<commit_before>const utils = require('../lib/utils')
const challenges = require('../data/datacache').challenges
const libxml = require('libxmljs')
const vm = require('vm')

exports = module.exports = function fileUpload () {
  return (req, res, next) => {
    const file = req.file
    if (utils.notSolved(challenges.uploadSizeChallenge) && file.size > 100000) {
      utils.solve(challenges.uploadSizeChallenge)
    }
    if (utils.notSolved(challenges.uploadTypeChallenge) && !(utils.endsWith(file.originalname.toLowerCase(), '.pdf') ||
        utils.endsWith(file.originalname.toLowerCase(), '.xml'))) {
      utils.solve(challenges.uploadTypeChallenge)
    }
    if (utils.endsWith(file.originalname.toLowerCase(), '.xml')) {
      if (utils.notSolved(challenges.deprecatedInterfaceChallenge)) {
        utils.solve(challenges.deprecatedInterfaceChallenge)
      }
      if (file.buffer) {
        const data = file.buffer.toString()
        res.status(410)
        try {
          const sandbox = { libxml, data }
          vm.createContext(sandbox)
          const xmlDoc = vm.runInContext('libxml.parseXml(data, { noblanks: true, noent: true, nocdata: true })', sandbox, { timeout: 2000 })
          const xmlString = xmlDoc.toString(false)
          if (utils.notSolved(challenges.xxeFileDisclosureChallenge) && (matchesSystemIniFile(xmlString) || matchesEtcPasswdFile(xmlString))) {
            utils.solve(challenges.xxeFileDisclosureChallenge)
          }
          next(new Error('B2B customer complaints via file upload have been deprecated for security reasons: ' + utils.trunc(xmlString, 200)))
        } catch (err) {
          if (err.message === 'Script execution timed out.') {
            if (utils.notSolved(challenges.xxeDosChallenge)) {
              utils.solve(challenges.xxeDosChallenge)
            }
            res.status(503)
            next(new Error('Sorry, we are temporarily not available! Please try again later.'))
          } else {
            next(new Error('B2B customer complaints via file upload have been deprecated for security reasons: ' + err.message))
          }
        }
      }
    }
    res.status(204).end()
  }

  function matchesSystemIniFile (text) {
    const match = text.match(/(; for 16-bit app support|drivers|mci|driver32|386enh|keyboard|boot|display)/gi)
    return match && match.length >= 2
  }

  function matchesEtcPasswdFile (text) {
    const match = text.match(/\w*:\w*:\d*:\d*:\w*:.*/gi)
    return match && match.length >= 2
  }<commit_msg>Set HTTP response status directly before return<commit_after>const utils = require('../lib/utils')
const challenges = require('../data/datacache').challenges
const libxml = require('libxmljs')
const vm = require('vm')

exports = module.exports = function fileUpload () {
  return (req, res, next) => {
    const file = req.file
    if (utils.notSolved(challenges.uploadSizeChallenge) && file.size > 100000) {
      utils.solve(challenges.uploadSizeChallenge)
    }
    if (utils.notSolved(challenges.uploadTypeChallenge) && !(utils.endsWith(file.originalname.toLowerCase(), '.pdf') ||
        utils.endsWith(file.originalname.toLowerCase(), '.xml'))) {
      utils.solve(challenges.uploadTypeChallenge)
    }
    if (utils.endsWith(file.originalname.toLowerCase(), '.xml')) {
      if (utils.notSolved(challenges.deprecatedInterfaceChallenge)) {
        utils.solve(challenges.deprecatedInterfaceChallenge)
      }
      if (file.buffer) {
        const data = file.buffer.toString()
        try {
          const sandbox = { libxml, data }
          vm.createContext(sandbox)
          const xmlDoc = vm.runInContext('libxml.parseXml(data, { noblanks: true, noent: true, nocdata: true })', sandbox, { timeout: 2000 })
          const xmlString = xmlDoc.toString(false)
          if (utils.notSolved(challenges.xxeFileDisclosureChallenge) && (matchesSystemIniFile(xmlString) || matchesEtcPasswdFile(xmlString))) {
            utils.solve(challenges.xxeFileDisclosureChallenge)
          }
          res.status(410)
          next(new Error('B2B customer complaints via file upload have been deprecated for security reasons: ' + utils.trunc(xmlString, 200)))
        } catch (err) {
          if (err.message === 'Script execution timed out.') {
            if (utils.notSolved(challenges.xxeDosChallenge)) {
              utils.solve(challenges.xxeDosChallenge)
            }
            res.status(503)
            next(new Error('Sorry, we are temporarily not available! Please try again later.'))
          } else {
            res.status(410)
            next(new Error('B2B customer complaints via file upload have been deprecated for security reasons: ' + err.message))
          }
        }
      }
    }
    res.status(204).end()
  }

  function matchesSystemIniFile (text) {
    const match = text.match(/(; for 16-bit app support|drivers|mci|driver32|386enh|keyboard|boot|display)/gi)
    return match && match.length >= 2
  }

  function matchesEtcPasswdFile (text) {
    const match = text.match(/\w*:\w*:\d*:\d*:\w*:.*/gi)
    return match && match.length >= 2
  }
{'fraction_non_alphanumeric': 0.1294695481335953, 'fraction_numerical': 0.01355599214145383, 'mean_word_length': 2.9618677042801558, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 11, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 24}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6303510', 'n_tokens_mistral': 1631, 'n_tokens_neox': 1515, 'n_words': 309}