Add and run a formatter

Signed-off-by: Matt Strapp <matt@mattstrapp.net>

4 files changed, 284 insertions, 275 deletions

diff --git a/src/index.ts b/src/index.ts
index 63c803c..def7aff 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -20,14 +20,13 @@ const csrf = csurf({ cookie: true });
 
 // Rate limiting
 const rateLimiter = rateLimit({
-    windowMs: 1 * 60 * 1000, // 1 minute
-    max: 40, // Limit each IP to 40 requests per `window` (here, per 1 minutes)
-    standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
-    legacyHeaders: false, // Disable the `X-RateLimit-*` headers
+  windowMs: 1 * 60 * 1000, // 1 minute
+  max: 40, // Limit each IP to 40 requests per `window` (here, per 1 minutes)
+  standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
+  legacyHeaders: false, // Disable the `X-RateLimit-*` headers
 });
 app.use(rateLimiter);
 
-
 // The API
 app.use('/api/v1/', api);
 
@@ -40,14 +39,14 @@ app.use('/public', express.static(path.join(__dirname, 'public'))); // Set stati
 /* ROUTING */
 
 app.get('/', csrf, (req: Request, res: Response) => {
-    res.render('index', { csrfToken: req.csrfToken() });
+  res.render('index', { csrfToken: req.csrfToken() });
 });
 app.get('/about', csrf, (req: Request, res: Response) => {
-    res.render('about');
+  res.render('about');
 });
 
 // Start the server
 const port = env.PORT || 2000;
 app.listen(port, () => {
-    console.log(`Server is listening on port ${port}`);
-});
\ No newline at end of file
+  console.log(`Server is listening on port ${port}`);
+});
diff --git a/src/public/css/style.css b/src/public/css/style.css
index a106926..3165d06 100644
--- a/src/public/css/style.css
+++ b/src/public/css/style.css
@@ -1,126 +1,117 @@
 body {
-    background-color: black;
-    color: white;
-    text-align: center;
-    vertical-align: middle;
-    position: relative;
+  background-color: black;
+  color: white;
+  text-align: center;
+  vertical-align: middle;
+  position: relative;
 }
 
 .header {
-    margin: 5px;
-    font-family: "Times New Roman", Times, serif;
+  margin: 5px;
+  font-family: 'Times New Roman', Times, serif;
 }
 
-
 /* Customize HTML paragraph element margins */
 
 p {
-    display: block;
-    margin-top: 1em;
-    margin-bottom: 1em;
-    margin-left: 15%;
-    margin-right: 15%;
+  display: block;
+  margin-top: 1em;
+  margin-bottom: 1em;
+  margin-left: 15%;
+  margin-right: 15%;
 }
 
-
 /*-------------------------Buttons-----------------------------------------------------*/
 
-
 /* Used for id=button1 */
 
 #actuate-but {
-    background-color: #0a3f73;
-    border: solid;
-    border-color: #d5d6d2;
-    color: white;
-    padding: 10px 20px;
-    text-align: center;
-    text-decoration: none;
-    font-family: "Constantia", sans-serif;
-    border-radius: 10px;
-    display: inline-block;
-    font-size: 20px;
+  background-color: #0a3f73;
+  border: solid;
+  border-color: #d5d6d2;
+  color: white;
+  padding: 10px 20px;
+  text-align: center;
+  text-decoration: none;
+  font-family: 'Constantia', sans-serif;
+  border-radius: 10px;
+  display: inline-block;
+  font-size: 20px;
 }
 
-
 /* Used for id=button1 - What the button looks like when a user puts one's cursor on it */
 
 #actuate-but:hover {
-    background-color: white;
-    color: maroon;
-    cursor: pointer;
+  background-color: white;
+  color: maroon;
+  cursor: pointer;
 }
 
-
 a {
-    color: blue;
-    text-decoration: none;
+  color: blue;
+  text-decoration: none;
 }
 
-
 /* Used for the about page*/
 
 .about {
-    color: white;
-    text-align: center;
-    margin: 5px;
-    font-size: large;
+  color: white;
+  text-align: center;
+  margin: 5px;
+  font-size: large;
 }
 
-
 #Background {
-    color: #ffbb00;
+  color: #ffbb00;
 }
 
 #Pendulum_info {
-    /* #4294cf is similar to a light blue color */
-    color: #4294cf;
+  /* #4294cf is similar to a light blue color */
+  color: #4294cf;
 }
 
-
 /* Used for id=Start */
 
 #Start {
-    font-size: 25px;
-    font-weight: bold;
-    color: #ffbb00;
+  font-size: 25px;
+  font-weight: bold;
+  color: #ffbb00;
 }
 
-
 .navbar {
-    top: 0;
-    width: 100%;
-    list-style-type: none;
-    margin: 0;
-    padding: 0;
-    overflow: hidden;
-    background-color: #7a0019;
+  top: 0;
+  width: 100%;
+  list-style-type: none;
+  margin: 0;
+  padding: 0;
+  overflow: hidden;
+  background-color: #7a0019;
 }
 
 .navbar li {
-    float: left;
+  float: left;
 }
 
 .navbar li a {
-    display: block;
-    color: white;
-    text-align: center;
-    padding: 14px 16px;
-    font-family: "Raleway", sans-serif;
-    text-decoration: none;
+  display: block;
+  color: white;
+  text-align: center;
+  padding: 14px 16px;
+  font-family: 'Raleway', sans-serif;
+  text-decoration: none;
 }
 
 .navbar li a:hover {
-    background-color: #ffcc33;
-    color: #000000;
-    /* Remove underlines from links */
-    text-decoration: none;
+  background-color: #ffcc33;
+  color: #000000;
+  /* Remove underlines from links */
+  text-decoration: none;
 }
 
 h2 {
-    font-size: larger;
+  font-size: larger;
 }
 
 .error {
-    color: red;
-}
\ No newline at end of file
+  color: red;
+}
diff --git a/src/public/js/form.js b/src/public/js/form.js
index 9e926fa..1e9eaca 100644
--- a/src/public/js/form.js
+++ b/src/public/js/form.js
@@ -1,84 +1,80 @@
 // This is split into comments so it doesn't look as gross with the closure tabs
 
 window.onload = function () {
-    document.getElementById('nojs').hidden = true;
-    document.getElementById('block').hidden = false;
+  document.getElementById('nojs').hidden = true;
+  document.getElementById('block').hidden = false;
 };
 
 // File submit AJAX request
 // After successful upload, actuate the file by calling actuate() on the successfully uploaded file
 document.getElementById('upload').onsubmit = function () {
-    // Reset error message and success message
-    document.getElementById('upload-err').innerText = '';
-    document.getElementById('actuate-err').innerText = '';
-    document.getElementById('upload-response').innerText = '';
-    document.getElementById('download-link').innerText = '';
-    // Make AJAX request
-    let xhr = new XMLHttpRequest();
-    xhr.open('POST', '/api/v1/upload');
-    let formData = new FormData(this);
-    xhr.send(formData);
-    xhr.onreadystatechange = function () {
-        if (xhr.readyState === 4) {
-            let response = JSON.parse(xhr.responseText);
-            if (xhr.status === 201) {
-                // Display upload success message to the user
-                document.getElementById('upload-response').innerText = response.msg;
-                actuate(response);
-            } else {
-                // Display upload error message to the user
-                document.getElementById('upload-err').innerText = response.error;
-                // DEBUG: Print full error if unknown error occurs
-                if (xhr.status === 500)
-                    console.error(response.error_msg);
-            }
-        }
-    };
-    document.getElementById('upload').reset();
-    return false;
+  // Reset error message and success message
+  document.getElementById('upload-err').innerText = '';
+  document.getElementById('actuate-err').innerText = '';
+  document.getElementById('upload-response').innerText = '';
+  document.getElementById('download-link').innerText = '';
+  // Make AJAX request
+  let xhr = new XMLHttpRequest();
+  xhr.open('POST', '/api/v1/upload');
+  let formData = new FormData(this);
+  xhr.send(formData);
+  xhr.onreadystatechange = function () {
+    if (xhr.readyState === 4) {
+      let response = JSON.parse(xhr.responseText);
+      if (xhr.status === 201) {
+        // Display upload success message to the user
+        document.getElementById('upload-response').innerText = response.msg;
+        actuate(response);
+      } else {
+        // Display upload error message to the user
+        document.getElementById('upload-err').innerText = response.error;
+        // DEBUG: Print full error if unknown error occurs
+        if (xhr.status === 500) console.error(response.error_msg);
+      }
+    }
+  };
+  document.getElementById('upload').reset();
+  return false;
 };
 
 // Actuate button AJAX request
 // Should always be called after upload
 // Implies that upload has been successful since it relies on the upload response
-// 
+//
 function actuate(file) {
-    let xhr = new XMLHttpRequest();
-    xhr.open('POST', '/api/v1/actuate');
-    let data = {
-        file: file.file
-    };
-    xhr.setRequestHeader('Content-Type', 'application/json; charset=utf-8');
-    xhr.setRequestHeader('X-CSRF-TOKEN', file.csrf);
-    xhr.send(JSON.stringify(data));
-    xhr.onreadystatechange = function () {
-        if (xhr.readyState === 4) {
-            let response = JSON.parse(xhr.responseText);
-            if (xhr.status === 200 || xhr.status === 500) {
-                createDownload(response.file);
-            }
-            if (xhr.status === 500) {
-                document.getElementById('actuate-err').innerText = response.error;
-                // DEBUG: Print full error if unknown error occurs
-                console.error(response.error_msg);
-            }
-
-        }
-        return;
-    };
+  let xhr = new XMLHttpRequest();
+  xhr.open('POST', '/api/v1/actuate');
+  let data = {
+    file: file.file,
+  };
+  xhr.setRequestHeader('Content-Type', 'application/json; charset=utf-8');
+  xhr.setRequestHeader('X-CSRF-TOKEN', file.csrf);
+  xhr.send(JSON.stringify(data));
+  xhr.onreadystatechange = function () {
+    if (xhr.readyState === 4) {
+      let response = JSON.parse(xhr.responseText);
+      if (xhr.status === 200 || xhr.status === 500) {
+        createDownload(response.file);
+      }
+      if (xhr.status === 500) {
+        document.getElementById('actuate-err').innerText = response.error;
+        // DEBUG: Print full error if unknown error occurs
+        console.error(response.error_msg);
+      }
+    }
+    return;
+  };
 }
 
-
 // Creates the download element
 function createDownload(response) {
-    if (!response)
-        return;
-    const tempName = response.filename;
-    const downloadName = response.name.split('.')[ 0 ];
-    const downloadLink = document.createElement('a');
-    downloadLink.setAttribute('href', `/api/v1/download/?filename=${tempName}`);
-    downloadLink.setAttribute('download', `${downloadName}.csv`);
-    downloadLink.innerText = 'Download CSV of results here.';
-    document.getElementById('download-link').appendChild(downloadLink);
-    return;
-}
\ No newline at end of file
+  if (!response) return;
+  const tempName = response.filename;
+  const downloadName = response.name.split('.')[0];
+  const downloadLink = document.createElement('a');
+  downloadLink.setAttribute('href', `/api/v1/download/?filename=${tempName}`);
+  downloadLink.setAttribute('download', `${downloadName}.csv`);
+  downloadLink.innerText = 'Download CSV of results here.';
+  document.getElementById('download-link').appendChild(downloadLink);
+  return;
+}
diff --git a/src/routes/api.ts b/src/routes/api.ts
index ee80ea5..22edd79 100644
--- a/src/routes/api.ts
+++ b/src/routes/api.ts
@@ -15,15 +15,16 @@ api.use(cookieParser());
 const csrf = csurf({ cookie: true });
 
 // For file uploads
-api.use(fileUpload({
+api.use(
+  fileUpload({
     preserveExtension: true, // Preserve file extension on upload
     safeFileNames: true, // Only allow alphanumeric characters in file names
     limits: { fileSize: 1 * 1024 * 1024 }, // Limit file size to 1MB
     useTempFiles: true, // Store files in temp instead of memory
     tempFileDir: '/tmp/', // Store files in /tmp/
     debug: false, // Log debug information
-}));
-
+  })
+);
 
 /*
     Upload a file to the server
@@ -44,34 +45,44 @@ api.use(fileUpload({
         415 when the file's MIME type is not text/x-python or text/plain (WINDOWS WHY)
         500 for any other errors
 */
-api.route('/upload')
-    .post(csrf, (req: Request, res: Response) => {
-        try {
-            // Check if anything was actually uploaded
-            if (!req.files || Object.keys(req.files).length === 0)
-                return res.status(400).json({ error: 'No file uploaded.' });
-
-            const file: UploadedFile = req.files.file as UploadedFile; // Kludge to prevent a compiler error, only one file gets uploaded so this should be fine
-
-            // Check if the file is too large (see fileUpload.limits for the limit)
-            if (file.truncated)
-                return res.status(413).json({ error: 'File uploaded was too large.' });
-
-            // Check if the file is a python file
-            if (file.mimetype !== 'text/x-python' && file.mimetype !== 'text/plain')
-                return res.status(415).json({ error: 'File uploaded was not a Python file.' });
-
-            res.status(201).json({ file: { file: file.name, path: file.tempFilePath }, msg: 'File uploaded successfully.', csrf: req.csrfToken() });
-        } catch (err) {
-            // Generic error handler
-            res.status(500).json({ error: 'An unknown error occurred while uploading the file.', error_msg: err });
-        }
-    })
-    // Fallback
-    .all(csrf, (req: Request, res: Response) => {
-        res.set('Allow', 'POST');
-        res.status(405).json({ error: 'Method not allowed.' });
-    });
+api
+  .route('/upload')
+  .post(csrf, (req: Request, res: Response) => {
+    try {
+      // Check if anything was actually uploaded
+      if (!req.files || Object.keys(req.files).length === 0)
+        return res.status(400).json({ error: 'No file uploaded.' });
+
+      const file: UploadedFile = req.files.file as UploadedFile; // Kludge to prevent a compiler error, only one file gets uploaded so this should be fine
+
+      // Check if the file is too large (see fileUpload.limits for the limit)
+      if (file.truncated)
+        return res.status(413).json({ error: 'File uploaded was too large.' });
+
+      // Check if the file is a python file
+      if (file.mimetype !== 'text/x-python' && file.mimetype !== 'text/plain')
+        return res
+          .status(415)
+          .json({ error: 'File uploaded was not a Python file.' });
+
+      res.status(201).json({
+        file: { file: file.name, path: file.tempFilePath },
+        msg: 'File uploaded successfully.',
+        csrf: req.csrfToken(),
+      });
+    } catch (err) {
+      // Generic error handler
+      res.status(500).json({
+        error: 'An unknown error occurred while uploading the file.',
+        error_msg: err,
+      });
+    }
+  })
+  // Fallback
+  .all(csrf, (req: Request, res: Response) => {
+    res.set('Allow', 'POST');
+    res.status(405).json({ error: 'Method not allowed.' });
+  });
 
 /* 
     Actuate the pendulum
@@ -102,20 +113,20 @@ api.route('/upload')
     Minimizing PE vectors like running this as an extremely low privilege user is a must.
 
 */
-api.route('/actuate')
-    // Snyk error mitigation, should be fine since the rate limiting is already in place
-    // file deepcode ignore NoRateLimitingForExpensiveWebOperation: This is already rate limited by the website, so we don't need to do it again
-    .post(csrf, async (req: Request, res: Response) => {
-        try {
-            const path: string = req.body.file.path;
-            // Verify that the file exists and is a regular file
-            // Return if not since the res will be sent by the verifyFile function
-            if (await verifyFile(path, res) !== true)
-                return;
-
-            const escaped = quote([ path ]);
-            // Run the code
-            /*
+api
+  .route('/actuate')
+  // Snyk error mitigation, should be fine since the rate limiting is already in place
+  // file deepcode ignore NoRateLimitingForExpensiveWebOperation: This is already rate limited by the website, so we don't need to do it again
+  .post(csrf, async (req: Request, res: Response) => {
+    try {
+      const path: string = req.body.file.path;
+      // Verify that the file exists and is a regular file
+      // Return if not since the res will be sent by the verifyFile function
+      if ((await verifyFile(path, res)) !== true) return;
+
+      const escaped = quote([path]);
+      // Run the code
+      /*
             TODO:
             - Potentially add the limiter to one-per-person here
             - Add a timeout
@@ -123,37 +134,48 @@ api.route('/actuate')
             - Make this more secure
                 - HOW?
         */
-            // let output = '';
-            let stderr = '';
-            const actuation = spawn('python', escaped.split(' '));
-            // actuation.stdout.on('data', (data: Buffer) => {
-            //     output += data.toString();
-            // });
-            actuation.stderr.on('data', (data: Buffer) => {
-                stderr += `STDERR: ${data.toString()}`;
-            });
-            actuation.on('close', (code: number) => {
-                const filename: string = (req.body.file.path as string).split('/').pop() as string;
-                // Make sure the program exited with a code of 0 (success)
-                if (code !== 0)
-                    return res.status(500).json({ error: `Program exited with exit code ${code}`, error_msg: stderr, file: { name: req.body.file.file, filename: filename } });
-                return res.status(200).json({ file: { name: req.body.file.file, filename: filename } });
-            });
-            // Kill the process if it takes too long
-            // Default timeout is 120 seconds (2 minutes)
-            setTimeout(() => {
-                actuation.kill();
-            }, 120000);
-        } catch (err) {
-            // Generic error handler
-            return res.status(500).json({ error: 'An unknown error occurred while running the file.', error_msg: err });
-        }
-    })
-    // Fallback
-    .all(csrf, (req: Request, res: Response) => {
-        res.set('Allow', 'POST');
-        return res.status(405).json({ error: 'Method not allowed.' });
-    });
+      // let output = '';
+      let stderr = '';
+      const actuation = spawn('python', escaped.split(' '));
+      // actuation.stdout.on('data', (data: Buffer) => {
+      //     output += data.toString();
+      // });
+      actuation.stderr.on('data', (data: Buffer) => {
+        stderr += `STDERR: ${data.toString()}`;
+      });
+      actuation.on('close', (code: number) => {
+        const filename: string = (req.body.file.path as string)
+          .split('/')
+          .pop() as string;
+        // Make sure the program exited with a code of 0 (success)
+        if (code !== 0)
+          return res.status(500).json({
+            error: `Program exited with exit code ${code}`,
+            error_msg: stderr,
+            file: { name: req.body.file.file, filename: filename },
+          });
+        return res
+          .status(200)
+          .json({ file: { name: req.body.file.file, filename: filename } });
+      });
+      // Kill the process if it takes too long
+      // Default timeout is 120 seconds (2 minutes)
+      setTimeout(() => {
+        actuation.kill();
+      }, 120000);
+    } catch (err) {
+      // Generic error handler
+      return res.status(500).json({
+        error: 'An unknown error occurred while running the file.',
+        error_msg: err,
+      });
+    }
+  })
+  // Fallback
+  .all(csrf, (req: Request, res: Response) => {
+    res.set('Allow', 'POST');
+    return res.status(405).json({ error: 'Method not allowed.' });
+  });
 
 /*
     Download the CSV file after running the pendulum
@@ -166,35 +188,34 @@ api.route('/actuate')
         404 when the file is not accessible or does not exist
         500 for any other errors
 */
-api.route('/download')
-    .get(csrf, async (req: Request, res: Response) => {
-        const filename: string = req.query.filename as string;
-        if (!filename)
-            return res.status(400).json({ error: 'No filename specified.' });
-        // Make sure no path traversal is attempted
-        // This regex matches all alphanumeric characters, underscores, and dashes.
-        // MAKE SURE THIS DOES NOT ALLOW PATH TRAVERSAL
-        if (!/^[\w-]+$/.test(filename))
-            return res.status(403).json({ error: 'No.' });
-        
-        const path = `/tmp/${filename}.csv`;
-
-        // Verify that the file exists and is a regular file
-        // Return if not since the res will be sent by the verifyFile function
-        if (await verifyFile(path, res) !== true)
-            return;
-        // Read the file and send it to the client
-        res.type('text/csv');
-        // Snyk error mitigation, should be fine since tmp is private and the simple regex above should prevent path traversal
-        // deepcode ignore PT: This is probably mitigated by the regex
-        return res.sendFile(path);
-    })
-    // Fallback
-    .all(csrf, (req: Request, res: Response) => {
-        res.set('Allow', 'GET');
-        return res.status(405).json({ error: 'Method not allowed.' });
-    });
+api
+  .route('/download')
+  .get(csrf, async (req: Request, res: Response) => {
+    const filename: string = req.query.filename as string;
+    if (!filename)
+      return res.status(400).json({ error: 'No filename specified.' });
+    // Make sure no path traversal is attempted
+    // This regex matches all alphanumeric characters, underscores, and dashes.
+    // MAKE SURE THIS DOES NOT ALLOW PATH TRAVERSAL
+    if (!/^[\w-]+$/.test(filename))
+      return res.status(403).json({ error: 'No.' });
+
+    const path = `/tmp/${filename}.csv`;
 
+    // Verify that the file exists and is a regular file
+    // Return if not since the res will be sent by the verifyFile function
+    if ((await verifyFile(path, res)) !== true) return;
+    // Read the file and send it to the client
+    res.type('text/csv');
+    // Snyk error mitigation, should be fine since tmp is private and the simple regex above should prevent path traversal
+    // deepcode ignore PT: This is probably mitigated by the regex
+    return res.sendFile(path);
+  })
+  // Fallback
+  .all(csrf, (req: Request, res: Response) => {
+    res.set('Allow', 'GET');
+    return res.status(405).json({ error: 'Method not allowed.' });
+  });
 
 /*
     Verify that the file exists and is a regular file
@@ -207,36 +228,38 @@ api.route('/download')
         ** AFTER THIS POINT, THE API HAS ALREADY SENT A RESPONSE, SO THE FUNCTION THAT CALLED IT SHOULD NOT RETURN ANOTHER RESPONSE **
 */
 async function verifyFile(file: string, res: Response) {
-    // Make sure the file being requested to run exists
-    try {
-        await access(file);
-    } catch (err) {
-        res.status(404).json({ error: 'File is not accessible or does not exist.' });
-        return false;
-    }
-    // This is a try catch because otherwise type checking will fail and get all messed up
-    // Handle your promise rejections, kids
-    try {
-        const stats = await stat(file);
-        // Make sure the file being requested to run is a regular file
-        if (!stats.isFile()) {
-            res.status(400).json({ error: 'File is not a regular file.' });
-            return false;
-        }
-        // Make sure the file being requested to run is not a directory
-        else if (stats.isDirectory()) {
-            res.status(400).json({ error: 'File is a directory.' });
-            return false;
-        }
-
-
-        // File does exist and is a regular file, so it is good to go
-        return true;
+  // Make sure the file being requested to run exists
+  try {
+    await access(file);
+  } catch (err) {
+    res
+      .status(404)
+      .json({ error: 'File is not accessible or does not exist.' });
+    return false;
+  }
+  // This is a try catch because otherwise type checking will fail and get all messed up
+  // Handle your promise rejections, kids
+  try {
+    const stats = await stat(file);
+    // Make sure the file being requested to run is a regular file
+    if (!stats.isFile()) {
+      res.status(400).json({ error: 'File is not a regular file.' });
+      return false;
     }
-    catch (err) {
-        res.status(404).json({ error: 'File is not accessible or does not exist.' });
-        return false;
+    // Make sure the file being requested to run is not a directory
+    else if (stats.isDirectory()) {
+      res.status(400).json({ error: 'File is a directory.' });
+      return false;
     }
+
+    // File does exist and is a regular file, so it is good to go
+    return true;
+  } catch (err) {
+    res
+      .status(404)
+      .json({ error: 'File is not accessible or does not exist.' });
+    return false;
+  }
 }
 
 export default api;