Merge pull request #272 from italia/fix-metadata-url-check

fix: add metadata url check
italia · Jan 11, 2024 · 61aa66e · 61aa66e
2 parents 414e2b7 + 7b3165f
commit 61aa66e
Show file tree

Hide file tree

Showing 3 changed files with 39 additions and 3 deletions.
diff --git a/spid-validator/server/lib/utils.js b/spid-validator/server/lib/utils.js
@@ -1,5 +1,6 @@
 const url = require("url");
 const path = require("path");
+const https = require("https");
 const CircularJSON = require("circular-json");
 const child_process = require('child_process');
 const UUID = require("uuidjs");
@@ -56,6 +57,19 @@ class Utils {
 
     static metadataDownload(src, dest) {
         return new Promise((resolve, reject) => {
+
+            // check if URL is valid
+            if(!this.isValidUrl(src)) {
+                return reject("Inserire una URL valida");
+            }
+
+            // check if URL exists
+            https.get(src, (res) => {
+                if(res.statusCode!='200') {
+                    return reject("Metadata non trovato alla URL indicata");
+                }
+            })
+
             const file_name = url.parse(src).pathname.split('/').pop();
             const file_extention = path.extname(file_name);
             const cmd = 'wget -O "' + dest + '" "' + src + '" --no-check-certificate --no-cache --no-cookies  --user-agent="Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0"';   
@@ -211,6 +225,20 @@ class Utils {
       });
       return fileArray;
   }
+
+  static isValidUrl(str) {
+    const pattern = new RegExp(
+      '^([a-zA-Z]+:\\/\\/)?' + // protocol
+        '((([a-z\\d]([a-z\\d-]*[a-z\\d])*)\\.)+[a-z]{2,}|' + // domain name
+        '((\\d{1,3}\\.){3}\\d{1,3}))' + // OR IP (v4) address
+        '(\\:\\d+)?(\\/[-a-z\\d%_.~+]*)*' + // port and path
+        '(\\?[;&a-z\\d%_.~+=-]*)?' + // query string
+        '(\\#[-a-z\\d_]*)?$', // fragment locator
+      'i'
+    );
+    return pattern.test(str);
+  }
+
 }
 
 module.exports = Utils;
diff --git a/spid-validator/server/npm-shrinkwrap.json_original b/spid-validator/server/npm-shrinkwrap.json_original
diff --git a/spid-validator/server/package.json b/spid-validator/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "spid-validator",
-  "version": "1.10.4",
+  "version": "1.10.5",
   "description": "Tool for validating Service Provider compliance to SPID response from Identity Provider",
   "main": "spid-validator",
   "author": "Michele D'Amico (damikael) - AgID",
@@ -26,8 +26,9 @@
     "unzip": "^0.1.11",
     "upload": "^1.3.2",
     "uuidjs": "^4.0.3",
-    "xml-encryption": "^0.11.1",
-    "xmlbuilder": "^9.0.7",
+    "xml-encryption": "^3.0.2",
+    "xmlbuilder": "^15.1.1",
+    "xmldom": "^0.6.0",
     "xpath": "0.0.27",
     "xpath.js": "^1.1.0"
   }