From 9a5aa72b0d439baa3924c51ee33ca39e451437ea Mon Sep 17 00:00:00 2001 From: Umputun Date: Thu, 22 Mar 2018 20:11:57 -0500 Subject: [PATCH] hash user ip --- app/migrator/remark_test.go | 6 ++++-- app/rest/api/rest_test.go | 2 +- app/store/bolt.go | 15 --------------- app/store/bolt_test.go | 7 ++++--- app/store/comment.go | 7 +++---- app/store/comment_test.go | 24 ------------------------ app/store/service.go | 21 +++++++++++++++++++++ 7 files changed, 33 insertions(+), 49 deletions(-) diff --git a/app/migrator/remark_test.go b/app/migrator/remark_test.go index 364b314f..3d243a8e 100644 --- a/app/migrator/remark_test.go +++ b/app/migrator/remark_test.go @@ -54,12 +54,14 @@ func TestRemark_Import(t *testing.T) { } // makes new boltdb, put two records -func prep(t *testing.T) *store.BoltDB { +func prep(t *testing.T) *store.Service { os.Remove(testDb) - b, err := store.NewBoltDB(store.BoltSite{SiteID: "radio-t", FileName: testDb}) + boltStore, err := store.NewBoltDB(store.BoltSite{SiteID: "radio-t", FileName: testDb}) assert.Nil(t, err) + b := &store.Service{Interface: boltStore} + comment := store.Comment{ ID: "efbc17f177ee1a1c0ee6e1e025749966ec071adc", Text: `some text, link`, diff --git a/app/rest/api/rest_test.go b/app/rest/api/rest_test.go index 7e09c799..d4902b41 100644 --- a/app/rest/api/rest_test.go +++ b/app/rest/api/rest_test.go @@ -96,7 +96,7 @@ func TestServer_CreateAndGet(t *testing.T) { assert.Equal(t, "

test 123 http://radio-t.com

", comment.Text) assert.Equal(t, store.User{Name: "developer one", ID: "dev", Picture: "/api/v1/avatar/remark.image", - Profile: "https://remark42.com", Admin: true, Blocked: false, IP: "127.0.0.1"}, + Profile: "https://remark42.com", Admin: true, Blocked: false, IP: "4b84b15bff6ee5796152495a230e45e3d7e947d9"}, comment.User) t.Logf("%+v", comment) } diff --git a/app/store/bolt.go b/app/store/bolt.go index 1feb1635..9ae54ccf 100644 --- a/app/store/bolt.go +++ b/app/store/bolt.go @@ -9,7 +9,6 @@ import ( "time" "github.com/coreos/bbolt" - "github.com/google/uuid" "github.com/pkg/errors" ) @@ -81,20 +80,6 @@ func NewBoltDB(sites ...BoltSite) (*BoltDB, error) { // Create saves new comment to store. Adds to posts bucket, reference to last and user bucket and increments count bucket func (b *BoltDB) Create(comment Comment) (commentID string, err error) { - // fill ID and time if empty - if comment.ID == "" { - comment.ID = uuid.New().String() - } - if comment.Timestamp.IsZero() { - comment.Timestamp = time.Now() - } - // reset votes if nothing - if comment.Votes == nil { - comment.Votes = make(map[string]bool) - } - - comment.sanitize() // clear potentially dangerous js from all parts of comment - bdb, err := b.db(comment.Locator.SiteID) if err != nil { return "", err diff --git a/app/store/bolt_test.go b/app/store/bolt_test.go index b94057c2..8664bc2f 100644 --- a/app/store/bolt_test.go +++ b/app/store/bolt_test.go @@ -11,7 +11,7 @@ import ( var testDb = "/tmp/test-remark.db" func TestBoltDB_CreateAndFind(t *testing.T) { - var b Interface = prep(t) + var b = prep(t) defer os.Remove(testDb) res, err := b.Find(Locator{URL: "https://radio-t.com", SiteID: "radio-t"}, "time") @@ -190,11 +190,12 @@ func TestBoltDB_GetForUser(t *testing.T) { } // makes new boltdb, put two records -func prep(t *testing.T) *BoltDB { +func prep(t *testing.T) *Service { os.Remove(testDb) - b, err := NewBoltDB(BoltSite{FileName: "/tmp/test-remark.db", SiteID: "radio-t"}) + boltStore, err := NewBoltDB(BoltSite{FileName: "/tmp/test-remark.db", SiteID: "radio-t"}) assert.Nil(t, err) + b := &Service{Interface: boltStore} comment := Comment{ ID: "id-1", diff --git a/app/store/comment.go b/app/store/comment.go index 4c7fd250..e2ce04c0 100644 --- a/app/store/comment.go +++ b/app/store/comment.go @@ -97,8 +97,8 @@ func (c *Comment) sanitize() { c.Text = strings.Replace(c.Text, "\t", "", -1) } -// HashUserFields replace sensitive fields with hashes -func (c *Comment) hashUserFields() { +// hashIP replace sensitive fields with hashes +func (u *User) hashIP() { hashVal := func(val string) string { if _, err := strconv.ParseUint(val, 16, 64); err == nil || val == "" { @@ -112,6 +112,5 @@ func (c *Comment) hashUserFields() { return fmt.Sprintf("%x", h.Sum(nil)) } - c.User.IP = hashVal(c.User.IP) - c.User.ID = hashVal(c.User.ID) + u.IP = hashVal(u.IP) } diff --git a/app/store/comment_test.go b/app/store/comment_test.go index 39c1c1dc..0c662a90 100644 --- a/app/store/comment_test.go +++ b/app/store/comment_test.go @@ -58,27 +58,3 @@ func TestComment_PrepareUntrusted(t *testing.T) { assert.Equal(t, User{ID: "username"}, comment.User) } - -func TestComment_HashUserFields(t *testing.T) { - tbl := []struct { - inp Comment - out Comment - }{ - {inp: Comment{}, out: Comment{}}, - { - inp: Comment{ - Text: "blah", - User: User{ID: "my id", IP: "127.0.0.1"}, - }, - out: Comment{ - Text: "blah", - User: User{ID: "de58071dda71e1783b6deb931ddb48bb66966f79", IP: "4b84b15bff6ee5796152495a230e45e3d7e947d9"}, - }, - }, - } - - for n, tt := range tbl { - tt.inp.hashUserFields() - assert.Equal(t, tt.out, tt.inp, "check #%d", n) - } -} diff --git a/app/store/service.go b/app/store/service.go index ca38d3ea..728f7b16 100644 --- a/app/store/service.go +++ b/app/store/service.go @@ -3,6 +3,7 @@ package store import ( "time" + "github.com/google/uuid" "github.com/pkg/errors" ) @@ -12,6 +13,26 @@ type Service struct { EditDuration time.Duration } +// Create prepares comment and forward to Interface.Create +func (s *Service) Create(comment Comment) (commentID string, err error) { + // fill ID and time if empty + if comment.ID == "" { + comment.ID = uuid.New().String() + } + if comment.Timestamp.IsZero() { + comment.Timestamp = time.Now() + } + // reset votes if nothing + if comment.Votes == nil { + comment.Votes = make(map[string]bool) + } + + comment.sanitize() // clear potentially dangerous js from all parts of comment + comment.User.hashIP() // replace ip by hash + + return s.Interface.Create(comment) +} + // SetPin pin/un-pin comment as special func (s *Service) SetPin(locator Locator, commentID string, status bool) error { comment, err := s.Get(locator, commentID)