Input validation and sanitization

package.json

@@ -98,7 +98,8 @@
     "uuid": "^9.0.1",
     "web3": "^4.3.0",
     "winston": "^3.11.0",
-    "winston-daily-rotate-file": "^4.7.1"
+    "winston-daily-rotate-file": "^4.7.1",
+    "xss": "^1.0.15"
   },
   "devDependencies": {
     "@commitlint/cli": "^18.4.3",
@@ -111,6 +112,7 @@
     "@types/cors": "^2.8.17",
     "@types/crypto-js": "^4.2.1",
     "@types/express": "^4.17.21",
+    "@types/file-type": "^10.6.0",
     "@types/jest": "^29.5.14",
     "@types/jsonwebtoken": "^9.0.5",
     "@types/lodash": "^4.14.202",
@@ -140,7 +142,6 @@
     "tsconfig-paths": "^4.2.0",
     "typescript": "^5.3.2"
   },
-
   "engines": {
     "node": ">=18.0.0",
     "npm": ">=8.0.0"

src/common/controllers/audit.controller.ts

@@ -27,7 +27,6 @@ import { Action } from '../../rbac/enums/action.enum';
 import { RequireScopes } from '../decorators/require-scopes.decorator';
 import { AuditInterceptor } from '../interceptors/audit.interceptor';
 
-// Audit controller
 @ApiTags('Audit & Compliance')
 @Controller('audit')
 @UseGuards(JwtAuthGuard, RbacGuard)

src/common/middleware/request-size-limiter.middleware.ts

@@ -0,0 +1,52 @@
+import { Injectable, NestMiddleware, BadRequestException } from '@nestjs/common';
+import { Request, Response, NextFunction } from 'express';
+
+@Injectable()
+export class RequestSizeLimiterMiddleware implements NestMiddleware {
+  private readonly maxRequestSize: number;
+  private readonly maxUrlLength: number;
+  private readonly maxHeadersCount: number;
+
+  constructor() {
+    // Get values from config or use defaults
+    this.maxRequestSize = parseInt(process.env.MAX_REQUEST_SIZE || '10485760', 10); // 10MB default
+    this.maxUrlLength = parseInt(process.env.MAX_URL_LENGTH || '2048', 10); // 2KB default
+    this.maxHeadersCount = parseInt(process.env.MAX_HEADERS_COUNT || '50', 10); // 50 headers default
+  }
+
+  use(req: Request, res: Response, next: NextFunction) {
+    // Check URL length
+    if (req.url.length > this.maxUrlLength) {
+      throw new BadRequestException(`Request URL exceeds maximum allowed length of ${this.maxUrlLength} characters`);
+    }
+
+    // Check number of headers
+    const headerCount = Object.keys(req.headers).length;
+    if (headerCount > this.maxHeadersCount) {
+      throw new BadRequestException(`Request exceeds maximum allowed headers count of ${this.maxHeadersCount}`);
+    }
+
+    // Check content length header if present
+    const contentLength = req.headers['content-length'];
+    if (contentLength) {
+      const size = parseInt(contentLength, 10);
+      if (size > this.maxRequestSize) {
+        throw new BadRequestException(`Request body exceeds maximum allowed size of ${this.maxRequestSize} bytes`);
+      }
+    }
+
+    // For chunked requests or when content-length is not available, monitor stream size
+    let receivedSize = 0;
+    if (req.method === 'POST' || req.method === 'PUT' || req.method === 'PATCH') {
+      req.on('data', (chunk: Buffer) => {
+        receivedSize += chunk.length;
+        if (receivedSize > this.maxRequestSize) {
+          req.destroy();
+          throw new BadRequestException(`Request body exceeds maximum allowed size of ${this.maxRequestSize} bytes`);
+        }
+      });
+    }
+
+    next();
+  }
+}