[Node.js] 19. 입력 정보에 대한 보안

해당 게시물은 유튜브 생활코딩 "Node.js" 강의 영상을 참고했습니다.
(https://www.youtube.com/watch?v=3RS_A87IAPA&list=PLuHgQVnccGMA9QQX5wqj6ThK7t2tsGxjm&index=1)

 

 

 파일명: password.js

module.exports = {
    id: 'egoing',
    password: '111111'
}

>> 위와 같은 모듈을 만들었을 때, 아래와 같이 경로를 통해서 password 정보에 접근 가능 

 

이를 막는 필터링 과정을 코드에 추가

var http = require('http');
var fs = require('fs');
var url = require('url');
var qs = require('querystring');
var path = require('path');

var template = require('./lib/template.js');

var app = http.createServer(function(request,response){
    var _url = request.url;
    var queryData = url.parse(_url, true).query;
    var pathname = url.parse(_url, true).pathname

    if(pathname === '/') {
        if(queryData.id === undefined) {
          fs.readdir('./data', function(error, filelist) {
            var title = 'Welcome';
            var description = 'Hello, Node.js';

            var list = template.list(filelist);
            var html = template.HTML(title, list, 
              `<h2>${title}</h2>${description}`, 
              `<a href = "/create">create</a>`
            ); 
            response.writeHead(200);
            response.end(html);
          })
        } else {
          fs.readdir('./data', function(error, filelist) {
            var filterdId = path.parse(queryData.id).base;  //필터링
            fs.readFile(`data/${filterdId}`, 'utf8', function(err, description) {
              var title = queryData.id;
              var list = template.list(filelist);
              var html = template.HTML(title, list, 
                `<h2>${title}</h2>${description}`, 
                `<a href = "/create">create</a> 
                 <a href = "/update?id=${title}">update</a>
                 <form action="delete_process" method="post">
                  <input type="hidden" name="id" value="${title}">
                  <input type="submit" value="delete">
                 </form>`  
              ); 
              response.writeHead(200);
              response.end(html);
            });
          });
        }
    } else if(pathname === '/create') {
      fs.readdir('./data', function(error, filelist) {
        var title = 'Web - create';
        var list = template.list(filelist);
        var html = template.HTML(title, list, `
        <form action = "/create_process" method = "post">
          <p><input type = "text" name = "title" placeholder = "title"></p>
          <p>
            <textarea name = "description" placeholder = "description"></textarea>
          </p>
          <p>
            <input type = "submit">
          </p>
        </form>
        `, '');
        response.writeHead(200);
        response.end(html);
      }); 
    } else if(pathname === '/create_process') {
      var body = '';
      request.on('data', function(data) {
        body += data;
      });
      request.on('end', function() {
        var post = qs.parse(body);
        var title = post.title;
        var description = post.description
        fs.writeFile(`data/${title}`, description, 'utf8', function(err) {
          response.writeHead(302, {Location: `/?id=${title}`});
          response.end();
        })
      });
    } else if (pathname === '/update') {
      fs.readdir('./data', function(error, filelist) {
        var filterdId = path.parse(queryData.id).base;   //필터링
        fs.readFile(`data/${filterdId}`, 'utf8', function(err, description) {
          var title = queryData.id;
          var list = template.list(filelist);
          var html = template.HTML(title, list,
            `
            <form action = "/update_process" method = "post">
            <input type = "hidden" name="id" value = "${title}">
            <p><input type = "text" name = "title" placeholder = "title" value = "${title}"></p>
            <p>
              <textarea name = "description" placeholder = "description">value = "${description}"</textarea>
            </p>
            <p>
              <input type = "submit">
            </p>
          </form>
            `, 
            `<a href = "/create">create</a> <a href = "/update?id=${title}">update</a>`  
          ); 
          response.writeHead(200);
          response.end(html);
        });
      });
    } else if (pathname === '/update_process') {
      var body = '';
      request.on('data', function(data) {
        body += data;
      });
      request.on('end', function() {
        var post = qs.parse(body);
        var id = post.id;
        var filterdId = path.parse(id).base;  //필터링
        var title = post.title;
        var description = post.description;
        fs.rename(`data/${filterdId}`, `data/${title}`, function(error) {
          fs.writeFile(`data/${title}`, description, 'utf8', function(err) {
            response.writeHead(302, {Location: `/?id=${title}`});
            response.end();
          })
        });
      });
    } else if (pathname === '/delete_process') {
      var body = '';
      request.on('data', function(data) {
        body += data;
      });
      request.on('end', function() {
        var post = qs.parse(body);
        var id = post.id;
        var filterdId = path.parse(id).base;  //필터링
        fs.unlink(`data/${filterdId}`, function(error) {
          response.writeHead(302, {Location: `/`});
          response.end();
        })
      });
    } else {
      response.writeHead(404);
      response.end('Not found')
    }
});
app.listen(3000);

 

>> 보안 처리 완료