88f7e72501
SECURITY FIXES: - Remove dangerous public DELETE /api/locations/:id endpoint - Add rate limiting to POST /api/locations (10 requests per 15 minutes) - Add input validation with length limits (500 chars address, 1000 chars description) - Add suspicious activity logging for abuse detection - Install express-rate-limit for protection against spam/DoS CHANGES: - Removed LocationDeleteRequest interface (no longer needed) - Updated tests to expect new security validation behavior - Added comprehensive tests for length validation - Fixed test setup issue with undefined constants Security Impact: - CRITICAL: Prevents unauthorized deletion of location reports - HIGH: Prevents spam submissions and DoS attacks - MEDIUM: Prevents buffer overflow and injection attacks via oversized inputs All 125 tests passing with new security validations. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
102 lines
No EOL
2.7 KiB
TypeScript
102 lines
No EOL
2.7 KiB
TypeScript
import { Database } from 'sqlite3';
|
|
import fs from 'fs';
|
|
import path from 'path';
|
|
|
|
// Setup test environment
|
|
process.env.NODE_ENV = 'test';
|
|
process.env.ADMIN_PASSWORD = 'test_admin_password';
|
|
process.env.MAPBOX_ACCESS_TOKEN = 'pk.test_token_here';
|
|
|
|
// Removed unused constants TEST_DB_PATH and TEST_PROFANITY_DB_PATH
|
|
// Helper function to create test database
|
|
export const createTestDatabase = (): Promise<Database> => {
|
|
return new Promise((resolve, reject) => {
|
|
const db = new Database(':memory:', (err) => {
|
|
if (err) {
|
|
reject(err);
|
|
return;
|
|
}
|
|
|
|
// Create locations table
|
|
db.run(`
|
|
CREATE TABLE IF NOT EXISTS locations (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
address TEXT NOT NULL,
|
|
latitude REAL,
|
|
longitude REAL,
|
|
timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
|
|
description TEXT,
|
|
persistent INTEGER DEFAULT 0,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
|
|
)
|
|
`, (err) => {
|
|
if (err) {
|
|
reject(err);
|
|
return;
|
|
}
|
|
resolve(db);
|
|
});
|
|
});
|
|
});
|
|
};
|
|
|
|
// Helper function to create test profanity database
|
|
export const createTestProfanityDatabase = (): Promise<Database> => {
|
|
return new Promise((resolve, reject) => {
|
|
const db = new Database(':memory:', (err) => {
|
|
if (err) {
|
|
reject(err);
|
|
return;
|
|
}
|
|
|
|
// Create profanity_words table
|
|
db.run(`
|
|
CREATE TABLE IF NOT EXISTS profanity_words (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
word TEXT NOT NULL UNIQUE,
|
|
severity TEXT NOT NULL,
|
|
category TEXT NOT NULL,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
|
created_by TEXT DEFAULT 'system'
|
|
)
|
|
`, (err) => {
|
|
if (err) {
|
|
reject(err);
|
|
return;
|
|
}
|
|
resolve(db);
|
|
});
|
|
});
|
|
});
|
|
};
|
|
|
|
// Cleanup function for tests (in-memory databases don't need file cleanup)
|
|
export const cleanupTestDatabases = () => {
|
|
// Using in-memory databases (:memory:) - no file cleanup needed
|
|
};
|
|
|
|
// Global test cleanup
|
|
afterAll(() => {
|
|
cleanupTestDatabases();
|
|
});
|
|
|
|
// Console override for cleaner test output
|
|
const originalConsoleLog = console.log;
|
|
const originalConsoleError = console.error;
|
|
const originalConsoleWarn = console.warn;
|
|
|
|
beforeAll(() => {
|
|
// Suppress console output during tests unless running in verbose mode
|
|
if (!process.env.VERBOSE_TESTS) {
|
|
console.log = jest.fn();
|
|
console.error = jest.fn();
|
|
console.warn = jest.fn();
|
|
}
|
|
});
|
|
|
|
afterAll(() => {
|
|
// Restore console functions
|
|
console.log = originalConsoleLog;
|
|
console.error = originalConsoleError;
|
|
console.warn = originalConsoleWarn;
|
|
}); |