upstream-rocketchat/apps/meteor/server/lib/messages/sendMessage.ts

import { AppEvents, Apps } from '@rocket.chat/apps';
import { Message } from '@rocket.chat/core-services';
import type { IMessage, IRoom } from '@rocket.chat/core-typings';
import { Messages } from '@rocket.chat/models';
import { isAbsoluteURL } from '@rocket.chat/tools';
import { Match, check } from 'meteor/check';

import { isRelativeURL } from '../../../lib/utils/isRelativeURL';
import { afterSaveMessage } from '../../hooks/messages/afterSaveMessage';
import { settings } from '../../settings';
import { hasPermissionAsync } from '../authorization/hasPermission';
import { FileUpload } from '../media/file-upload';
import { validateCustomMessageFields } from '../messaging/validateCustomMessageFields';
import { notifyOnRoomChangedById } from '../notifyListener';

export type SendMessageOptions = {
	upsert?: boolean;
	previewUrls?: string[];
	skipNotifications?: boolean;
};

// TODO: most of the types here are wrong, but I don't want to change them now

/**
 * IMPORTANT
 *
 * This validator prevents malicious href values
 * intending to run arbitrary js code in anchor tags.
 * You should use it whenever the value you're checking
 * is going to be rendered in the href attribute of a
 * link.
 */
const validFullURLParam = Match.Where((value) => {
	check(value, String);

	if (!isAbsoluteURL(value) && !value.startsWith(FileUpload.getPath())) {
		throw new Error('Invalid href value provided');
	}

	if (/^javascript:/i.test(value)) {
		throw new Error('Invalid href value provided');
	}

	return true;
});

const validPartialURLParam = Match.Where((value) => {
	check(value, String);

	if (!isRelativeURL(value) && !isAbsoluteURL(value) && !value.startsWith(FileUpload.getPath())) {
		throw new Error('Invalid href value provided');
	}

	if (/^javascript:/i.test(value)) {
		throw new Error('Invalid href value provided');
	}

	return true;
});

const objectMaybeIncluding = (types: any) =>
	Match.Where((value: any) => {
		Object.keys(types).forEach((field) => {
			if (value[field] != null) {
				try {
					check(value[field], types[field]);
				} catch (error: any) {
					error.path = field;
					throw error;
				}
			}
		});

		return true;
	});

const validateAttachmentsFields = (attachmentField: any) => {
	check(
		attachmentField,
		objectMaybeIncluding({
			short: Boolean,
			title: String,
			value: Match.OneOf(String, Number, Boolean),
		}),
	);

	if (!attachmentField.value || !attachmentField.title) {
		throw new Error('Invalid attachment field, title and value is required');
	}
};

const validateAttachmentsActions = (attachmentActions: any) => {
	check(
		attachmentActions,
		objectMaybeIncluding({
			type: String,
			text: String,
			url: validFullURLParam,
			image_url: validFullURLParam,
			is_webview: Boolean,
			webview_height_ratio: String,
			msg: String,
			msg_in_chat_window: Boolean,
		}),
	);
};

const validateAttachment = (attachment: any) => {
	check(
		attachment,
		objectMaybeIncluding({
			color: String,
			text: String,
			ts: Match.OneOf(String, Number),
			thumb_url: validFullURLParam,
			button_alignment: String,
			actions: [Match.Any],
			message_link: validFullURLParam,
			collapsed: Boolean,
			author_name: String,
			author_link: validFullURLParam,
			author_icon: validFullURLParam,
			title: String,
			title_link: validFullURLParam,
			title_link_download: Boolean,
			image_dimensions: Object,
			image_url: validFullURLParam,
			image_preview: String,
			image_type: String,
			image_size: Number,
			audio_url: validFullURLParam,
			audio_type: String,
			audio_size: Number,
			video_url: validFullURLParam,
			video_type: String,
			video_size: Number,
			fields: [Match.Any],
		}),
	);

	if (attachment.fields?.length) {
		attachment.fields.map(validateAttachmentsFields);
	}

	if (attachment.actions?.length) {
		attachment.actions.map(validateAttachmentsActions);
	}
};

const validateBodyAttachments = (attachments: any[]) => attachments.map(validateAttachment);

export const validateMessage = async (message: any, room: any, user: any) => {
	check(
		message,
		objectMaybeIncluding({
			_id: String,
			msg: String,
			text: String,
			alias: String,
			emoji: String,
			tmid: String,
			tshow: Boolean,
			avatar: validPartialURLParam,
			attachments: [Match.Any],
			blocks: [Match.Any],
		}),
	);

	if (message.alias || message.avatar) {
		const isLiveChatGuest = !message.avatar && user.token && user.token === room.v?.token;

		if (!isLiveChatGuest && !(await hasPermissionAsync(user._id, 'message-impersonate', room._id))) {
			throw new Error('Not enough permission');
		}
	}

	if (Array.isArray(message.attachments) && message.attachments.length) {
		validateBodyAttachments(message.attachments);
	}

	if (message.customFields) {
		validateCustomMessageFields({
			customFields: message.customFields,
			messageCustomFieldsEnabled: settings.get<boolean>('Message_CustomFields_Enabled'),
			messageCustomFields: settings.get<string>('Message_CustomFields'),
		});
	}
};

export function prepareMessageObject(
	message: Partial<IMessage>,
	rid: IRoom['_id'],
	user: { _id: string; username?: string; name?: string },
): asserts message is IMessage {
	if (!message.ts) {
		message.ts = new Date();
	}

	if (message.tshow !== true) {
		delete message.tshow;
	}

	const { _id, username, name } = user;
	message.u = {
		_id,
		username: username as string, // FIXME: this is wrong but I don't want to change it now
		name,
	};
	message.rid = rid;

	if (!Match.test(message.msg, String)) {
		message.msg = '';
	}

	if (message.ts == null) {
		message.ts = new Date();
	}
}

/**
 * Validates and sends the message object. This function does not verify the Message_MaxAllowedSize settings.
 * Caller of the function should verify the Message_MaxAllowedSize if needed.
 * There might be same use cases which needs to override this setting. Example - sending error logs.
 */
export const sendMessage = async function (user: any, message: any, room: any, options: SendMessageOptions = {}) {
	const { upsert = false, previewUrls } = options;

	if (!user || !message || !room._id) {
		return false;
	}

	await validateMessage(message, room, user);
	prepareMessageObject(message, room._id, user);

	if (settings.get('Message_Read_Receipt_Enabled')) {
		message.unread = true;
	}

	// For the Rocket.Chat Apps :)
	if (Apps.self?.isLoaded()) {
		const prevent = await Apps.self?.triggerEvent(AppEvents.IPreMessageSentPrevent, message);

		if (prevent) {
			return;
		}

		const result = await Apps.self?.triggerEvent(
			AppEvents.IPreMessageSentModify,
			await Apps.self?.triggerEvent(AppEvents.IPreMessageSentExtend, message),
		);

		if (typeof result === 'object') {
			message = Object.assign(message, result);

			// Some app may have inserted malicious/invalid values in the message, let's check it again
			await validateMessage(message, room, user);
		}
	}

	message = await Message.beforeSave({ message, room, user, previewUrls, parseUrls: message.parseUrls });

	if (!message) {
		return;
	}

	if (message._id && upsert) {
		const { _id } = message;
		delete message._id;
		await Messages.updateOne(
			{
				_id,
				'u._id': message.u._id,
			},
			{ $set: message },
			{ upsert: true },
		);
		message._id = _id;
	} else {
		const messageAlreadyExists = message._id && (await Messages.findOneById(message._id, { projection: { _id: 1 } }));
		if (messageAlreadyExists) {
			return;
		}
		const { insertedId } = await Messages.insertOne(message);
		message._id = insertedId;
	}

	if (Apps.self?.isLoaded()) {
		// If the message has a type (system message), we should notify the listener about it
		const messageEvent = message.t ? AppEvents.IPostSystemMessageSent : AppEvents.IPostMessageSent;
		void Apps.self?.triggerEvent(messageEvent, message);
	}

	await afterSaveMessage(message, room, user, { options });

	void notifyOnRoomChangedById(message.rid);

	return message;
};