snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/routes/avatar/middlewares/auth.spec.ts

@@ -0,0 +1,124 @@
+import { expect } from 'chai';
+import { describe, it } from 'mocha';
+import proxyquire from 'proxyquire';
+import sinon from 'sinon';
+
+const mocks = {
+	utils: {
+		userCanAccessAvatar: sinon.stub(),
+		renderSVGLetters: sinon.stub(),
+	},
+};
+
+const { protectAvatarsWithFallback, protectAvatars } = proxyquire.noCallThru().load('./auth.ts', {
+	'../utils': mocks.utils,
+});
+
+describe('#protectAvatarsWithFallback()', () => {
+	const response = {
+		setHeader: sinon.spy(),
+		writeHead: sinon.spy(),
+		write: sinon.spy(),
+		end: sinon.spy(),
+	};
+	const next = sinon.spy();
+
+	afterEach(() => {
+		response.setHeader.resetHistory();
+		response.writeHead.resetHistory();
+		response.end.resetHistory();
+		next.resetHistory();
+
+		Object.values(mocks.utils).forEach((mock) => mock.reset());
+	});
+
+	it(`should write 404 to head if no url provided`, async () => {
+		await protectAvatarsWithFallback({}, response, next);
+		expect(next.called).to.be.false;
+		expect(response.setHeader.called).to.be.false;
+		expect(response.writeHead.calledWith(404)).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it(`should write 200 to head and write fallback to body (user avatar)`, async () => {
+		mocks.utils.renderSVGLetters.returns('fallback');
+
+		await protectAvatarsWithFallback({ url: '/jon' }, response, next);
+		expect(next.called).to.be.false;
+		expect(response.setHeader.called).to.be.false;
+
+		expect(response.writeHead.calledWith(200, { 'Content-Type': 'image/svg+xml' })).to.be.true;
+		expect(mocks.utils.renderSVGLetters.calledWith('jon')).to.be.true;
+		expect(response.write.calledWith('fallback')).to.be.true;
+
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it(`should write 200 to head and write fallback to body (room avatar)`, async () => {
+		mocks.utils.renderSVGLetters.returns('fallback');
+
+		await protectAvatarsWithFallback({ url: '/room/jon' }, response, next);
+		expect(next.called).to.be.false;
+		expect(response.setHeader.called).to.be.false;
+		expect(response.writeHead.calledWith(200, { 'Content-Type': 'image/svg+xml' })).to.be.true;
+		expect(response.write.calledWith('fallback')).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it(`should call next if user can access avatar`, async () => {
+		mocks.utils.userCanAccessAvatar.returns(true);
+		const request = { url: '/jon' };
+
+		await protectAvatarsWithFallback(request, response, next);
+		expect(mocks.utils.userCanAccessAvatar.calledWith(request)).to.be.true;
+		expect(next.called).to.be.true;
+	});
+});
+
+describe('#protectAvatars()', () => {
+	const response = {
+		setHeader: sinon.spy(),
+		writeHead: sinon.spy(),
+		write: sinon.spy(),
+		end: sinon.spy(),
+	};
+	const next = sinon.spy();
+
+	afterEach(() => {
+		response.setHeader.resetHistory();
+		response.writeHead.resetHistory();
+		response.end.resetHistory();
+		next.resetHistory();
+
+		Object.values(mocks.utils).forEach((mock) => mock.reset());
+	});
+
+	it(`should write 404 to head if no url provided`, async () => {
+		await protectAvatars({}, response, next);
+
+		expect(next.called).to.be.false;
+		expect(response.setHeader.called).to.be.false;
+		expect(response.writeHead.calledWith(404)).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it(`should write 404 to head if access is denied`, async () => {
+		mocks.utils.userCanAccessAvatar.returns(false);
+
+		await protectAvatars({ url: '/room/jon' }, response, next);
+
+		expect(next.called).to.be.false;
+		expect(response.setHeader.called).to.be.false;
+		expect(response.writeHead.calledWith(404)).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it(`should call next if user can access avatar`, async () => {
+		mocks.utils.userCanAccessAvatar.returns(true);
+		const request = { url: '/jon' };
+
+		await protectAvatars(request, response, next);
+		expect(mocks.utils.userCanAccessAvatar.calledWith(request)).to.be.true;
+		expect(next.called).to.be.true;
+	});
+});

apps/meteor/server/routes/avatar/middlewares/auth.ts

@@ -0,0 +1,47 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+
+import type { IIncomingMessage } from '@rocket.chat/core-typings';
+import type { NextFunction } from 'connect';
+
+import { userCanAccessAvatar, renderSVGLetters } from '../utils';
+
+const renderFallback = (req: IncomingMessage, res: ServerResponse) => {
+	if (!req.url) {
+		res.writeHead(404);
+		res.end();
+		return;
+	}
+
+	let roomOrUsername;
+
+	if (req.url.startsWith('/room')) {
+		roomOrUsername = req.url.split('/')[2] || 'Room';
+	} else {
+		roomOrUsername = req.url.split('/')[1] || 'Anonymous';
+	}
+
+	res.writeHead(200, { 'Content-Type': 'image/svg+xml' });
+	res.write(renderSVGLetters(roomOrUsername, 200));
+	res.end();
+};
+
+const getProtectAvatars = (callback?: typeof renderFallback) => async (req: IncomingMessage, res: ServerResponse, next: NextFunction) => {
+	if (!(await userCanAccessAvatar(req as IIncomingMessage))) {
+		if (callback) {
+			callback(req, res);
+			return;
+		}
+
+		res.writeHead(404);
+		res.end();
+		return;
+	}
+
+	return next();
+};
+
+// If unauthorized returns the SVG fallback (letter avatar)
+export const protectAvatarsWithFallback = getProtectAvatars(renderFallback);
+
+// Just returns 404
+export const protectAvatars = getProtectAvatars();

apps/meteor/server/routes/avatar/middlewares/browserVersion.spec.ts

@@ -0,0 +1,87 @@
+import { expect } from 'chai';
+import { describe, it } from 'mocha';
+import proxyquire from 'proxyquire';
+import sinon from 'sinon';
+
+// const getCookie = sinon.stub();
+class CookiesMock {
+	public get = (_key: any, value: any) => value;
+}
+const { handleBrowserVersionCheck, isIEOlderThan11 } = proxyquire.noCallThru().load('./browserVersion', {
+	'meteor/ostrio:cookies': {
+		Cookies: CookiesMock,
+	},
+	'../../../lib/utils/getURL': {
+		getURL: () => '',
+	},
+});
+
+describe('#isIEOlderThan11()', () => {
+	it('should return false if user agent is IE11', () => {
+		const userAgent = {
+			browser: {
+				name: 'IE',
+				version: '11.0',
+			},
+		};
+		expect(isIEOlderThan11(userAgent)).to.be.false;
+	});
+
+	it('should return true if user agent is IE < 11', () => {
+		const userAgent = {
+			browser: {
+				name: 'IE',
+				version: '10.0',
+			},
+		};
+		expect(isIEOlderThan11(userAgent)).to.be.true;
+	});
+});
+
+describe('#handleBrowserVersionCheck()', () => {
+	it('should call next if browser_version_check cookie is set to "bypass"', async () => {
+		const next = sinon.spy();
+		const request = {
+			headers: {
+				cookie: 'bypass',
+			},
+		};
+		handleBrowserVersionCheck(request as any, {} as any, next);
+
+		expect(next.calledOnce).to.be.true;
+	});
+
+	it('should call next if browser_version_check cookie is not set to "force" and user agent is not IE < 11', async () => {
+		const next = sinon.spy();
+		const request = {
+			headers: {
+				'cookie': 'anything',
+				'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36',
+			},
+		};
+		handleBrowserVersionCheck(request as any, {} as any, next);
+
+		expect(next.calledOnce).to.be.true;
+	});
+
+	it('should respond with Browser not supported', async () => {
+		const next = sinon.spy();
+		const request = {
+			headers: {
+				'cookie': 'anything',
+				'user-agent': 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 7.0; InfoPath.3; .NET CLR 3.1.40767; Trident/6.0; en-IN)',
+			},
+		};
+
+		const response = {
+			setHeader: sinon.spy(),
+			write: sinon.spy(),
+			end: sinon.spy(),
+		};
+		handleBrowserVersionCheck(request as any, response as any, next);
+
+		expect(response.setHeader.calledWith('content-type', 'text/html; charset=utf-8')).to.be.true;
+		expect(response.write.calledWith(sinon.match('Browser not supported'))).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+});

apps/meteor/server/routes/avatar/middlewares/browserVersion.ts

@@ -0,0 +1,147 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+
+import type { IIncomingMessage } from '@rocket.chat/core-typings';
+import type { NextFunction } from 'connect';
+import { Cookies } from 'meteor/ostrio:cookies';
+import parser from 'ua-parser-js';
+
+import { getURL } from '../../../lib/utils/getURL';
+
+const cookies = new Cookies();
+
+export const isIEOlderThan11 = (userAgent: ReturnType<typeof parser>) => {
+	if (!userAgent?.browser.name || !userAgent?.browser.version) {
+		return false;
+	}
+	return userAgent.browser.name === 'IE' && parseInt(userAgent.browser.version) < 11;
+};
+
+export const handleBrowserVersionCheck = (request: IncomingMessage, res: ServerResponse, next: NextFunction) => {
+	const req = request as IIncomingMessage;
+
+	const browserVersionCheck = cookies.get('browser_version_check', req.headers.cookie);
+	if (browserVersionCheck === 'bypass') {
+		next();
+		return;
+	}
+
+	const userAgent = parser(req.headers['user-agent']);
+	if (browserVersionCheck !== 'force' && !isIEOlderThan11(userAgent)) {
+		next();
+		return;
+	}
+
+	res.setHeader('content-type', 'text/html; charset=utf-8');
+
+	res.write(`
+		<style>
+			body {
+				margin: 0;
+				font-family: -apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Oxygen,Ubuntu,Cantarell,'Helvetica Neue','Apple Color Emoji','Segoe UI Emoji','Segoe UI Symbol','Meiryo UI',Arial,sans-serif;
+			}
+
+			.rcx-box--text-style-headline {
+				letter-spacing: 0rem;
+				font-family: Inter, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Oxygen, Ubuntu, Cantarell, Helvetica Neue, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Meiryo UI, Arial, sans-serif;
+				font-size: 1.375rem;
+				font-weight: 400;
+				line-height: 2rem;
+			}
+
+			.not-supported-browser {
+				width: 100%;
+				min-height: 100vh;
+
+				text-align: center;
+
+				background-image: url(${getURL('/images/404.svg')});
+				background-repeat: no-repeat;
+				background-position: center;
+				background-size: cover;
+
+				display: flex;
+				justify-content: center;
+				align-items: center;
+
+				&__404 {
+					font-size: 4em;
+					font-weight: bold;
+				}
+			}
+
+			.not-supported-browser__text {
+				font-size: 4em;
+				font-weight: bold;
+			}
+
+			.rcx-box--text-color-alternative {
+				color: #ffffff;
+			}
+
+			.rcx-box, .rcx-box::before, .rcx-box::after {
+				box-sizing: border-box;
+				margin: 0;
+				padding: 0;
+				transition: all 230ms;
+				border-width: 0;
+				border-style: solid;
+				border-color: currentColor;
+				outline: none;
+				-webkit-font-smoothing: antialiased;
+				-moz-osx-font-smoothing: grayscale;
+				font-variant-numeric: tabular-nums;
+			}
+
+			.rcx-button {
+				display: inline-block;
+				text-align: center;
+				vertical-align: middle;
+				white-space: nowrap;
+				text-decoration: none;
+				cursor: pointer;
+				outline: 0;
+				letter-spacing: 0rem;
+				font-family: Inter, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Oxygen, Ubuntu, Cantarell, Helvetica Neue, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Meiryo UI, Arial, sans-serif;
+				font-size: 0.875rem;
+				font-weight: 500;
+				line-height: 1.25rem;
+				overflow: hidden;
+				text-overflow: ellipsis;
+				padding: 7px 15px;
+				padding-top: 7px;
+				padding-bottom: 7px;
+				padding-block: 7px;
+				padding-left: 15px;
+				padding-right: 15px;
+				padding-inline: 15px;
+			}
+
+			.rcx-button--primary {
+				color: #ffffff;
+				border-width: 0.125rem;
+				border-style: solid;
+				border-color: #1d74f5;
+				border-radius: 0.125rem;
+				background-color: #1d74f5;
+				-webkit-appearance: none;
+				-moz-appearance: none;
+				appearance: none;
+			}
+
+			.rcx-box--text-color-primary {
+				color: #1d74f5;
+			}
+			.rcx-box.rcx-\@s6mi60{margin:0.75rem !important;}.rcx-box.rcx-\@19aubzx{margin:2rem !important;}.rcx-box.rcx-\@1kgm1vs{-webkit-align-items:center !important;-webkit-box-align:center !important;-ms-flex-align:center !important;align-items:center !important;-webkit-box-pack:center !important;-webkit-justify-content:center !important;-ms-flex-pack:center !important;justify-content:center !important;-webkit-flex-direction:column !important;-ms-flex-direction:column !important;flex-direction:column !important;}.rcx-box.rcx-\@1qvl0ud{display:-webkit-box !important;display:-webkit-flex !important;display:-ms-flexbox !important;display:flex !important;}
+		</style>
+
+		<section class="rcx-box not-supported-browser rcx-@1kgm1vs rcx-@1qvl0ud">
+			<div class="rcx-box">
+				<div class="rcx-box rcx-box--text-color-alternative not-supported-browser__text rcx-@s6mi60">Browser not supported</div>
+				<a class="rcx-box rcx-button rcx-button--primary" href="https://rocket.chat/docs/getting-support/#supported-browser-versions" target="_blank">Check the documentation</a>
+				<a class="rcx-box rcx-button rcx-button--primary" href="#" onclick="document.cookie = 'browser_version_check=bypass; path=/'; location.reload(true);">Proceed anyway</a>
+			</div>
+		</section>
+	`);
+
+	res.end();
+};

apps/meteor/server/routes/avatar/middlewares/index.ts

@@ -0,0 +1,8 @@
+import { WebApp } from 'meteor/webapp';
+
+import { protectAvatarsWithFallback, protectAvatars } from './auth';
+import { handleBrowserVersionCheck } from './browserVersion';
+
+WebApp.connectHandlers.use(handleBrowserVersionCheck);
+WebApp.connectHandlers.use('/avatar/uid/', protectAvatars);
+WebApp.connectHandlers.use('/avatar/', protectAvatarsWithFallback);