Merge pull request #6317 from overleaf/jpa-send-explicit-content-type

[web] send explicit content type in responses

GitOrigin-RevId: d5aeaba57a7d2fc053fbf5adc2299fb46e435341

services/web/app/src/Features/Captcha/CaptchaMiddleware.js

@@ -47,7 +47,7 @@ module.exports = CaptchaMiddleware = {
               { statusCode: response.statusCode, body },
               'failed recaptcha siteverify request'
             )
-            return res.status(400).send({
+            return res.status(400).json({
               errorReason: 'cannot_verify_user_not_robot',
               message: {
                 text: 'Sorry, we could not verify that you are not a robot. Please check that Google reCAPTCHA is not being blocked by an ad blocker or firewall.',

services/web/app/src/Features/Collaborators/CollaboratorsInviteController.js

@@ -131,7 +131,7 @@ module.exports = CollaboratorsInviteController = {
             { projectId, email, sendingUserId },
             'invalid email address'
           )
-          return res.status(400).send({ errorReason: 'invalid_email' })
+          return res.status(400).json({ errorReason: 'invalid_email' })
         }
         return CollaboratorsInviteController._checkRateLimit(
           sendingUserId,

services/web/app/src/Features/Compile/CompileController.js

@@ -117,7 +117,7 @@ module.exports = CompileController = {
       if (error != null) {
         return next(error)
       }
-      return res.status(200).send()
+      return res.sendStatus(200)
     })
   },
 
@@ -159,15 +159,12 @@ module.exports = CompileController = {
         if (error != null) {
           return next(error)
         }
-        res.contentType('application/json')
-        return res.status(200).send(
-          JSON.stringify({
-            status,
-            outputFiles,
-            clsiServerId,
-            validationProblems,
-          })
-        )
+        return res.json({
+          status,
+          outputFiles,
+          clsiServerId,
+          validationProblems,
+        })
       }
     )
   },
@@ -564,8 +561,7 @@ module.exports = CompileController = {
           if (error != null) {
             return next(error)
           }
-          res.contentType('application/json')
-          return res.send(body)
+          return res.json(body)
         }
       )
     })

services/web/app/src/Features/Contacts/ContactController.js

@@ -70,7 +70,7 @@ module.exports = ContactsController = {
                 contacts = contacts.concat(
                   ...Array.from(additional_contacts || [])
                 )
-                return res.send({
+                return res.json({
                   contacts,
                 })
               }

services/web/app/src/Features/Contacts/ContactRouter.js

@@ -11,7 +11,7 @@ function contactsAuthenticationMiddleware() {
       if (SessionManager.isUserLoggedIn(req.session)) {
         next()
       } else {
-        res.send({ contacts: [] })
+        res.json({ contacts: [] })
       }
     }
   }

services/web/app/src/Features/Documents/DocumentController.js

@@ -5,6 +5,7 @@ const ProjectEntityHandler = require('../Project/ProjectEntityHandler')
 const ProjectEntityUpdateHandler = require('../Project/ProjectEntityUpdateHandler')
 const logger = require('@overleaf/logger')
 const _ = require('lodash')
+const { plainTextResponse } = require('../../infrastructure/Response')
 
 function getDocument(req, res, next) {
   const { Project_id: projectId, doc_id: docId } = req.params
@@ -47,8 +48,7 @@ function getDocument(req, res, next) {
                 return next(error)
               }
               if (plain) {
-                res.type('text/plain')
-                res.send(lines.join('\n'))
+                plainTextResponse(res, lines.join('\n'))
               } else {
                 const projectHistoryId = _.get(project, 'overleaf.history.id')
                 const projectHistoryDisplay = _.get(

services/web/app/src/Features/Downloads/ProjectDownloadsController.js

@@ -17,6 +17,7 @@ const Metrics = require('@overleaf/metrics')
 const ProjectGetter = require('../Project/ProjectGetter')
 const ProjectZipStreamManager = require('./ProjectZipStreamManager')
 const DocumentUpdaterHandler = require('../DocumentUpdater/DocumentUpdaterHandler')
+const { prepareZipAttachment } = require('../../infrastructure/Response')
 
 module.exports = ProjectDownloadsController = {
   downloadProject(req, res, next) {
@@ -41,10 +42,7 @@ module.exports = ProjectDownloadsController = {
                 if (error != null) {
                   return next(error)
                 }
-                res.setContentDisposition('attachment', {
-                  filename: `${project.name}.zip`,
-                })
-                res.contentType('application/zip')
+                prepareZipAttachment(res, `${project.name}.zip`)
                 return stream.pipe(res)
               }
             )
@@ -69,10 +67,10 @@ module.exports = ProjectDownloadsController = {
             if (error != null) {
               return next(error)
             }
-            res.setContentDisposition('attachment', {
-              filename: `Overleaf Projects (${project_ids.length} items).zip`,
-            })
-            res.contentType('application/zip')
+            prepareZipAttachment(
+              res,
+              `Overleaf Projects (${project_ids.length} items).zip`
+            )
             return stream.pipe(res)
           }
         )

services/web/app/src/Features/Errors/ErrorController.js

@@ -4,6 +4,7 @@ const logger = require('@overleaf/logger')
 const SessionManager = require('../Authentication/SessionManager')
 const SamlLogHandler = require('../SamlLog/SamlLogHandler')
 const HttpErrorHandler = require('./HttpErrorHandler')
+const { plainTextResponse } = require('../../infrastructure/Response')
 
 module.exports = ErrorController = {
   notFound(req, res) {
@@ -62,11 +63,11 @@ module.exports = ErrorController = {
     } else if (error instanceof Errors.InvalidError) {
       logger.warn({ err: error, url: req.url }, 'invalid error')
       res.status(400)
-      res.send(error.message)
+      plainTextResponse(res, error.message)
     } else if (error instanceof Errors.InvalidNameError) {
       logger.warn({ err: error, url: req.url }, 'invalid name error')
       res.status(400)
-      res.send(error.message)
+      plainTextResponse(res, error.message)
     } else if (error instanceof Errors.SAMLSessionDataMissing) {
       logger.warn(
         { err: error, url: req.url },

services/web/app/src/Features/Errors/HttpErrorHandler.js

@@ -1,5 +1,6 @@
 const logger = require('@overleaf/logger')
 const Settings = require('@overleaf/settings')
+const { plainTextResponse } = require('../../infrastructure/Response')
 
 function renderJSONError(res, message, info = {}) {
   if (info.message) {
@@ -23,7 +24,7 @@ function handleGeneric500Error(req, res, statusCode, message) {
     case 'json':
       return renderJSONError(res, message)
     default:
-      return res.send('internal server error')
+      return plainTextResponse(res, 'internal server error')
   }
 }
 
@@ -38,7 +39,7 @@ function handleGeneric400Error(req, res, statusCode, message, info = {}) {
     case 'json':
       return renderJSONError(res, message, info)
     default:
-      return res.send('client error')
+      return plainTextResponse(res, 'client error')
   }
 }
 
@@ -90,7 +91,7 @@ module.exports = HttpErrorHandler = {
       case 'json':
         return renderJSONError(res, message, info)
       default:
-        return res.send('conflict')
+        return plainTextResponse(res, 'conflict')
     }
   },
 
@@ -102,7 +103,7 @@ module.exports = HttpErrorHandler = {
       case 'json':
         return renderJSONError(res, message, info)
       default:
-        return res.send('restricted')
+        return plainTextResponse(res, 'restricted')
     }
   },
 
@@ -114,7 +115,7 @@ module.exports = HttpErrorHandler = {
       case 'json':
         return renderJSONError(res, message, info)
       default:
-        return res.send('not found')
+        return plainTextResponse(res, 'not found')
     }
   },
 
@@ -129,7 +130,7 @@ module.exports = HttpErrorHandler = {
       case 'json':
         return renderJSONError(res, message, info)
       default:
-        return res.send('unprocessable entity')
+        return plainTextResponse(res, 'unprocessable entity')
     }
   },
 
@@ -155,7 +156,7 @@ module.exports = HttpErrorHandler = {
       case 'json':
         return renderJSONError(res, message, {})
       default:
-        return res.send(message)
+        return plainTextResponse(res, message)
     }
   },
 }

services/web/app/src/Features/FileStore/FileStoreController.js

@@ -3,6 +3,7 @@ const logger = require('@overleaf/logger')
 const FileStoreHandler = require('./FileStoreHandler')
 const ProjectLocator = require('../Project/ProjectLocator')
 const Errors = require('../Errors/Errors')
+const { preparePlainTextResponse } = require('../../infrastructure/Response')
 
 module.exports = {
   getFile(req, res) {
@@ -34,7 +35,7 @@ module.exports = {
             }
             // mobile safari will try to render html files, prevent this
             if (isMobileSafari(userAgent) && isHtml(file)) {
-              res.setHeader('Content-Type', 'text/plain')
+              preparePlainTextResponse(res)
             }
             res.setContentDisposition('attachment', { filename: file.name })
             stream.pipe(res)
@@ -57,7 +58,7 @@ module.exports = {
         }
         return
       }
-      res.set('Content-Length', fileSize)
+      res.setHeader('Content-Length', fileSize)
       res.status(200).end()
     })
   },

services/web/app/src/Features/HealthCheck/HealthCheckController.js

@@ -12,7 +12,6 @@ module.exports = {
   check(req, res, next) {
     if (!settings.siteIsOpen || !settings.editorIsOpen) {
       // always return successful health checks when site is closed
-      res.contentType('application/json')
       res.sendStatus(200)
     } else {
       // detach from express for cleaner stack traces
@@ -92,9 +91,6 @@ module.exports = {
   },
 }
 
-function prettyJSON(blob) {
-  return JSON.stringify(blob, null, 2) + '\n'
-}
 async function runSmokeTestsDetached(req, res) {
   function isAborted() {
     return req.aborted
@@ -120,6 +116,5 @@ async function runSmokeTestsDetached(req, res) {
     response = { stats, error: err.message }
   }
   if (isAborted()) return
-  res.contentType('application/json')
-  res.status(status).send(prettyJSON(response))
+  res.status(status).json(response)
 }

services/web/app/src/Features/History/HistoryController.js

@@ -12,6 +12,7 @@ const ProjectDetailsHandler = require('../Project/ProjectDetailsHandler')
 const ProjectEntityUpdateHandler = require('../Project/ProjectEntityUpdateHandler')
 const RestoreManager = require('./RestoreManager')
 const { pipeline } = require('stream')
+const { prepareZipAttachment } = require('../../infrastructure/Response')
 
 module.exports = HistoryController = {
   selectHistoryApi(req, res, next) {
@@ -414,10 +415,7 @@ module.exports = HistoryController = {
               delete response.headers['content-disposition']
               delete response.headers['content-type']
               res.status(response.statusCode)
-              res.setContentDisposition('attachment', {
-                filename: `${name}.zip`,
-              })
-              res.contentType('application/zip')
+              prepareZipAttachment(res, `${name}.zip`)
               pipeline(response, res, err => {
                 if (err) {
                   logger.warn(

services/web/app/src/Features/InactiveData/InactiveProjectController.js

@@ -26,7 +26,7 @@ module.exports = {
         if (err != null) {
           return res.sendStatus(500)
         } else {
-          return res.send(projectsDeactivated)
+          return res.json(projectsDeactivated)
         }
       }
     )

services/web/app/src/Features/LinkedFiles/LinkedFilesController.js

@@ -37,6 +37,7 @@ const {
   FileCannotRefreshError,
 } = require('./LinkedFilesErrors')
 const Modules = require('../../infrastructure/Modules')
+const { plainTextResponse } = require('../../infrastructure/Response')
 
 module.exports = LinkedFilesController = {
   Agents: _.extend(
@@ -138,55 +139,70 @@ module.exports = LinkedFilesController = {
 
   handleError(error, req, res, next) {
     if (error instanceof AccessDeniedError) {
-      return res.status(403).send('You do not have access to this project')
+      res.status(403)
+      plainTextResponse(res, 'You do not have access to this project')
     } else if (error instanceof BadDataError) {
-      return res.status(400).send('The submitted data is not valid')
+      res.status(400)
+      plainTextResponse(res, 'The submitted data is not valid')
     } else if (error instanceof BadEntityTypeError) {
-      return res.status(400).send('The file is the wrong type')
+      res.status(400)
+      plainTextResponse(res, 'The file is the wrong type')
     } else if (error instanceof SourceFileNotFoundError) {
-      return res.status(404).send('Source file not found')
+      res.status(404)
+      plainTextResponse(res, 'Source file not found')
     } else if (error instanceof ProjectNotFoundError) {
-      return res.status(404).send('Project not found')
+      res.status(404)
+      plainTextResponse(res, 'Project not found')
     } else if (error instanceof V1ProjectNotFoundError) {
-      return res
-        .status(409)
-        .send(
-          'Sorry, the source project is not yet imported to Overleaf v2. Please import it to Overleaf v2 to refresh this file'
-        )
+      res.status(409)
+      plainTextResponse(
+        res,
+        'Sorry, the source project is not yet imported to Overleaf v2. Please import it to Overleaf v2 to refresh this file'
+      )
     } else if (error instanceof CompileFailedError) {
-      return res
-        .status(422)
-        .send(res.locals.translate('generic_linked_file_compile_error'))
+      res.status(422)
+      plainTextResponse(
+        res,
+        res.locals.translate('generic_linked_file_compile_error')
+      )
     } else if (error instanceof OutputFileFetchFailedError) {
-      return res.status(404).send('Could not get output file')
+      res.status(404)
+      plainTextResponse(res, 'Could not get output file')
     } else if (error instanceof UrlFetchFailedError) {
-      return res
-        .status(422)
-        .send(
-          `Your URL could not be reached (${error.statusCode} status code). Please check it and try again.`
-        )
+      res.status(422)
+      plainTextResponse(
+        res,
+        `Your URL could not be reached (${error.statusCode} status code). Please check it and try again.`
+      )
     } else if (error instanceof InvalidUrlError) {
-      return res
-        .status(422)
-        .send('Your URL is not valid. Please check it and try again.')
+      res.status(422)
+      plainTextResponse(
+        res,
+        'Your URL is not valid. Please check it and try again.'
+      )
     } else if (error instanceof NotOriginalImporterError) {
-      return res
-        .status(400)
-        .send('You are not the user who originally imported this file')
+      res.status(400)
+      plainTextResponse(
+        res,
+        'You are not the user who originally imported this file'
+      )
     } else if (error instanceof FeatureNotAvailableError) {
-      return res.status(400).send('This feature is not enabled on your account')
+      res.status(400)
+      plainTextResponse(res, 'This feature is not enabled on your account')
     } else if (error instanceof RemoteServiceError) {
-      return res.status(502).send('The remote service produced an error')
+      res.status(502)
+      plainTextResponse(res, 'The remote service produced an error')
     } else if (error instanceof FileCannotRefreshError) {
-      return res.status(400).send('This file cannot be refreshed')
+      res.status(400)
+      plainTextResponse(res, 'This file cannot be refreshed')
     } else if (error.message === 'project_has_too_many_files') {
-      return res.status(400).send('too many files')
+      res.status(400)
+      plainTextResponse(res, 'too many files')
     } else if (/\bECONNREFUSED\b/.test(error.message)) {
-      return res
-        .status(500)
-        .send('Importing references is not currently available')
+      res.status(500)
+      plainTextResponse(res, 'Importing references is not currently available')
     } else {
-      return next(error)
+      next(error)
     }
   },
 }

services/web/app/src/Features/Notifications/NotificationsController.js

@@ -21,7 +21,7 @@ module.exports = {
             return notification
           }
         )
-        res.send(unreadNotifications)
+        res.json(unreadNotifications)
       }
     )
   },

services/web/app/src/Features/Project/ProjectController.js

@@ -249,7 +249,7 @@ const ProjectController = {
     const { projectName } = req.body
     logger.log({ projectId, projectName }, 'cloning project')
     if (!SessionManager.isUserLoggedIn(req.session)) {
-      return res.send({ redir: '/register' })
+      return res.json({ redir: '/register' })
     }
     const currentUser = SessionManager.getSessionUser(req.session)
     const { first_name: firstName, last_name: lastName, email } = currentUser
@@ -265,7 +265,7 @@ const ProjectController = {
           })
           return next(err)
         }
-        res.send({
+        res.json({
           name: project.name,
           project_id: project._id,
           owner_ref: project.owner_ref,
@@ -306,7 +306,7 @@ const ProjectController = {
         if (err != null) {
           return next(err)
         }
-        res.send({
+        res.json({
           project_id: project._id,
           owner_ref: project.owner_ref,
           owner: {

services/web/app/src/Features/Spelling/SpellingController.js

@@ -27,14 +27,14 @@ module.exports = {
     if (url === '/check') {
       if (!language) {
         logger.error('"language" field should be included for spell checking')
-        return res.status(422).send(JSON.stringify({ misspellings: [] }))
+        return res.status(422).json({ misspellings: [] })
       }
 
       if (!languageCodeIsSupported(language)) {
         // this log statement can be changed to 'error' once projects with
         // unsupported languages are removed from the DB
         logger.info({ language }, 'language not supported')
-        return res.status(422).send(JSON.stringify({ misspellings: [] }))
+        return res.status(422).json({ misspellings: [] })
       }
     }
 

services/web/app/src/Features/Uploads/ProjectUploadController.js

@@ -60,7 +60,7 @@ module.exports = ProjectUploadController = {
             })
           }
         } else {
-          return res.send({ success: true, project_id: project._id })
+          return res.json({ success: true, project_id: project._id })
         }
       }
     )
@@ -77,7 +77,7 @@ module.exports = ProjectUploadController = {
         { projectId: project_id, fileName: name },
         'bad name when trying to upload file'
       )
-      return res.status(422).send({
+      return res.status(422).json({
         success: false,
         error: 'invalid_filename',
       })
@@ -106,20 +106,20 @@ module.exports = ProjectUploadController = {
             'error uploading file'
           )
           if (error.name === 'InvalidNameError') {
-            return res.status(422).send({
+            return res.status(422).json({
               success: false,
               error: 'invalid_filename',
             })
           } else if (error.message === 'project_has_too_many_files') {
-            return res.status(422).send({
+            return res.status(422).json({
               success: false,
               error: 'project_has_too_many_files',
             })
           } else {
-            return res.status(422).send({ success: false })
+            return res.status(422).json({ success: false })
           }
         } else {
-          return res.send({
+          return res.json({
             success: true,
             entity_id: entity != null ? entity._id : undefined,
             entity_type: entity != null ? entity.type : undefined,

services/web/app/src/Features/UserMembership/UserMembershipController.js

@@ -14,6 +14,7 @@ const SessionManager = require('../Authentication/SessionManager')
 const UserMembershipHandler = require('./UserMembershipHandler')
 const Errors = require('../Errors/Errors')
 const EmailHelper = require('../Helpers/EmailHelper')
+const { csvAttachment } = require('../../infrastructure/Response')
 const CSVParser = require('json2csv').Parser
 
 module.exports = {
@@ -146,9 +147,7 @@ module.exports = {
           return next(error)
         }
         const csvParser = new CSVParser({ fields })
-        res.header('Content-Disposition', 'attachment; filename=Group.csv')
-        res.contentType('text/csv')
-        return res.send(csvParser.parse(users))
+        csvAttachment(res, csvParser.parse(users), 'Group.csv')
       }
     )
   },

services/web/app/src/infrastructure/Response.js

@@ -0,0 +1,48 @@
+function csvAttachment(res, body, filename) {
+  if (!filename || !filename.endsWith('.csv')) {
+    throw new Error('filename must end with .csv')
+  }
+  // res.attachment sets both content-type and content-disposition headers.
+  res.attachment(filename)
+  res.setHeader('X-Content-Type-Options', 'nosniff')
+  res.send(body)
+}
+
+function preparePlainTextResponse(res) {
+  res.setHeader('X-Content-Type-Options', 'nosniff')
+  res.contentType('text/plain; charset=utf-8')
+}
+
+function plainTextResponse(res, body) {
+  preparePlainTextResponse(res)
+  res.send(body)
+}
+
+function xmlResponse(res, body) {
+  res.setHeader('X-Content-Type-Options', 'nosniff')
+  res.contentType('application/xml; charset=utf-8')
+  res.send(body)
+}
+
+function prepareZipAttachment(res, filename) {
+  if (!filename || !filename.endsWith('.zip')) {
+    throw new Error('filename must end with .zip')
+  }
+  // res.attachment sets both content-type and content-disposition headers.
+  res.attachment(filename)
+  res.setHeader('X-Content-Type-Options', 'nosniff')
+}
+
+function zipAttachment(res, body, filename) {
+  prepareZipAttachment(res, filename)
+  res.send(body)
+}
+
+module.exports = {
+  csvAttachment,
+  plainTextResponse,
+  preparePlainTextResponse,
+  prepareZipAttachment,
+  xmlResponse,
+  zipAttachment,
+}

services/web/app/src/router.js

@@ -61,6 +61,7 @@ const {
 const logger = require('@overleaf/logger')
 const _ = require('underscore')
 const { expressify } = require('./util/promises')
+const { plainTextResponse } = require('./infrastructure/Response')
 
 module.exports = { initialize }
 
@@ -1018,23 +1019,27 @@ function initialize(webRouter, privateApiRouter, publicApiRouter) {
     AdminController.unregisterServiceWorker
   )
 
-  privateApiRouter.get('/perfTest', (req, res) => res.send('hello'))
+  privateApiRouter.get('/perfTest', (req, res) => {
+    plainTextResponse(res, 'hello')
+  })
 
   publicApiRouter.get('/status', (req, res) => {
     if (!Settings.siteIsOpen) {
-      res.send('web site is closed (web)')
+      plainTextResponse(res, 'web site is closed (web)')
     } else if (!Settings.editorIsOpen) {
-      res.send('web editor is closed (web)')
+      plainTextResponse(res, 'web editor is closed (web)')
     } else {
-      res.send('web sharelatex is alive (web)')
+      plainTextResponse(res, 'web sharelatex is alive (web)')
     }
   })
-  privateApiRouter.get('/status', (req, res) =>
-    res.send('web sharelatex is alive (api)')
-  )
+  privateApiRouter.get('/status', (req, res) => {
+    plainTextResponse(res, 'web sharelatex is alive (api)')
+  })
 
   // used by kubernetes health-check and acceptance tests
-  webRouter.get('/dev/csrf', (req, res) => res.send(res.locals.csrfToken))
+  webRouter.get('/dev/csrf', (req, res) => {
+    plainTextResponse(res, res.locals.csrfToken)
+  })
 
   publicApiRouter.get(
     '/health_check',
@@ -1085,7 +1090,7 @@ function initialize(webRouter, privateApiRouter, publicApiRouter) {
       const projectId = req.params.Project_id
       const sendRes = _.once(function (statusCode, message) {
         res.status(statusCode)
-        res.send(message)
+        plainTextResponse(res, message)
         ClsiCookieManager.clearServerId(projectId)
       }) // force every compile to a new server
       // set a timeout