backend user input handling

backend/config/constants.js

@@ -7,8 +7,8 @@ constants.amazonResultCodes = {
   UNAUTHORIZED: 401,
   NOT_FOUND: 404,
   CONFLICT: 409,
-    PAYLOAD_TOO_LARGE:413
+  PAYLOAD_TOO_LARGE: 413,
-}
+};
 
 constants.apiResultCodes = {
   GENERIC_ERROR: -1,
@@ -18,11 +18,12 @@ constants.apiResultCodes = {
   DATABASE_ERROR: 3,
   NO_SKILL: 4,
   INCONSISTENT_STATE: 5,
-}
+  INVALID_SKILL: 6,
+};
 
 constants.HTTPResultCodes = {
   INTERNAL_SERVER_ERROR: 500,
-}
+};
 
 constants.SKILL_ID_LENGTH = 24;
 
@@ -30,14 +31,31 @@ constants.voiceResponseStrings = {
   QUESTION_NOT_FOUND: 'Sorry, I didnt understand',
   GENERIC_CONTINUE: 'Say something to continue',
   DIDNT_ASK_ANYTHING: 'There was no question to answer to',
-}
+};
 
 //Timing is given in [ms]
 constants.voiceResponseTimings = {
   PAUSE_BETWEEN_QUESTIONS: 650,
   PAUSE_AFTER_WELCOME_MESSAGE: 650,
-}
+};
 
+constants.stringConstraints = {
+  INTENT_EXPLANATION_MAX_LENGTH: 70,
 
+  INTENT_NAME_MAX_LENGTH: 30,
+  INTENT_NAME_MIN_LENGTH: 2,
+
+  QUESTION_MAX_LENGTH: 150,
+  QUESTION_MIN_LENGTH: 2,
+
+  ANSWER_MAX_LENGTH: 150,
+  ANSWER_MIN_LENGTH: 2,
+
+  INVOCATION_NAME_MAX_LENGTH: 50,
+  INVOCATION_NAME_MIN_LENGTH: 2,
+  INVOCATION_ANSWER_MAX_LENGTH: 100,
+
+  EMAIL_MAX_LENGTH: 100,
+};
 
 module.exports = constants;

backend/controllers/skill.js

@@ -2,6 +2,7 @@ var express = require ('express'), router = express.Router ();
 const constants = require ('../config/constants');
 var databaseHelper = require ('../helpers/database');
 var amazonHelper = require ('../helpers/amazon');
+var skillValidator = require('../helpers/skillValidator');
 var bodyParser = require ('body-parser');
 var alexa = require ('../models/alexa');
 
@@ -31,6 +32,20 @@ router.put ('/:id', bodyParser.json (), async (req, res, next) => {
   delete skill.updateOnAmazon;
   delete skill._id;
 
+  //Validate skill
+  if (!skillValidator.validateSkill(skill)){
+    //skill not valid
+    res
+    .status (
+      constants.HTTPResultCodes.INTERNAL_SERVER_ERROR
+    )
+    .json ({
+      result: constants.apiResultCodes.INVALID_SKILL,
+      message: '',
+    });
+    return;
+  }
+
   //First get current skill from DB
   databaseHelper
     .getSkill (id)

backend/helpers/skillValidator.js

@@ -0,0 +1,100 @@
+const constants = require ('../config/constants');
+
+validateEmail = function (email) {
+  if (email.length > constants.stringConstraints.EMAIL_MAX_LENGTH) return false;
+  let validEmailRegex = /^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
+  return validEmailRegex.test (email);
+};
+
+validateIntentName = function (intentName) {
+  if (
+    intentName.length < constants.stringConstraints.INTENT_NAME_MIN_LENGTH ||
+    intentName.length > constants.stringConstraints.INTENT_NAME_MAX_LENGTH
+  )
+    return false;
+  let validIntentNameRegex = /^[a-z]*$/i;
+  return validIntentNameRegex.test (intentName);
+};
+
+validateQuestion = function (question) {
+  if (
+    question.length < constants.stringConstraints.QUESTION_MIN_LENGTH ||
+    question.length > constants.stringConstraints.QUESTION_MAX_LENGTH
+  )
+    return false;
+  let validQuestionNameRegex = /^[a-z,.' ]*$/i;
+  return validQuestionNameRegex.test (question);
+};
+
+validateAnswer = function (answer) {
+  if (
+    answer.length < constants.stringConstraints.ANSWER_MIN_LENGTH ||
+    answer.length > constants.stringConstraints.ANSWER_MAX_LENGTH
+  )
+    return false;
+  let validAnswerRegex = /^[a-z,.' ]*$/i;
+  return validAnswerRegex.test (answer);
+};
+
+validateInvocationName = function (invocationName) {
+  if (
+    invocationName.length < constants.stringConstraints.INVOCATION_NAME_MIN_LENGTH ||
+    invocationName.length > constants.stringConstraints.INVOCATION_NAME_MAX_LENGTH
+  )
+    return false;
+  let validInvocationNameRegex = /^[a-z,.' ]*$/i;
+  return validInvocationNameRegex.test (invocationName);
+};
+
+validateInvocationAnswer = function (invocationAnswer) {
+  if (invocationAnswer.length > constants.stringConstraints.INVOCATION_ANSWER_MAX_LENGTH)
+    return false;
+  let validInvocationAnswerRegex = /^[a-z,.' ]*$/i;
+  return validInvocationAnswerRegex.test (invocationAnswer);
+};
+
+validateIntentExplanation = function (explanation) {
+  if (explanation.length > constants.stringConstraints.INTENT_EXPLANATION_MAX_LENGTH)
+    return false;
+  let validExplanationRegex = /^[a-z,.' ]*$/i;
+  return validExplanationRegex.test (explanation);
+};
+
+module.exports = {
+  validateSkill: function (skill) {
+    try {
+      if (
+        !validateEmail (skill.contactEmail) ||
+        !validateInvocationName (skill.invocationName) ||
+        !validateInvocationAnswer (skill.invocationAnswer)
+      )
+        return false;
+
+      for (let i = 0; i < skill.intents.length; i++) {
+        if (!validateIntentName (skill.intents[i].intentName)) return false;
+        if (!validateAnswer (skill.intents[i].answer)) return false;
+
+        for (let j = 0; j < skill.intents.length; j++) {
+          if (i === j) continue;
+          if (skill.intents[i].intentName === skill.intents[j].intentName)
+            return false;
+        }
+
+        for (let j = 0; j < skill.intents[i].questions.length; j++) {
+          if (!validateQuestion (skill.intents[i].questions[j])) return false;
+
+          for (let k = 0; k < skill.intents[i].questions.length; k++) {
+            if (j === k) continue;
+            if (skill.intents[i].questions[j] === skill.intents[i].questions[k])
+              return false;
+          }
+        }
+      }
+
+      return true;
+    } catch (e) {
+      console.log ('Error : ' + e);
+      return false;
+    }
+  },
+};