CPSC 455 - Filtering proxy / WAF PoC

waf.js

#!/usr/bin/env node

// See https://chatgpt.com/share/67331281-9cec-800b-99fb-c193630dffa1

const http = require('http');
const { URL } = require('url');

const PORT = 8000;
const TARGET_PORT = 65412;
const TARGET_HOST = 'localhost';

const server = http.createServer((req, res) => {
    const requestUrl = new URL(req.url, `http://${req.headers.host}`);
    const filePath = requestUrl.searchParams.get('path');

    // Updated validation pattern (allows alphanumeric, underscores, dots, dashes)
    const validationPattern = /^[a-zA-Z0-9_-]*(?:(?:\.(?!\.))[a-zA-Z0-9_-]*)*[a-zA-Z0-9_-]$/;

    if (!filePath || filePath.length > 255 || !validationPattern.test(filePath)) {
        res.writeHead(400, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ message: 'Invalid file name.' }));
        return;
    }

    // Forward the request to the target server
    const options = {
        hostname: TARGET_HOST,
        port: TARGET_PORT,
        path: `/?path=${filePath}`,
        method: 'GET',
        headers: req.headers,
    };

    const proxyReq = http.request(options, (proxyRes) => {
        res.writeHead(proxyRes.statusCode, proxyRes.headers);
        proxyRes.pipe(res, { end: true });
    });

    proxyReq.on('error', (err) => {
        res.writeHead(500, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ message: 'Proxy request failed.' }));
    });

    req.pipe(proxyReq, { end: true });
});

server.listen(PORT, () => {
    console.log(`Proxy server running at http://localhost:${PORT}`);
});