gitignore: removing ye olde binary from ignore

.gitignore

@@ -1,4 +1,3 @@
-/directory-server
 /.idea
 /scripts/deploy.sh
 /main

go.mod

@@ -23,6 +23,7 @@ require (
 	github.com/kr/pty v1.1.8 // indirect
 	github.com/mailru/easyjson v0.7.0 // indirect
 	github.com/mattn/go-isatty v0.0.9 // indirect
+	github.com/microcosm-cc/bluemonday v1.0.2
 	github.com/onsi/ginkgo v1.10.1
 	github.com/onsi/gomega v1.7.0
 	github.com/rs/cors v1.7.0

go.sum

@@ -28,6 +28,7 @@ github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMo
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gin-contrib/cors v1.3.0 h1:PolezCc89peu+NgkIWt9OB01Kbzt6IP0J/JvkG6xxlg=
 github.com/gin-contrib/cors v1.3.0/go.mod h1:artPvLlhkF7oG06nK8v3U8TNz6IeX+w1uzCSEId5/Vc=
+github.com/gin-contrib/gzip v0.0.1 h1:ezvKOL6jH+jlzdHNE4h9h8q8uMpDQjyl0NN0Jd7jozc=
 github.com/gin-contrib/gzip v0.0.1/go.mod h1:fGBJBCdt6qCZuCAOwWuFhBB4OOq9EFqlo5dEaFhhu5w=
 github.com/gin-contrib/sse v0.0.0-20170109093832-22d885f9ecc7/go.mod h1:VJ0WA2NBN22VlZ2dKZQPAPnyWw5XTlK1KymzLKsr59s=
 github.com/gin-contrib/sse v0.0.0-20190301062529-5545eab6dad3/go.mod h1:VJ0WA2NBN22VlZ2dKZQPAPnyWw5XTlK1KymzLKsr59s=
@@ -90,6 +91,8 @@ github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hd
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.9 h1:d5US/mDsogSGW37IV293h//ZFaeajb69h+EHFsv2xGg=
 github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ=
+github.com/microcosm-cc/bluemonday v1.0.2 h1:5lPfLTTAvAbtS0VqT+94yOtFnGfUWYyx0+iToC3Os3s=
+github.com/microcosm-cc/bluemonday v1.0.2/go.mod h1:iVP4YcDBq+n/5fb23BhYFvIMq/leAFZyRl6bYmGDlGc=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=

metrics/controller.go

@@ -4,18 +4,20 @@ import (
 	"net/http"
 
 	"github.com/gin-gonic/gin"
+	"github.com/microcosm-cc/bluemonday"
 	"github.com/nymtech/nym-directory/models"
-	"github.com/nymtech/nym-directory/server/websocket"
 )
 
 // Config for this controller
 type Config struct {
-	Hub *websocket.Hub
+	Sanitizer bluemonday.Policy
+	Service   IService
 }
 
 // controller is the metrics controller
 type controller struct {
-	service *service
+	service   IService
+	sanitizer bluemonday.Policy
 }
 
 // Controller ...
@@ -26,8 +28,7 @@ type Controller interface {
 
 // New returns a new metrics.Controller
 func New(cfg Config) Controller {
-	db := newMetricsDb()
-	return &controller{newService(db, cfg.Hub)}
+	return &controller{cfg.Service, cfg.Sanitizer}
 }
 
 func (controller *controller) RegisterRoutes(router *gin.Engine) {

metrics/db.go

@@ -7,23 +7,25 @@ import (
 	"github.com/nymtech/nym-directory/models"
 )
 
-type db struct {
+// IDb holds metrics information
+type IDb interface {
+	Add(models.PersistedMixMetric)
+	List() []models.PersistedMixMetric
+}
+
+// Db holds data for metrics
+type Db struct {
 	sync.Mutex
 	incomingMetrics []models.PersistedMixMetric
 	mixMetrics      []models.PersistedMixMetric
 	ticker          *time.Ticker
 }
 
-// Db holds metrics information
-type Db interface {
-	Add(models.PersistedMixMetric)
-	List() []models.PersistedMixMetric
-}
-
-func newMetricsDb() *db {
+// NewMetricsDb constructor
+func NewMetricsDb() *Db {
 	ticker := time.NewTicker(3 * time.Second)
 
-	d := db{
+	d := Db{
 		incomingMetrics: []models.PersistedMixMetric{},
 		mixMetrics:      []models.PersistedMixMetric{},
 	}
@@ -34,21 +36,21 @@ func newMetricsDb() *db {
 }
 
 // Add adds a models.PersistedMixMetric to the database
-func (db *db) Add(metric models.PersistedMixMetric) {
+func (db *Db) Add(metric models.PersistedMixMetric) {
 	db.Lock()
 	defer db.Unlock()
 	db.incomingMetrics = append(db.incomingMetrics, metric)
 }
 
 // List returns all models.PersistedMixMetric in the database
-func (db *db) List() []models.PersistedMixMetric {
+func (db *Db) List() []models.PersistedMixMetric {
 	db.Lock()
 	defer db.Unlock()
 	return db.mixMetrics
 }
 
 // dbCleaner periodically clears the database
-func dbCleaner(ticker *time.Ticker, database *db) {
+func dbCleaner(ticker *time.Ticker, database *Db) {
 	for {
 		select {
 		case <-ticker.C:
@@ -71,7 +73,7 @@ func dbCleaner(ticker *time.Ticker, database *db) {
 // `incoming` to `mixMetrics` and have a full list, clearing incoming.
 // This way we can offer a consistent view of what happened
 // over any individual bit of time.
-func (db *db) clear() {
+func (db *Db) clear() {
 	db.Lock()
 	defer db.Unlock()
 	db.mixMetrics = db.incomingMetrics

metrics/db_test.go

@@ -9,7 +9,7 @@ import (
 )
 
 var _ = Describe("Metrics Db", func() {
-	var db *db
+	var db *Db
 	var metric1 models.MixMetric
 	var metric2 models.MixMetric
 	var p1 models.PersistedMixMetric
@@ -42,23 +42,23 @@ var _ = Describe("Metrics Db", func() {
 	Describe("retrieving mixnet metrics", func() {
 		Context("when no metrics have been added", func() {
 			It("should return an empty metrics list", func() {
-				db = newMetricsDb()
+				db = NewMetricsDb()
 				assert.Len(GinkgoT(), db.List(), 0)
 			})
 		})
 	})
 	Describe("adding mixnet metrics", func() {
 		Context("adding 1", func() {
 			It("should contain 1 metric", func() {
-				db = newMetricsDb()
+				db = NewMetricsDb()
 				db.Add(p1)
 				assert.Len(GinkgoT(), db.List(), 0)          // see note on db.clear()
 				assert.Len(GinkgoT(), db.incomingMetrics, 1) // see note on db.clear()
 			})
 		})
 		Context("adding 2", func() {
 			It("should contain 2 metrics", func() {
-				db = newMetricsDb()
+				db = NewMetricsDb()
 				db.Add(p1)
 				db.Add(p2)
 				assert.Len(GinkgoT(), db.List(), 0)          // see note on db.clear()

metrics/service.go

@@ -9,25 +9,28 @@ import (
 	"github.com/nymtech/nym-directory/server/websocket"
 )
 
-type service struct {
-	db  Db
-	hub websocket.Broadcaster
+// Service struct
+type Service struct {
+	db  IDb
+	hub websocket.IHub
 }
 
-// Service defines the REST service interface for metrics.
-type Service interface {
-	CreateMixMetric() error
-	List() []models.MixMetric
+// IService defines the REST service interface for metrics.
+type IService interface {
+	CreateMixMetric(metric models.MixMetric)
+	List() []models.PersistedMixMetric
 }
 
-func newService(db Db, hub websocket.Broadcaster) *service {
-	return &service{
+// NewService constructor
+func NewService(db IDb, hub websocket.IHub) *Service {
+	return &Service{
 		db:  db,
 		hub: hub,
 	}
 }
 
-func (service *service) CreateMixMetric(metric models.MixMetric) {
+// CreateMixMetric adds a new PersistedMixMetric in the database.
+func (service *Service) CreateMixMetric(metric models.MixMetric) {
 	persist := models.PersistedMixMetric{
 		MixMetric: metric,
 		Timestamp: timemock.Now().UnixNano(),
@@ -43,6 +46,7 @@ func (service *service) CreateMixMetric(metric models.MixMetric) {
 
 }
 
-func (service *service) List() []models.PersistedMixMetric {
+// List lists all mix metrics in the database
+func (service *Service) List() []models.PersistedMixMetric {
 	return service.db.List()
 }

metrics/service_test.go

@@ -14,13 +14,13 @@ import (
 )
 
 var _ = Describe("metrics.Service", func() {
-	var mockDb mocks.Db
+	var mockDb mocks.IDb
 	var m1 models.MixMetric
 	var m2 models.MixMetric
 	var p1 models.PersistedMixMetric
 	var p2 models.PersistedMixMetric
 
-	var serv service
+	var serv Service
 	var received uint = 99
 	var now = time.Now()
 	timemock.Freeze(now)
@@ -51,9 +51,9 @@ var _ = Describe("metrics.Service", func() {
 
 	Describe("Adding a mixmetric", func() {
 		It("should add a PersistedMixMetric to the db and notify the Hub", func() {
-			mockDb = *new(mocks.Db)
-			mockHub := *new(wsMocks.Broadcaster)
-			serv = *newService(&mockDb, &mockHub)
+			mockDb = *new(mocks.IDb)
+			mockHub := *new(wsMocks.IHub)
+			serv = *NewService(&mockDb, &mockHub)
 			mockDb.On("Add", p1)
 			j, _ := json.Marshal(p1)
 			mockHub.On("Notify", j)
@@ -67,12 +67,12 @@ var _ = Describe("metrics.Service", func() {
 	Describe("Listing mixmetrics", func() {
 		Context("when receiving a list request", func() {
 			It("should call to the Db", func() {
-				mockDb = *new(mocks.Db)
-				mockHub := *new(wsMocks.Broadcaster)
+				mockDb = *new(mocks.IDb)
+				mockHub := *new(wsMocks.IHub)
 
 				list := []models.PersistedMixMetric{p1, p2}
 
-				serv = *newService(&mockDb, &mockHub)
+				serv = *NewService(&mockDb, &mockHub)
 				mockDb.On("List").Return(list)
 
 				result := serv.List()

models/metrics.go

@@ -1,5 +1,10 @@
 package models
 
+import (
+	"fmt"
+	"html"
+)
+
 // MixMetric is a report from each mixnode detailing recent traffic.
 // Useful for creating visualisations.
 type MixMetric struct {
@@ -8,6 +13,15 @@ type MixMetric struct {
 	Received *uint           `json:"received" binding:"exists"`
 }
 
+// Sanitize strips XSS attacks
+func (metric *MixMetric) Sanitize() {
+	fmt.Println("Sanitizing")
+	metric.PubKey = html.EscapeString(metric.PubKey)
+	for key := range metric.Sent {
+		key = html.EscapeString(key)
+	}
+}
+
 // PersistedMixMetric is a saved MixMetric with a timestamp recording when it
 // was seen by the directory server. It can be used to build visualizations of
 // mixnet traffic.

server/server.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 
 	"github.com/gin-gonic/gin"
+	"github.com/microcosm-cc/bluemonday"
 	"github.com/nymtech/nym-directory/healthcheck"
 	"github.com/nymtech/nym-directory/metrics"
 	"github.com/nymtech/nym-directory/presence"
@@ -43,13 +44,19 @@ func New() *gin.Engine {
 		websocket.Serve(hub, c.Writer, c.Request)
 	})
 
-	cfg := metrics.Config{
-		Hub: hub,
+	sanitizer := bluemonday.UGCPolicy()
+
+	metricsDb := metrics.NewMetricsDb()
+	metricsService := *metrics.NewService(*metricsDb, *hub)
+
+	metricsConfig := metrics.Config{
+		Service:   metricsService,
+		Sanitizer: *sanitizer,
 	}
 
 	// Register all HTTP controller routes
 	healthcheck.New().RegisterRoutes(router)
-	metrics.New(cfg).RegisterRoutes(router)
+	metrics.New(metricsConfig).RegisterRoutes(router)
 	presence.New().RegisterRoutes(router)
 
 	return router

server/websocket/hub.go

@@ -4,8 +4,8 @@ package websocket
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Broadcaster notifies attached clients
-type Broadcaster interface {
+// IHub notifies attached clients
+type IHub interface {
 	Notify(msg []byte)
 }