'Location': `/`});
            response.end();
          });
      });
    } else {
      response.writeHead(404);
      response.end('Not found');
    }
});
app.listen(4000);