next #405
next #405
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎ |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| async (request: FastifyRequest, reply: FastifyReply) => { | ||
| const logs = await import("fs/promises").then((fs) => | ||
| fs.readFile("logs.log", "utf-8") | ||
| ); | ||
| reply.send({ logs: logs }); | ||
| } |
Check failure
Code scanning / CodeQL
Missing rate limiting High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 months ago
To fix the problem, we need to introduce rate limiting to the route that performs file system access. We can use the fastify-rate-limit plugin to achieve this. This plugin allows us to set a maximum number of requests per time window for specific routes.
- Install the
fastify-rate-limitplugin. - Register the
fastify-rate-limitplugin with the Fastify instance. - Apply rate limiting to the specific route that performs file system access.
| @@ -3,4 +3,9 @@ | ||
| import { prisma } from "../prisma"; | ||
| import fastifyRateLimit from 'fastify-rate-limit'; | ||
|
|
||
| export function dataRoutes(fastify: FastifyInstance) { | ||
| fastify.register(fastifyRateLimit, { | ||
| max: 100, // maximum number of requests | ||
| timeWindow: '15 minutes' // time window for rate limiting | ||
| }); | ||
| // Get total count of all tickets | ||
| @@ -68,2 +73,10 @@ | ||
| "/api/v1/data/logs", | ||
| { | ||
| config: { | ||
| rateLimit: { | ||
| max: 10, // maximum number of requests for this route | ||
| timeWindow: '1 minute' // time window for rate limiting | ||
| } | ||
| } | ||
| }, | ||
| async (request: FastifyRequest, reply: FastifyReply) => { |
| @@ -65,3 +65,4 @@ | ||
| "simple-oauth2": "^5.1.0", | ||
| "xml-encryption": "^3.0.2" | ||
| "xml-encryption": "^3.0.2", | ||
| "fastify-rate-limit": "^5.9.0" | ||
| }, |
| Package | Version | Security advisories |
| fastify-rate-limit (npm) | 5.9.0 | None |
| }), | ||
| if (webhook[i].active === true) { | ||
| const s = status ? "Completed" : "Outstanding"; | ||
| if (url.includes("discord.com")) { |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 months ago
To fix the problem, we need to parse the URL and check its host value against a whitelist of allowed hosts. This ensures that the check is not bypassed by embedding the allowed host in an unexpected location within the URL.
- Parse the URL to extract the host value.
- Define a whitelist of allowed hosts.
- Check if the host value is in the whitelist before proceeding with the redirection or API call.
| @@ -553,2 +553,4 @@ | ||
| const url = webhook[i].url; | ||
| const parsedUrl = new URL(url); | ||
| const allowedHosts = ["discord.com", "www.discord.com"]; | ||
|
|
||
| @@ -556,3 +558,3 @@ | ||
| const s = status ? "Completed" : "Outstanding"; | ||
| if (url.includes("discord.com")) { | ||
| if (allowedHosts.includes(parsedUrl.host)) { | ||
| const message = { |
| const response = await fetch(`/api/v1/role/${id}`, { | ||
| headers: { | ||
| Authorization: `Bearer ${getCookie("session")}`, | ||
| }, | ||
| }); |
Check failure
Code scanning / CodeQL
Server-side request forgery Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 months ago
To fix the problem, we need to validate and sanitize the id parameter before using it in the URL for the fetch request. One way to do this is to ensure that the id parameter matches a specific pattern or format that is expected for role IDs. This can be done using a regular expression or by checking against a list of allowed IDs.
In this case, we will use a regular expression to validate the id parameter. We will only allow alphanumeric characters and dashes in the id parameter, which is a common pattern for IDs.
| @@ -19,5 +19,8 @@ | ||
|
|
||
| // Function to validate the id parameter | ||
| const isValidId = (id: string) => /^[a-zA-Z0-9-]+$/.test(id); | ||
|
|
||
| // New function to fetch role data | ||
| const fetchRoleData = async () => { | ||
| if (!id) return; | ||
| if (!id || !isValidId(id as string)) return; | ||
|
|
| await fetch(`/api/v1/role/${id}/update`, { | ||
| method: "PUT", | ||
| headers: { | ||
| Authorization: `Bearer ${getCookie("session")}`, | ||
| "Content-Type": "application/json", | ||
| }, | ||
| body: JSON.stringify({ | ||
| name: roleName, | ||
| permissions: selectedPermissions, | ||
| users: selectedUsers, | ||
| }), | ||
| }) |
Check failure
Code scanning / CodeQL
Server-side request forgery Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 months ago
To fix the problem, we need to ensure that the id parameter is validated before it is used to construct the URL for the fetch request. One way to do this is to use a whitelist of allowed role IDs or to validate the format of the id to ensure it meets expected criteria (e.g., it is a valid UUID).
In this case, we will implement a simple validation to ensure that the id is a valid UUID. This will prevent attackers from injecting malicious input into the URL.
| @@ -19,5 +19,11 @@ | ||
|
|
||
| // Function to validate UUID | ||
| const isValidUUID = (uuid) => { | ||
| const regex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i; | ||
| return regex.test(uuid); | ||
| }; | ||
|
|
||
| // New function to fetch role data | ||
| const fetchRoleData = async () => { | ||
| if (!id) return; | ||
| if (!id || !isValidUUID(id)) return; | ||
|
|
||
| @@ -61,3 +67,3 @@ | ||
| const handleUpdateRole = async () => { | ||
| if (!roleName || !id) return; | ||
| if (!roleName || !id || !isValidUUID(id)) return; | ||
|
|
No description provided.