fix: security and reliability fixes for home page and invoice handlers

Author: CKodidela

resources/get-invoice.html

@@ -46,7 +46,7 @@ <h1 class="mt-4 mb-4 text-center text-nowrap">{{name}}</h1>
               <div class="form-check">
                 <input class="form-check-input" type="checkbox" id="tosAccepted" name="tosAccepted" value="yes" required>
                 <label class="form-check-label" for="tosAccepted">
-                  I have read and agree to the <a href="/terms" class="card-link" target="_blank">Terms of Service</a>
+                  I have read and agree to the <a href="/terms" class="card-link" target="_blank" rel="noopener noreferrer">Terms of Service</a>
                 </label>
               </div>
             </div>
@@ -60,7 +60,7 @@ <h1 class="mt-4 mb-4 text-center text-nowrap">{{name}}</h1>
         </div>
         <div class="row d-none" id="powered-by-zebedee">
           <div class="d-flex justify-content-center mb-3 mt-4">
-            <a href="https://zeb.gg/nostr-zbd-quickstart" target="_blank">
+            <a href="https://zeb.gg/nostr-zbd-quickstart" target="_blank" rel="noopener noreferrer">
               <img class="poweredbyzbd-img" src="https://cdn.zebedee.io/an/nostr/poweredbyzbd.png" />
             </a>
           </div>

resources/index.html

@@ -28,7 +28,7 @@ <h1 class="mt-4 mb-2 text-center text-nowrap">{{name}}</h1>
             <div class="card-body">
               <h5 class="card-title">Nostr Relay</h5>
               <p class="card-text">
-                This is a <a href="https://github.com/nostr-protocol/nostr" target="_blank">Nostr</a> relay.
+                This is a <a href="https://github.com/nostr-protocol/nostr" target="_blank" rel="noopener noreferrer">Nostr</a> relay.
                 To use it, connect with a Nostr client using the address below.
               </p>
               <p class="card-text">

resources/invoices.html

@@ -74,7 +74,7 @@ <h2 class="text-danger">Invoice expired!</h2>
         <div class="row pending d-none">
           <div class="col">
             <div class="d-flex justify-content-center mb-3">
-              <button id="sendPaymentBtn" class="btn btn-lg btn-warning d-none" type="submit">Pay with wallet</button>
+              <button id="sendPaymentBtn" class="btn btn-lg btn-warning d-none" type="button">Pay with wallet</button>
             </div>
           </div>
         </div>
@@ -88,7 +88,7 @@ <h2 class="text-danger">Invoice expired!</h2>
         </div>
         <div class="row d-none" id="powered-by-zebedee">
           <div class="d-flex justify-content-center mb-3 mt-4">
-            <a href="https://zeb.gg/nostr-zbd-quickstart" target="_blank">
+            <a href="https://zeb.gg/nostr-zbd-quickstart" target="_blank" rel="noopener noreferrer">
               <img class="poweredbyzbd-img" src="https://cdn.zebedee.io/an/nostr/poweredbyzbd.png" />
             </a>
           </div>
@@ -152,7 +152,7 @@ <h2 class="text-danger">Invoice expired!</h2>
         })
       }
 
-      fallbackTimeout = setTimeout(getInvoiceStatus, getBackoffTime)
+      fallbackTimeout = setTimeout(getInvoiceStatus, getBackoffTime())
 
       function connect() {
         var socket = new WebSocket(relayUrl)

resources/post-invoice.html

@@ -74,7 +74,7 @@ <h2 class="text-danger">Invoice expired!</h2>
         <div class="row pending d-none">
           <div class="col">
             <div class="d-flex justify-content-center mb-3">
-              <button id="sendPaymentBtn" class="btn btn-lg btn-warning d-none" type="submit">Pay with wallet</button>
+              <button id="sendPaymentBtn" class="btn btn-lg btn-warning d-none" type="button">Pay with wallet</button>
             </div>
           </div>
         </div>
@@ -88,7 +88,7 @@ <h2 class="text-danger">Invoice expired!</h2>
         </div>
         <div class="row d-none" id="powered-by-zebedee">
           <div class="d-flex justify-content-center mb-3 mt-4">
-            <a href="https://zeb.gg/nostr-zbd-quickstart" target="_blank">
+            <a href="https://zeb.gg/nostr-zbd-quickstart" target="_blank" rel="noopener noreferrer">
               <img class="poweredbyzbd-img" src="https://cdn.zebedee.io/an/nostr/poweredbyzbd.png" />
             </a>
           </div>
@@ -152,7 +152,7 @@ <h2 class="text-danger">Invoice expired!</h2>
         })
       }
 
-      fallbackTimeout = setTimeout(getInvoiceStatus, getBackoffTime)
+      fallbackTimeout = setTimeout(getInvoiceStatus, getBackoffTime())
 
       function connect() {
         var socket = new WebSocket(relayUrl)

src/handlers/request-handlers/get-privacy-request-handler.ts

@@ -6,10 +6,15 @@ import { createSettings as settings } from '../../factories/settings-factory'
 export const getPrivacyRequestHandler = (_req: Request, res: Response, next: NextFunction) => {
   const { info: { name } } = settings()
 
-  const page = readFileSync('./resources/privacy.html', 'utf8')
-    .replaceAll('{{name}}', name)
-    .replaceAll('{{nonce}}', res.locals.nonce)
+  let page: string
+  try {
+    page = readFileSync('./resources/privacy.html', 'utf8')
+      .replaceAll('{{name}}', name)
+      .replaceAll('{{nonce}}', res.locals.nonce)
+  } catch (err) {
+    next(err)
+    return
+  }
 
   res.status(200).setHeader('content-type', 'text/html; charset=utf8').send(page)
-  next()
 }

src/handlers/request-handlers/get-terms-request-handler.ts

@@ -8,10 +8,15 @@ import { createSettings as settings } from '../../factories/settings-factory'
 export const getTermsRequestHandler = (_req: Request, res: Response, next: NextFunction) => {
   const { info: { name } } = settings()
 
-  const page = readFileSync('./resources/terms.html', 'utf8')
-    .replaceAll('{{name}}', name)
-    .replaceAll('{{nonce}}', res.locals.nonce)
+  let page: string
+  try {
+    page = readFileSync('./resources/terms.html', 'utf8')
+      .replaceAll('{{name}}', name)
+      .replaceAll('{{nonce}}', res.locals.nonce)
+  } catch (err) {
+    next(err)
+    return
+  }
 
   res.status(200).setHeader('content-type', 'text/html; charset=utf8').send(page)
-  next()
 }

src/handlers/request-handlers/root-request-handler.ts

@@ -74,21 +74,27 @@ export const rootRequestHandler = (request: Request, response: Response, next: N
     return
   }
 
-  const admissionFeeEnabled = pathEq(['payments', 'feeSchedules', 'admission', '0', 'enabled'], true, settings)
+  const admissionFeeEnabled = pathEq(['payments', 'enabled'], true, settings)
+    && pathEq(['payments', 'feeSchedules', 'admission', '0', 'enabled'], true, settings)
   const admissionFee = path<FeeSchedule>(['payments', 'feeSchedules', 'admission', '0'], settings)
   const amount = admissionFeeEnabled && admissionFee
     ? (BigInt(admissionFee.amount) / 1000n).toString()
     : '0'
 
-  const page = readFileSync('./resources/index.html', 'utf8')
-    .replaceAll('{{name}}', settings.info.name)
-    .replaceAll('{{description}}', settings.info.description ?? '')
-    .replaceAll('{{relay_url}}', settings.info.relay_url)
-    .replaceAll('{{amount}}', amount)
-    .replaceAll('{{payments_section_class}}', admissionFeeEnabled ? '' : 'd-none')
-    .replaceAll('{{no_payments_section_class}}', admissionFeeEnabled ? 'd-none' : '')
-    .replaceAll('{{nonce}}', response.locals.nonce)
+  let page: string
+  try {
+    page = readFileSync('./resources/index.html', 'utf8')
+      .replaceAll('{{name}}', settings.info.name)
+      .replaceAll('{{description}}', settings.info.description ?? '')
+      .replaceAll('{{relay_url}}', settings.info.relay_url)
+      .replaceAll('{{amount}}', amount)
+      .replaceAll('{{payments_section_class}}', admissionFeeEnabled ? '' : 'd-none')
+      .replaceAll('{{no_payments_section_class}}', admissionFeeEnabled ? 'd-none' : '')
+      .replaceAll('{{nonce}}', response.locals.nonce)
+  } catch (err) {
+    next(err)
+    return
+  }
 
   response.status(200).setHeader('content-type', 'text/html; charset=utf8').send(page)
-  next()
 }