csrfミドルウェアを使用するようにした

diff --git a/chat.js b/chat.js
index c8f84e7..234501a 100644 (file)
--- a/chat.js
+++ b/chat.js
@@ -56,7 +56,7 @@ function chat_proc(req, res){
        var room_number = 0;\r
        if(typeof(req.query.rno) != "undefined")\r
                room_number = req.query.rno;\r
-       res.render("chat",{rno:room_number,token:info.token});\r
+       res.render("chat",{rno:room_number,token:req.session._csrf});\r
 }\r
 \r
 function auth_proc(user, pass) {\r
@@ -68,11 +68,6 @@ function log_proc(req, res) {
 }\r
 \r
 function admin_postproc(req,res){\r
-       if(req.session.items.token != req.body.token)\r
-       {\r
-               res.send(resource.invaild_token_message);\r
-               return;\r
-       }\r
        if(typeof(req.body.erase) != "undefined")\r
        {\r
                removeLog(req.body.file,function(){\r
@@ -105,7 +100,7 @@ function admin_proc(req,res)
                        files: list,\r
                        log_directory:$log_directory,\r
                        ipbanlist:iplist,\r
-                       token:info.token,\r
+                       token:req.session._csrf,\r
                        roomlist:$rooms.GetString()\r
                });\r
        });\r
@@ -493,7 +488,7 @@ function ParseAuthorization(handshakeData, callback)
                                result = "failed get from session store";\r
                        else if(err)\r
                                result = err;\r
-                       else if(handshakeData.query.token != session.items.token)\r
+                       else if(handshakeData.query.token != session._csrf)\r
                                result = "invaild token";\r
                        if(typeof(session) != "undefined" && result == null)\r
                                handshakeData.sessionID = sessionID;\r

diff --git a/main.js b/main.js
index cd72b94..dc87c33 100644 (file)
--- a/main.js
+++ b/main.js
@@ -34,6 +34,7 @@ app.configure(function(){
                store:sessionStore,\r
                cookie: { httpOnly: false }\r
        }));\r
+       app.use(express.csrf());\r
        app.use(app.router);\r
        app.use(express.static(__dirname + "/public"));\r
 });\r
@@ -46,10 +47,10 @@ app.configure("production", function(){
   app.use(express.errorHandler()); \r
 });\r
 \r
-if(config.enable_profile)\r
-       require("./profile")(app);\r
-\r
 var server = http.createServer(app).listen(config.port);\r
 console.log("Express server listening on port %d in %s mode", config.port, app.settings.env);\r
 \r
 require("./chat")(app,server,express,sessionStore);\r
+\r
+if(config.enable_profile)\r
+       require("./profile")(app);\r

diff --git a/profile.js b/profile.js
index 15547b3..d93ed48 100644 (file)
--- a/profile.js
+++ b/profile.js
@@ -31,7 +31,7 @@ function admin_proc(req, res)
                if(err != null)\r
                        RenderMessage(res,err,info);\r
                else{\r
-                       result.token = info.token;\r
+                       result.token = req.session._csrf;\r
                        res.setHeader("X-FRAME-OPTIONS","DENY");\r
                        res.render("profile/admin",result);\r
                }\r
@@ -40,10 +40,6 @@ function admin_proc(req, res)
 \r
 function admin_postproc(req,res)\r
 {\r
-       if(req.session.items.token != req.body.token){\r
-               RenderMessage(res,resource.invaild_parameter,req.session.items);\r
-               return;\r
-       }\r
        async.waterfall([\r
                function(cb){\r
                        if(typeof(req.body.removeall) != "undefined")\r
@@ -132,17 +128,13 @@ function detail_proc(req, res)
                        RenderMessage(res,resource.notfound_name,req.session.items);\r
                else{\r
                        res.setHeader("X-FRAME-OPTIONS","DENY");\r
-                       res.render("profile/detail",{list:result,token:req.session.items.token,admin:req.session.items.admin});\r
+                       res.render("profile/detail",{list:result,token:req.session._csrf,admin:req.session.items.admin});\r
                }\r
        });\r
 }\r
 \r
 function detail_postproc(req, res)\r
 {\r
-       if(req.session.items.token != req.body.token){\r
-               RenderMessage(res,resource.invaild_parameter,req.session.items);\r
-               return;\r
-       }\r
        if(typeof(req.body.remove) != "undefined"){\r
                async.waterfall([\r
                        function(cb){\r
@@ -184,7 +176,7 @@ function detail_postproc(req, res)
                                RenderMessage(res,err,req.session.items);\r
                        }else if(result != null){\r
                                res.setHeader("X-FRAME-OPTIONS","DENY");\r
-                               res.render("profile/edit",{list:result,token:req.body.token});\r
+                               res.render("profile/edit",{list:result,token:req.session._csrf});\r
                        }else{\r
                                RenderMessage(res,resource.unmatch_password,req.session.items);\r
                        }\r
@@ -196,10 +188,6 @@ function detail_postproc(req, res)
 \r
 function edit_postproc(req, res)\r
 {\r
-       if(req.session.items.token != req.body.token){\r
-               RenderMessage(res,resource.invaild_parameter,req.session.items);\r
-               return;\r
-       }\r
        if(typeof(req.body.name) == "undefined")\r
        {\r
                RenderMessage(res,resource.invaild_parameter,req.session.items);\r
@@ -225,10 +213,6 @@ function edit_postproc(req, res)
 \r
 function registor_postproc(req, res)\r
 {\r
-       if(req.session.items.token != req.body.token){\r
-               RenderMessage(res,resource.invaild_parameter,req.session.items);\r
-               return;\r
-       }\r
        if(typeof(req.body.registor) != "undefined"){\r
                async.waterfall([\r
                        function(cb){\r
@@ -251,13 +235,13 @@ function registor_proc(req, res)
                req.session.items = new security.SessionInfomation(false);\r
 \r
        res.setHeader("X-FRAME-OPTIONS","DENY");\r
-       res.render("profile/registor",{token:req.session.items.token});\r
+       res.render("profile/registor",{token:req.session._csrf});\r
 }\r
 \r
 function RenderMessage(res,msg,info)\r
 {\r
-       if(typeof(info) == "undefined")\r
-               res.render("profile/message",{message:msg});\r
+       if(typeof(info) == "undefined" || typeof(info.admin) == "undefined")\r
+               res.render("profile/message",{message:msg,admin:false});\r
        else\r
                res.render("profile/message",{message:msg,admin:info.admin});\r
 }\r

diff --git a/public/admin.ejs b/public/admin.ejs
index 46bc8cd..6b75fb8 100644 (file)
--- a/public/admin.ejs
+++ b/public/admin.ejs
@@ -37,7 +37,7 @@
                                        </tr>\r
                                <% } %>\r
                        </table>\r
-                       <input type="hidden" name="token" value="<%= token %>"></input>\r
+                       <input type="hidden" name="_csrf" value="<%= token %>"></input>\r
                        <input type="submit" name="erase" value="削除"/>\r
                </form>\r
        </div>\r
@@ -46,7 +46,7 @@
                        <p>ＩＰＢＡＮリスト</p>\r
                        <textarea name="newbanlist" rows="4" cols="40"><%= ipbanlist %></textarea>\r
                        <br/>\r
-                       <input type="hidden" name="token" value="<%= token %>"></input>\r
+                       <input type="hidden" name="_csrf" value="<%= token %>"></input>\r
                        <input type="submit" name="registor" value="登録">\r
                </form>\r
        </div>\r
@@ -55,7 +55,7 @@
                        <p>ルームリスト</p>\r
                        <textarea name="newroomlist" rows="4" cols="40"><%= roomlist %></textarea>\r
                        <br/>\r
-                       <input type="hidden" name="token" value="<%= token %>"></input>\r
+                       <input type="hidden" name="_csrf" value="<%= token %>"></input>\r
                        <input type="submit" name="updateroom" value="登録">\r
                </form>\r
        </div>\r

diff --git a/public/chat.ejs b/public/chat.ejs
index ac6ac66..add32d6 100644 (file)
--- a/public/chat.ejs
+++ b/public/chat.ejs
@@ -88,7 +88,7 @@
        <div id="chat_frame" style="display:none">\r
                <form name="chat_form" accept-charset="UTF-8">\r
                        <input type="hidden" name="rno" value="<%= rno %>"></input>\r
-                       <input type="hidden" name="token" value="<%= token %>"></input>\r
+                       <input type="hidden" name="_csrf" value="<%= token %>"></input>\r
                        <p>発言<textarea type="text" name="message" value=""></textarea></p>\r
                        <p>\r
                                <input type="button" name="sid" value="発言"></input>\r

diff --git a/public/profile/admin.ejs b/public/profile/admin.ejs
index 4a8710d..79d4f68 100644 (file)
--- a/public/profile/admin.ejs
+++ b/public/profile/admin.ejs
@@ -32,7 +32,7 @@
                </tr>\r
        <% } %>\r
        </table>\r
-       <input type="hidden" name="token" value="<%= token %>"></input>\r
+       <input type="hidden" name="_csrf" value="<%= token %>"></input>\r
        <input type="submit" value="全削除" name="removeall"/>\r
        <input type="submit" value="削除" name="remove"/>\r
 </form>\r

diff --git a/public/profile/detail.ejs b/public/profile/detail.ejs
index 923b988..26d0c4b 100644 (file)
--- a/public/profile/detail.ejs
+++ b/public/profile/detail.ejs
@@ -44,7 +44,7 @@ $(function(){
                <p><%= list[0].etc %></p>\r
        </div>\r
        <form action="/profile/detail" method="POST">\r
-               <input type="hidden" name="token" value="<%= token %>"></input>\r
+               <input type="hidden" name="_csrf" value="<%= token %>"></input>\r
                <input type="hidden" value="<%= list[0].name %>" name="name"/>\r
                <input type="submit" value="編集" name="edit"/>\r
                <input type="submit" value="削除" name="remove"/>\r

diff --git a/public/profile/edit.ejs b/public/profile/edit.ejs
index cf4a4f0..084eb2c 100644 (file)
--- a/public/profile/edit.ejs
+++ b/public/profile/edit.ejs
@@ -46,7 +46,7 @@
                                <td><textarea name="etc" rows="4" cols="50"><%= list[0].etc %></textarea></td>\r
                        </tr>\r
                </table>\r
-               <input type="hidden" name="token" value="<%= token %>"></input>\r
+               <input type="hidden" name="_csrf" value="<%= token %>"></input>\r
                <input type="submit" value="編集" name="edit"/>\r
        </form>\r
 </div>\r

diff --git a/public/profile/registor.ejs b/public/profile/registor.ejs
index 23be2df..96ec685 100644 (file)
--- a/public/profile/registor.ejs
+++ b/public/profile/registor.ejs
@@ -43,7 +43,7 @@
                                <td><textarea name="etc" rows="4" cols="50"></textarea></td>\r
                        </tr>\r
                </table>\r
-               <input type="hidden" name="token" value="<%= token %>"></input>\r
+               <input type="hidden" name="_csrf" value="<%= token %>"></input>\r
                <input type="submit" value="登録" name="registor"/>\r
        </form>\r
 </div>\r

diff --git a/public/scripts/chatclient.js b/public/scripts/chatclient.js
index 4b35312..06406fe 100644 (file)
--- a/public/scripts/chatclient.js
+++ b/public/scripts/chatclient.js
@@ -47,7 +47,7 @@ $(document).ready(function(){
        document.chat_form.onsubmit = function(){return false;};\r
        document.enter_form.onsubmit = function(){return false;};\r
 \r
-       $socket = io.connect(location.hostname  + "/" + document.chat_form.rno.value + "?token="+ encodeURIComponent(document.chat_form.token.value));\r
+       $socket = io.connect(location.hostname  + "/" + document.chat_form.rno.value + "?token="+ encodeURIComponent(document.chat_form._csrf.value));\r
        $socket.on("error",getErrorMessage);\r
        $socket.on("send roominfo",sendRoomInfoListerner);\r
        $socket.on("send romcount",sendRomCountListerner);\r

diff --git a/security.js b/security.js
index 5e8ba8a..8e2f03c 100644 (file)
--- a/security.js
+++ b/security.js
@@ -1,15 +1,3 @@
-var $token_length = 32;     //トークンの長さ\r
-\r
-module.exports.SessionInfomation = function(admin){\r
-       this.token = GetToken($token_length);\r
+module.exports.SessionInfomation = function(admin){\r
        this.admin = admin;\r
 };\r
-\r
-function GetToken(length){\r
-       var RandomString = "";\r
-       var BaseString ="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";\r
-       for(var i=0; i < length; i++) {\r
-               RandomString += BaseString.charAt( Math.floor( Math.random() * BaseString.length));\r
-       }\r
-       return RandomString;\r
-};\r