added hardening on documents link

.env.local

@@ -37,6 +37,6 @@ BASIC_AUTH_CREDENTIALS,, = pinswg:password|pinswg2:password2
 
 NEXT_PUBLIC_ISHARESECRETPHRASE = "Secret phrase"
 
-HASHKEY = 028ffbae928d7191c0017f298260995f901d78eabde1436c0af0423459cc3715832136d84f68818d3a96399467b52143e273d4f3bf4ae190848891535421cd6c
+HASHKEY = "028ffbae928d7191c0017f298260995f901d78eabde1436c0af0423459cc3715832136d84f68818d3a96399467b52143e273d4f3bf4ae190848891535421cd6c"
 
-NEXT_PUBLIC_HASHKEY = 028ffbae928d7191c0017f298260995f901d78eabde1436c0af0423459cc3715832136d84f68818d3a96399467b52143e273d4f3bf4ae190848891535421cd6c
+NEXT_PUBLIC_HASHKEY = "028ffbae928d7191c0017f298260995f901d78eabde1436c0af0423459cc3715832136d84f68818d3a96399467b52143e273d4f3bf4ae190848891535421cd6c"

actions/index.js

@@ -15,8 +15,7 @@ if (process.browser) {
 } else {
     BASE_URL = process.env.API_ROOT || `http://localhost:${port}`;
 }
-const WORDKEY =
-    "028ffbae928d7191c0017f298260995f901d78eabde1436c0af0423459cc3715832136d84f68818d3a96399467b52143e273d4f3bf4ae190848891535421cd6c";
+const WORDKEY = process.env.NEXT_PUBLIC_HASHKEY;
 
 const API_PATH = "/api/data/v8.2/";
 
@@ -79,34 +78,6 @@ export const getSASToken = () => {
     return token;
 };
 
-const accessToken =
-    "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IlVXelVaa0U3OEx0NVBGRkJ0LV9seVdoMjdjTSIsImtpZCI6IlVXelVaa0U3OEx0NVBGRkJ0LV9seVdoMjdjTSJ9.eyJhdWQiOiJodHRwczovL2RldmNybTIwMTYubGxjZHQuZ292LndhbGVzLyIsImlzcyI6Imh0dHA6Ly9mcy50ZXN0Lmdvdi53YWxlcy9hZGZzL3NlcnZpY2VzL3RydXN0IiwiaWF0IjoxNjMyMTIxMjkxLCJuYmYiOjE2MzIxMjEyOTEsImV4cCI6MTYzMjE1MDA5MSwidXBuIjpbIlJvYmVydC5Cb25kQHRlc3QuZ292LndhbGVzIiwicm9iZXJ0LmJvbmRAdGVzdC5nb3Yud2FsZXMiXSwicHJpbWFyeXNpZCI6IlMtMS01LTIxLTE4MDA4NDIwNzYtMjQ1NTYwNjU5LTQyMTU3NzU0NjktMTY2MjgiLCJ1bmlxdWVfbmFtZSI6IlhNXFxCb25kUiIsImFwcHR5cGUiOiJQdWJsaWMiLCJhcHBpZCI6IjQyN2ZhNzljLWI1ZmMtNDJhZC04M2Q0LTQxMGIwMzk0OGFiNiIsImF1dGhtZXRob2QiOiJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dzLzIwMDgvMDYvaWRlbnRpdHkvYXV0aGVudGljYXRpb25tZXRob2Qvd2luZG93cyIsImF1dGhfdGltZSI6IjIwMjEtMDktMjBUMDc6MDE6MzEuNDYzWiIsInZlciI6IjEuMCJ9.W0ID2nCBYVxh8T1eQqWKk2Wh45kRbRzCICfzrZNAs-4u54yl0UJUcVihyI8EBmQeALCEc5eY99DjK0gaqzCdJqxbxol8yk5LrFvhV5UkCiZ7SO2Wq1cLReWHVsgz39qBtrZ8vlqqZsv7DsEaRJQbtj8Djnx26Wb_kcNu-tuXwUBF0uR5GLFFvJfM3PzkRCY-ZPOTbvPTb73oN_NKe6BrsVjyaR9xSXsRJjgHPmJgWgnvq-2X0Dj7LCwXSEygDDOGlF1yqqN0Lv6qplhQoH-heZlC1K6qe_92nHPswXag6uN5nxTmk1Qw6zJt_aHMnXdwa18ghh4hGx5R0Jz53X113Q";
-
-//const SASToken = getSASToken();
-
-const crmHeaders = {
-    withCredentials: true,
-    headers: {
-        "Content-Type": "application/json; charset=utf-8",
-        "OData-MaxVersion": "4.0",
-        "OData-Version": "4.0",
-        "Accept": "application/json",
-        "Prefer": 'odata.include-annotations="*",return=representation',
-        "Authorization": "Bearer " + accessToken,
-    },
-};
-
-const crmHeadersReturn = {
-    headers: {
-        "OData-MaxVersion": "4.0",
-        "OData-Version": "4.0",
-        "Accept": "application/json",
-        "Prefer": "return=representation",
-        "Content-Type": "application/json",
-        "Authorization": "Bearer " + accessToken,
-    },
-};
-
 const azureHeaders = (SASToken) => {
     return {
         headers: {
@@ -135,16 +106,11 @@ const azureHeadersPaged = (SASToken) => {
 };
 
 const hashProxyPath = (queryPath) => {
-    //console.log(CryptoJS.enc.Hex.parse(wordKey));
-    //console.log("hasshing this: ", queryPath);
     var hashlink = CryptoJS.HmacSHA256(
         queryPath,
         CryptoJS.enc.Hex.parse(WORDKEY)
     );
     hashlink = hashlink.toString();
-    hashlink = encodeURI(hashlink);
-
-    console.log(hashlink);
 
     return "&hash=" + hashlink;
 };
@@ -179,7 +145,7 @@ export const getBasicSearch = (token, searchString) => {
 export const getBasicSearchPaged = (searchString, pageNumber) => {
     //console.log("\n\n", token, searchString);
 
-    console.log(typeof pageNumber != "undefined");
+    //console.log(typeof pageNumber != "undefined");
 
     var queryUrl =
         "/api/proxy/incidents?$select=numberofchildincidents,_accountid_value,_customerid_value,_pinswg_associatedlpa_value,_ownerid_value,pinswg_appealcasetype,statuscode,ticketnumber,title, _primarycontactid_value&$expand=primarycontactid($select=fullname)&$filter=(contains(title, '" +
@@ -188,10 +154,10 @@ export const getBasicSearchPaged = (searchString, pageNumber) => {
         searchString +
         "')) and pinswg_appealcasetype ne null and pinswg_publishtoweb eq true&$orderby=createdon desc&$count=true" +
         (typeof pageNumber != "undefined"
-            ? "&$skiptoken=" +
-              encodeURI('<cookie pagenumber="' + pageNumber + '" />')
+            ? "&$skiptoken=" + '<cookie pagenumber="' + pageNumber + '" />'
             : "");
 
+    //console.log(queryUrl);
     return axios
         .get(queryUrl + hashProxyPath(queryUrl))
         .then((res) => {
@@ -227,12 +193,11 @@ export const getBasicDNSSearchPaged = (pageNumber) => {
     var queryUrl =
         "/api/proxy/incidents?$select=numberofchildincidents,_accountid_value,_customerid_value,_pinswg_associatedlpa_value,_ownerid_value,pinswg_appealcasetype,statuscode,ticketnumber,title, _primarycontactid_value&$expand=primarycontactid($select=fullname)&$filter=pinswg_appealcasetype eq 846040011 and pinswg_publishtoweb eq true&$orderby=createdon desc&$count=true" +
         (typeof pageNumber != "undefined"
-            ? "&$skiptoken=" +
-              encodeURI('<cookie pagenumber="' + pageNumber + '" />')
+            ? "&$skiptoken=" + '<cookie pagenumber="' + pageNumber + '" />'
             : "");
 
     return axios
-        .get(hashProxyPath(queryUrl), azureHeadersPaged(token))
+        .get(queryUrl + hashProxyPath(queryUrl))
         .then((res) => res.data)
         .catch((error) => {
             return error.response;
@@ -325,12 +290,11 @@ export const getAdvancedSearchPaged = (searchString, pageNumber) => {
         queryString +
         " and pinswg_appealcasetype ne null and pinswg_publishtoweb eq true&$orderby=createdon desc&$count=true" +
         (typeof pageNumber != "undefined"
-            ? "&$skiptoken=" +
-              encodeURI('<cookie pagenumber="' + pageNumber + '" />')
+            ? "&$skiptoken=" + ('<cookie pagenumber="' + pageNumber + '" />')
             : "");
 
     return axios
-        .get(hashProxyPath(queryUrl), azureHeadersPaged(token))
+        .get(queryUrl + hashProxyPath(queryUrl))
         .then((res) => res.data)
         .catch((error) => {
             let ErrResponse = {
@@ -435,9 +399,8 @@ export const getSearchDocumentDetailsPaged = (incidentID, pageNumber) => {
               encodeURI('<cookie pagenumber="' + pageNumber + '" />')
             : "");
 
-    hashProxyPath(queryUrl);
     return axios
-        .get(hashProxyPath(queryUrl), azureHeadersPaged(token))
+        .get(queryUrl + hashProxyPath(queryUrl))
         .then((res) => res.data)
         .catch((error) => {
             console.log("thiserror", error);
@@ -451,11 +414,10 @@ export const getSearchDocumentHistoryPaged = (documentID, pageNumber) => {
         "/api/proxy/pinswg_documenthistories?$count=true&$select=_pinswg_documentid_value,pinswg_createddate,pinswg_state,pinswg_fileexists,statecode,pinswg_publisheddate&$filter=_pinswg_documentid_value eq " +
         documentID +
         (typeof pageNumber != "undefined"
-            ? "&$skiptoken=" +
-              encodeURI('<cookie pagenumber="' + pageNumber + '" />')
+            ? "&$skiptoken=" + ('<cookie pagenumber="' + pageNumber + '" />')
             : "");
     return axios
-        .get(hashProxyPath(queryUrl), azureHeadersPaged(token))
+        .get(queryUrl + hashProxyPath(queryUrl))
         .then((res) => res.data)
         .catch((error) => {
             console.log("thiserror", error);
@@ -470,7 +432,7 @@ export const getSearchDocumentDetails1 = (incidentID) => {
         incidentID +
         "&$select=pinswg_isharedocumentlocations,_pinswg_documentids_value,pinswg_isharelabelcasetype,pinswg_isharelabellpaname,pinswg_publishtoweb,pinswg_uploadstatus,pinswg_isharedocumentclassification,pinswg_isharedocumentreference";
     return axios
-        .get(hashProxyPath(queryUrl))
+        .get(queryUrl + hashProxyPath(queryUrl))
         .then((res) => res.data)
         .catch((error) => {
             console.log("thiserror", error);
@@ -485,11 +447,10 @@ export const getSearchDocumentDetails1Paged = (incidentID, pageNumber) => {
         incidentID +
         "&$select=pinswg_isharedocumentlocations,_pinswg_documentids_value,pinswg_isharelabelcasetype,pinswg_isharelabellpaname,pinswg_publishtoweb,pinswg_uploadstatus,pinswg_isharedocumentclassification,pinswg_isharedocumentreference" +
         (typeof pageNumber != "undefined"
-            ? "&$skiptoken=" +
-              encodeURI('<cookie pagenumber="' + pageNumber + '" />')
+            ? "&$skiptoken=" + ('<cookie pagenumber="' + pageNumber + '" />')
             : "");
     return axios
-        .get(hashProxyPath(queryUrl))
+        .get(queryUrl + hashProxyPath(queryUrl))
         .then((res) => res.data)
         .catch((error) => {
             console.log("thiserror", error);
@@ -503,7 +464,7 @@ export const getSearchDocumentHistory1 = (documentID) => {
         "/api/proxy/pinswg_documenthistories?$count=true&$select=_pinswg_documentid_value,pinswg_createddate,pinswg_state,pinswg_fileexists,statecode,pinswg_publisheddate&$filter=_pinswg_documentid_value eq " +
         documentID;
     return axios
-        .get(hashProxyPath(queryUrl))
+        .get(queryUrl + hashProxyPath(queryUrl))
         .then((res) => {
             return res.data;
         })
@@ -519,11 +480,10 @@ export const getSearchDocumentHistory1Paged = (documentID, pageNumber) => {
         "/api/proxy/pinswg_documenthistories?$count=true&$select=_pinswg_documentid_value,pinswg_createddate,pinswg_state,pinswg_fileexists,statecode,pinswg_publisheddate&$filter=_pinswg_documentid_value eq " +
         documentID +
         (typeof pageNumber != "undefined"
-            ? "&$skiptoken=" +
-              encodeURI('<cookie pagenumber="' + pageNumber + '" />')
+            ? "&$skiptoken=" + ('<cookie pagenumber="' + pageNumber + '" />')
             : "");
     return axios
-        .get(hashProxyPath(queryUrl))
+        .get(queryUrl + hashProxyPath(queryUrl))
         .then((res) => {
             return res.data;
         })
@@ -556,7 +516,7 @@ export const getBasicDNSSearchDetailsPaged = (caseReference) => {
         "'&$count=true";
 
     return axios
-        .get(hashProxyPath(queryUrl), azureHeadersPaged(token))
+        .get(queryUrl + hashProxyPath(queryUrl))
         .then((res) => res.data)
         .catch((error) => {
             console.log("thiserror", error);
@@ -565,14 +525,12 @@ export const getBasicDNSSearchDetailsPaged = (caseReference) => {
 
 export const getLinkedCases = (parentIncidentid) => {
     //console.log(parentIncidentid);
-    var token = getSASToken();
-
     var queryUrl =
         "/api/proxy/incidents?$count=true&$filter=_parentcaseid_value eq " +
         parentIncidentid +
         " and pinswg_appealcasetype ne null and pinswg_publishtoweb eq true &$select=title, incidentid";
     return axios
-        .get(hashProxyPath(queryUrl))
+        .get(queryUrl + hashProxyPath(queryUrl))
         .then((res) => {
             //console.log(" linked date", res.data);
             return res.data;
@@ -732,7 +690,7 @@ export const getLogin = (emailAddress, pwd) => {
         "'&$count=true&$select=emailaddress1,%20contactid,pinswg_custom_password, yomifullname, firstname, lastname";
 
     return axios
-        .get(hashProxyPath(queryUrl))
+        .get(queryUrl + hashProxyPath(queryUrl))
         .then((res) => res.data)
         .catch((error) => {
             console.log("thiserror", error);
@@ -855,7 +813,7 @@ export const getMyRepresentationsProxy = (token, loggedInUserId) => {
         loggedInUserId +
         "&$count=true&$orderby=createdon desc";
     return axios
-        .get(hashProxyPath(queryUrl))
+        .get(queryUrl + hashProxyPath(queryUrl))
         .then((res) => res.data)
         .catch((error) => {
             console.log("this serror", error);
@@ -892,7 +850,7 @@ export const getRepresentations = (incidentID) => {
         incidentID +
         " and pinswg_publishtoweb eq true&$count=true&$orderby=createdon desc";
     return axios
-        .get(hashProxyPath(queryUrl), azureHeaders(getSASToken()))
+        .get(queryUrl + hashProxyPath(queryUrl))
         .then((res) => res.data)
         .catch((error) => {
             console.log("this serror", error);
@@ -905,7 +863,7 @@ export const getRepresentationsProxy = (token, incidentID) => {
         incidentID +
         "&$count=true&$orderby=createdon desc";
     return axios
-        .get(hashProxyPath(queryUrl), azureHeaders(token))
+        .get(queryUrl + hashProxyPath(queryUrl))
         .then((res) => res.data)
         .catch((error) => {
             console.log("this serror", error);
@@ -933,7 +891,7 @@ export const getWatchedCasesProxy = (token, loggedInUserId) => {
         loggedInUserId +
         "&$count=true&$orderby=createdon desc";
     return axios
-        .get(hashProxyPath(queryUrl), azureHeaders(token))
+        .get(queryUrl | +hashProxyPath(queryUrl))
         .then((res) => res.data)
         .catch((error) => {
             console.log("this serror", error);
@@ -1030,7 +988,7 @@ export const getPortalModuleDetailsProxy = (
         caseReference +
         "'&$count=true";
     return axios
-        .get(hashProxyPath(queryUrl), azureHeaders(token))
+        .get(queryUrl + hashProxyPath(queryUrl))
         .then((res) => res.data)
         .catch((error) => {
             console.log("thiserror", error);
@@ -1044,7 +1002,7 @@ export const getEmailAccountCheck = (emailAddress) => {
         emailAddress +
         "'&$count=true&$select=emailaddress1, contactid";
     return axios
-        .get(hashProxyPath(queryUrl))
+        .get(queryUrl + hashProxyPath(queryUrl))
         .then((res) => res.data)
         .catch((error) => {
             console.log("thiserror", error);

components/case/documents.js

@@ -105,12 +105,9 @@ const DocumentDetails = (props) => {
                                         >
                                             <dd className="govuk-summary-list__value govuk-!-font-size-16 ">
                                                 <a
-                                                    href={
-                                                        "/api/proxy/documents/download/" +
-                                                        encryptDocReference(
-                                                            detailsObj.pinswg_isharedocumentreference
-                                                        )
-                                                    }
+                                                    href={encryptDocReference(
+                                                        detailsObj.pinswg_isharedocumentreference
+                                                    )}
                                                 >
                                                     <span className="results-visually-hidden">
                                                         {t(
@@ -194,15 +191,18 @@ const DocumentDetails = (props) => {
         );
     };
 
-    const encryptDocReference = (documentRef) => {
-        var encrypted = encodeURIComponent(
-            CryptoJS.AES.encrypt(
-                documentRef,
-                process.env.NEXT_PUBLIC_ISHARESECRETPHRASE
-            )
-        );
+    const WORDKEY = process.env.NEXT_PUBLIC_HASHKEY;
 
-        return encrypted;
+    const encryptDocReference = (documentRef) => {
+        var hashlink = CryptoJS.HmacSHA256(
+            "/api/proxy/documents/download/" + documentRef,
+            CryptoJS.enc.Hex.parse(WORDKEY)
+        );
+        hashlink = hashlink.toString();
+
+        return (
+            "/api/proxy/documents/download/" + documentRef + "&hash=" + hashlink
+        );
     };
 
     useEffect(() => {

components/case/summaryTypes/pinswg_dnsid.js

@@ -263,7 +263,19 @@ const Pinswg_dnsid = (props) => {
                                                           detailsObj.pinswg_webaddress +
                                                           '")].value_cy'
                                                   )
-                                                : detailsObj.pinswg_webaddress ||
+                                                : (
+                                                      <a
+                                                          target="_blank"
+                                                          rel="noopener"
+                                                          href={
+                                                              detailsObj.pinswg_webaddress
+                                                          }
+                                                      >
+                                                          {
+                                                              detailsObj.pinswg_webaddress
+                                                          }
+                                                      </a>
+                                                  ) ||
                                                   t(
                                                       "case:summary-no-date-entered-label"
                                                   )}

components/search/dnssearchresults.js

@@ -268,7 +268,7 @@ const DNSSearchResults = (props) => {
                 //console.log("getting details", data);
                 return getSearchDetailsPaged(data).then((data) => {
                     setSearchDetails(data);
-                    setShowSpinnerState(false);
+                    //setShowSpinnerState(false);
                 });
             });
     };

pages/api/proxy/[...route].js

@@ -50,34 +50,23 @@ const getSASToken = () => {
 };
 
 function checkProxyPath(queryPath) {
-    var urlHasHash = queryPath.indexOf("&hash=");
-
-    //console.log(queryPath); //, urlHasHash, queryPath.split("&hash="));
-
-    const WORDKEY =
-        "028ffbae928d7191c0017f298260995f901d78eabde1436c0af0423459cc3715832136d84f68818d3a96399467b52143e273d4f3bf4ae190848891535421cd6c";
+    const WORDKEY = process.env.NEXT_PUBLIC_HASHKEY;
 
     const wordKey = WORDKEY;
-    //console.log(CryptoJS.enc.Hex.parse(wordKey));
     var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
+        decodeURI(queryPath),
         CryptoJS.enc.Hex.parse(wordKey)
     );
 
     hashlink = hashlink.toString();
-    hashlink = encodeURI(hashlink);
 
     return hashlink;
 }
 
 export default async function ApiProxy(req, res) {
-    //console.log(req.method);
-
     var data = JSON.stringify(req.body);
     const SASToken = getSASToken();
 
-    //console.log("the request", req.query.route, req.url);
-
     var configNoData = {
         method: req.method,
         //url: PROXY_RELAY_URL + updateFormCollection + "(" + incidentId + ")",
@@ -125,67 +114,49 @@ export default async function ApiProxy(req, res) {
         responseType: "arraybuffer",
     };
 
-    return new Promise((resolve, reject) => {
-        let hashCheckPath = req.url.split("&hash=")[0];
-        let hashCheckValue = req.url.split("&hash=")[1];
-        let hashFromRequest = checkProxyPath(hashCheckPath);
-        let apiPath = "";
+    let hashCheckPath = req.url.split("&hash=")[0];
+    let hashCheckValue = req.url.split("&hash=")[1];
+    let hashFromRequest = checkProxyPath(hashCheckPath);
 
-        // console.log(req.url);
-        console.log("Check:", hashCheckValue);
+    if (hashCheckValue == hashFromRequest) {
+        return new Promise((resolve, reject) => {
+            let hasDocument =
+                hashCheckPath.indexOf("/download") > 0 ? true : false;
 
-        // if (hashCheckPath > 0) {
-        //     hashCheckValue = req.url.split("&hash=")[1];
-        //     apiPath = req.url.split("&hash=")[0].split("/api/proxy")[1];
-        // } else {
-        //     apiPath = req.url.split("/api/proxy")[1];
-        // }
-        //console.log(hashCheckPath);
-        console.log("Calculated:", hashFromRequest);
-
-        //console.log(req.url.split("&hash=")[0].split("/api/proxy/")[1]);
-        //console.log(hashCheckPath);
-        // console.log("from proxy :", hashCheckValue);
-        // // console.log(req.url);
-        // // console.log(apiPath);
-        // console.log("hashing path", hashFromRequest);
-
-        let hasDocument = apiPath.indexOf("/download") > 0 ? true : false;
-
-        // hashCheckValue == hashFromRequest
-        //?
-        axios(
-            req.method == "GET"
-                ? hasDocument
-                    ? configDocument
-                    : configNoData
-                : config
-        )
-            .then((response) => {
-                res.statusCode = 200;
-                if (hasDocument) {
-                    res.setHeader(
-                        "Content-disposition",
-                        "attachment; filename=" +
-                            response.headers["content-disposition"].split(
-                                "filename="
-                            )[1]
-                    );
-                    res.end(response.data);
-                } else {
-                    res.setHeader("Content-Type", "application/json");
-                    // res.setHeader("Cache-Control", "max-age=1800000");
-                    res.end(JSON.stringify(response.data));
-                }
-                resolve();
-            })
-            .catch((error) => {
-                console.log("proxy response error", error);
-                // res.json(error);
-                res.status(405).end();
-                return resolve();
-            });
-        //     : res.status(405).end();
-        // return resolve();
-    });
+            axios(
+                req.method == "GET"
+                    ? hasDocument
+                        ? configDocument
+                        : configNoData
+                    : config
+            )
+                .then((response) => {
+                    res.statusCode = 200;
+                    if (hasDocument) {
+                        res.setHeader(
+                            "Content-disposition",
+                            "attachment; filename=" +
+                                response.headers["content-disposition"].split(
+                                    "filename="
+                                )[1]
+                        );
+                        res.end(response.data);
+                    } else {
+                        res.setHeader("Content-Type", "application/json");
+                        // res.setHeader("Cache-Control", "max-age=1800000");
+                        res.end(JSON.stringify(response.data));
+                    }
+                    resolve();
+                })
+                .catch((error) => {
+                    console.log("proxy response error", error);
+                    // res.json(error);
+                    res.status(405).end();
+                    return resolve();
+                });
+        });
+    } else {
+        res.status(405).end();
+        return resolve();
+    }
 }