Validation work

2025-04-22 20:25:26 -04:00
parent 024280e96d
commit 0c657ae1c5
8 changed files with 225 additions and 134 deletions
@@ -8,7 +8,6 @@ import (
 	"log"
 	"net/http"
 	"path/filepath"
-	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -131,23 +130,42 @@ func main() {
 		slug := chi.URLParam(r, "slug")
 		ip := util.GetIP(r)

-		timeRemaining := util.IsOnCooldown(ip, util.ThreadCooldowns, util.THREAD_COOLDOWN)
+		// check cooldown
+		timeRemaining := util.GetRemainingCooldown(ip, util.ThreadCooldowns, util.THREAD_COOLDOWN)
 		if timeRemaining > 0 {
-			response := fmt.Sprintf("Please wait %.0f seconds.", timeRemaining.Seconds())
+			response := fmt.Sprintf("Please wait %.0f seconds", timeRemaining.Seconds())
 			io.Copy(io.Discard, r.Body)
 			http.Error(w, response, http.StatusTooManyRequests)
 			return
 		}

+		// parse form
+		r.Body = http.MaxBytesReader(w, r.Body, util.MAX_REQUEST_BYTES)
 		if err := r.ParseMultipartForm(util.FILE_MEM_LIMIT); err != nil {
 			http.Error(w, "Failed to parse form", http.StatusBadRequest)
 			log.Printf("ParseMultipartForm: %v", err)
 			return
 		}

-		subject := r.FormValue("subject")
+		// validate inputs
+		subject := strings.ReplaceAll(strings.TrimSpace(r.FormValue("subject")), "\n", "")
 		body := strings.TrimSpace(r.FormValue("body"))

+		if len(subject) > util.MAX_SUBJECT_LEN {
+			http.Error(w, fmt.Sprintf("Subject exceeds %d characters", util.MAX_BODY_LEN), http.StatusBadRequest)
+			return
+		}
+
+		if body == "" {
+			http.Error(w, "Body is empty", http.StatusBadRequest)
+			return
+		}
+
+		if len(body) > util.MAX_BODY_LEN {
+			http.Error(w, fmt.Sprintf("Body exceeds %d characters", util.MAX_BODY_LEN), http.StatusBadRequest)
+			return
+		}
+
 		file, header, err := r.FormFile("file")
 		if err != nil {
 			http.Error(w, "Failed to retrive file from form", http.StatusBadRequest)
@@ -156,16 +174,32 @@ func main() {
 		}
 		defer file.Close()

-		isFileVideo, err := util.IsFileVideo(file)
+		if header.Size > util.FILE_MEM_LIMIT {
+			http.Error(w, "File too large (max 10 MB)", http.StatusRequestEntityTooLarge)
+			return
+		}
+
+		isMediaTooLarge, err := util.IsMediaTooLarge(file)
+		if err != nil {
+			http.Error(w, "Failed to detect if file is too large", http.StatusInternalServerError)
+			return
+		}
+		file.Seek(0, io.SeekStart)
+
+		if isMediaTooLarge {
+			http.Error(w, "File too large (max 10MB)", http.StatusRequestEntityTooLarge)
+			return
+		}
+
+		mediaType, err := util.DetectPostFileType(file)
 		if err != nil {
 			http.Error(w, "Failed to detect if file is a video", http.StatusInternalServerError)
 			return
 		}
+		file.Seek(0, io.SeekStart)

-		fileExt := strings.ToLower(filepath.Ext(header.Filename))
-
-		if isFileVideo && !slices.Contains(util.SUPPORTED_VID_FORMATS, fileExt) {
-			http.Error(w, "Unsupported file format", http.StatusBadRequest)
+		if mediaType == util.PostFileUnsupported {
+			http.Error(w, "Unsupported media type", http.StatusBadRequest)
 			return
 		}

@@ -182,6 +216,8 @@ func main() {
 			log.Printf("PutThread: %v", err)
 			return
 		}
+
+		util.BeginCooldown(ip, util.ThreadCooldowns, util.THREAD_COOLDOWN)
 	})

 	// CREATE POST
@@ -189,26 +225,35 @@ func main() {
 		slug := chi.URLParam(r, "slug")
 		ip := util.GetIP(r)

-		timeRemaining := util.IsOnCooldown(ip, util.PostCooldowns, util.POST_COOLDOWN)
+		// check cooldown
+		timeRemaining := util.GetRemainingCooldown(ip, util.PostCooldowns, util.POST_COOLDOWN)
 		if timeRemaining > 0 {
-			response := fmt.Sprintf("Please wait %.0f seconds.", timeRemaining.Seconds())
+			response := fmt.Sprintf("Please wait %.0f seconds", timeRemaining.Seconds())
 			io.Copy(io.Discard, r.Body)
 			http.Error(w, response, http.StatusTooManyRequests)
 			return
 		}

+		// parse form
+		r.Body = http.MaxBytesReader(w, r.Body, util.MAX_REQUEST_BYTES)
 		if err := r.ParseMultipartForm(util.FILE_MEM_LIMIT); err != nil {
 			http.Error(w, "Failed to parse form", http.StatusBadRequest)
 			log.Printf("ParseMultipartForm: %v", err)
 			return
 		}

+		// validate inputs
 		body := strings.TrimSpace(r.FormValue("body"))
 		mediaPath := ""
 		thumbPath := ""

 		if body == "" {
-			http.Error(w, "Malformed post body", http.StatusBadRequest)
+			http.Error(w, "Body is empty", http.StatusBadRequest)
+			return
+		}
+
+		if len(body) > util.MAX_BODY_LEN {
+			http.Error(w, fmt.Sprintf("Body exceeds %d characters", util.MAX_BODY_LEN), http.StatusBadRequest)
 			return
 		}

@@ -222,21 +267,36 @@ func main() {
 		} else {
 			defer file.Close()

-			// file type
-			isFileVideo, err := util.IsFileVideo(file)
+			if header.Size > util.FILE_MEM_LIMIT {
+				http.Error(w, "File too large (max 10 MB)", http.StatusRequestEntityTooLarge)
+				return
+			}
+
+			isMediaTooLarge, err := util.IsMediaTooLarge(file)
+			if err != nil {
+				http.Error(w, "Failed to detect if file is too large", http.StatusInternalServerError)
+				return
+			}
+			file.Seek(0, io.SeekStart)
+
+			if isMediaTooLarge {
+				http.Error(w, "File too large (max 5MB)", http.StatusRequestEntityTooLarge)
+				return
+			}
+
+			mediaType, err := util.DetectPostFileType(file)
 			if err != nil {
 				http.Error(w, "Failed to detect if file is a video", http.StatusInternalServerError)
 				return
 			}
+			file.Seek(0, io.SeekStart)

-			fileExt := strings.ToLower(filepath.Ext(header.Filename))
-
-			if isFileVideo && !slices.Contains(util.SUPPORTED_VID_FORMATS, fileExt) {
-				http.Error(w, "Unsupported file format", http.StatusBadRequest)
+			if mediaType == util.PostFileUnsupported {
+				http.Error(w, "Unsupported media type", http.StatusBadRequest)
 				return
 			}

-			filename := strconv.FormatInt(time.Now().UnixNano(), 10) + fileExt
+			filename := strconv.FormatInt(time.Now().UnixNano(), 10) + filepath.Ext(header.Filename)
 			err, savedMediaPath, savedThumbPath := util.SavePostFile(file, filename)
 			if err != nil {
 				http.Error(w, "Failed to save file", http.StatusInternalServerError)
@@ -247,6 +307,7 @@ func main() {
 			thumbPath = savedThumbPath
 		}

+		// put post into DB
 		threadIdStr := chi.URLParam(r, "threadId")
 		threadId, err := strconv.Atoi(threadIdStr)
 		if err != nil {
@@ -259,6 +320,8 @@ func main() {
 			log.Printf("PutPost: %v", err)
 			return
 		}
+
+		util.BeginCooldown(ip, util.PostCooldowns, util.POST_COOLDOWN)
 	})

 	// -----------------
@@ -132,8 +132,7 @@ body {
    margin: auto;
 }

-#newPostForm button,
-#newThreadForm button {
+#newPostForm button {
    display: block;
    margin-left: auto;
 }
@@ -13,6 +13,11 @@ function isOffScreen(el) {
    );
 }

+function isHttpWarningStatus(code) {
+    const warningStatuses = [429, 400, 413];
+    return warningStatuses.includes(code);
+}
+
 function insertAfter(referenceNode, newNode) {
    referenceNode.parentNode.insertBefore(newNode, referenceNode.nextSibling);
 }
@@ -8,58 +8,6 @@ import (
 	"strconv"
 )

-templ NewThreadForm(board database.Board) {
-	<div style="display: none;" id="newPostWarning" class="warning"></div>
-	<form
-		hx-encoding="multipart/form-data"
-		style="display: none;"
-		id="newThreadForm"
-		hx-swap="none"
-		hx-post={ fmt.Sprintf("/%s/threads", board.Slug) }
-		_="
-		on htmx:beforeSend toggle @disabled on <button/> until htmx:afterRequest  	
-		on htmx:afterRequest 
-			if event.detail.xhr.status is not 429
-				hide me 
-				then show #newThreadBtn 
-				then set #newPostBody.value to '' 
-				then set #newPostFile.value to '' 
-				then set #newPostSubject.value to '' 
-				then hide #newPostWarning
-				then trigger refreshThreads on body
-			else
-				show #newPostWarning
-				then put event.detail.xhr.responseText into #newPostWarning
-			end"
-	>
-		<table>
-			<tbody>
-				<tr class="new-post-form-field">
-					<th>Subject</th>
-					<td><input id="newPostSubject" name="subject"/></td>
-				</tr>
-				<tr class="new-post-form-field">
-					<th>Comment</th>
-					<td><textarea id="newPostBody" name="body" required></textarea></td>
-				</tr>
-				<tr class="new-post-form-field">
-					<th>File</th>
-					<td>
-						<input
-							accept="image/*,video/mp4,video/webm,video/ogg"
-							id="newPostFile"
-							name="file"
-							type="file"
-							required
-						/>
-					</td>
-				</tr>
-			</tbody>
-		</table>
-		<button type="submit">Submit</button>
-	</form>
-}
-
 templ BoardHeader(board database.Board) {
 	<header class="board-header">
 		<img src={ fmt.Sprintf("/static/media/banners/%s.png", board.Slug) }/>
@@ -74,8 +22,12 @@ templ Board(board database.Board) {
 	@shared.Layout() {
 		@BoardHeader(board)
 		<div class="new-post-container">
-			<button _="on click hide me then show #newThreadForm" id="newThreadBtn">[New Thread]</button>
-			@NewThreadForm(board)
+			<button
+				_="on load hide #newPostForm 
+				on click hide me then show #newPostForm"
+				id="newThreadBtn"
+			>[New Thread]</button>
+			@shared.NewPostForm(board, fmt.Sprintf("/%s/threads", board.Slug), true)
 		</div>
 		<hr/>
 		<div id="boardActionBar">
@@ -89,7 +41,7 @@ templ Board(board database.Board) {
 		<hr/>
 		<div
 			hx-get={ fmt.Sprintf("/hx/%s/catalog", board.Slug) }
-			hx-trigger="load, refreshThreads from:body"
+			hx-trigger="load, refreshPosts from:body"
 			_="on htmx:afterRequest 
 				call resizeCatalogPreviewImgs()
 				then call applyCatalogSearch()"
@@ -0,0 +1,65 @@
+package shared
+
+import "github.com/dominicf2001/comfychan/internal/database"
+import "strings"
+import "github.com/dominicf2001/comfychan/internal/util"
+import "strconv"
+
+templ NewPostForm(board database.Board, endpoint string, isForThread bool) {
+	<div style="display: none;" id="newPostWarning" class="warning"></div>
+	<form
+		hx-encoding="multipart/form-data"
+		id="newPostForm"
+		hx-swap="none"
+		hx-post={ endpoint }
+		_="
+			on htmx:beforeRequest toggle @disabled on <button/> until htmx:afterRequest
+
+			on htmx:afterRequest
+			  if isHttpWarningStatus(event.detail.xhr.status)
+				show #newPostWarning
+				put event.detail.xhr.responseText into #newPostWarning
+			  else
+				hide #newPostWarning
+				set #newPostBody.value to ''
+				set #newPostFile.value to ''
+				set #newPostSubject.value to ''
+				trigger refreshPosts on body
+			  end
+		  "
+	>
+		<table>
+			{{ acceptedMimeTypes := strings.Join(util.SUPPORTED_IMAGE_MIME_TYPES, ",") + "," + strings.Join(util.SUPPORTED_VIDEO_MIME_TYPES, ",") }}
+			<tbody>
+				<tr
+					if !isForThread {
+						style="display: none;"
+					}
+					class="new-post-form-field"
+				>
+					<th>Subject</th>
+					<td><input maxlength={ strconv.Itoa(util.MAX_SUBJECT_LEN) } id="newPostSubject" name="subject"/></td>
+				</tr>
+				<tr class="new-post-form-field">
+					<th>Comment</th>
+					<td><textarea maxlength={ strconv.Itoa(util.MAX_BODY_LEN) } id="newPostBody" name="body" required></textarea></td>
+				</tr>
+				<tr class="new-post-form-field">
+					<th>File</th>
+					<td>
+						<input
+							accept={ acceptedMimeTypes }
+							id="newPostFile"
+							name="file"
+							type="file"
+							if isForThread {
+								required
+							}
+						/>
+					</td>
+				</tr>
+			</tbody>
+		</table>
+		<button type="submit">Submit</button>
+	</form>
+}
@@ -117,46 +117,7 @@ templ Thread(board database.Board, thread database.Thread, posts []database.Post
 		<script src="/static/thread.js" defer></script>
 		@BoardHeader(board)
 		<div class="new-post-container">
-			<div style="display: none;" id="newPostWarning" class="warning"></div>
-			<form
-				hx-encoding="multipart/form-data"
-				id="newPostForm"
-				hx-target="#newPostWarning"
-				hx-post={ fmt.Sprintf("/%s/threads/%d", board.Slug, thread.Id) }
-				_="
-				on htmx:beforeSend toggle @disabled on <button/> until htmx:afterRequest  	
-				on htmx:afterRequest 
-					if event.detail.xhr.status is not 429
-						set #newPostBody.value to '' 
-						then set #newPostFile.value to '' 
-						then hide #newPostWarning
-						then trigger refreshPosts on body
-					else
-						show #newPostWarning
-						then put event.detail.xhr.responseText into #newPostWarning
-					end"
-			>
-				<table>
-					<tbody>
-						<tr class="new-post-form-field">
-							<th>comment</th>
-							<td><textarea id="newPostBody" name="body" required></textarea></td>
-						</tr>
-						<tr class="new-post-form-field">
-							<th>File</th>
-							<td>
-								<input
-									accept="image/*,video/mp4,video/webm,video/ogg"
-									id="newPostFile"
-									name="file"
-									type="file"
-								/>
-							</td>
-						</tr>
-					</tbody>
-				</table>
-				<button type="submit">Submit</button>
-			</form>
+			@shared.NewPostForm(board, fmt.Sprintf("/%s/threads/%d", board.Slug, thread.Id), false)
 		</div>
 		<hr/>
 		<div style="margin-left: 25px;">