fix: rate limit store requests and sanitize path (#357)

* fix: rate limit store requests and sanitize path

* fix: lint issues

.github/bot-scripts/renameCommitCheck.js

@@ -12,10 +12,6 @@ async function main(param) {
 		repo: context.repo.repo,
 	};
 
-	const request = {
-		...options,
-		pull_number: context.issue.number,
-	};
 	const { data: commits } = await github.pulls.listCommits({
 		...options,
 		pull_number: context.issue.number,

app.js

@@ -22,6 +22,19 @@ const path = require('path')
 const { storeDir } = reqlib('config/app.js')
 const renderIndex = reqlib('/lib/renderIndex')
 const archiver = require('archiver')
+const rateLimit = require('express-rate-limit')
+
+const storeLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 100,
+  handler: function (req, res) {
+    res.json({
+      success: false,
+      message:
+        'Request limit reached. You can make only 100 reqests every 15 minutes'
+    })
+  }
+})
 
 const socketManager = new SocketManager()
 
@@ -38,6 +51,17 @@ function start (server) {
   startGateway()
 }
 
+function sanitizePath (path) {
+  // remove every ../
+  path = path.replace(/\.\.\//, '')
+
+  if (!path.startsWith(storeDir)) {
+    throw Error('Path not allowed')
+  }
+
+  return path
+}
+
 function setupLogging (settings) {
   loggers.setupAll(settings ? settings.gateway : null)
 }
@@ -267,7 +291,7 @@ app.post('/api/importConfig', async function (req, res) {
 })
 
 // get config
-app.get('/api/store', async function (req, res) {
+app.get('/api/store', storeLimiter, async function (req, res) {
   try {
     async function parseDir (dir) {
       const toReturn = []
@@ -299,13 +323,9 @@ app.get('/api/store', async function (req, res) {
   }
 })
 
-app.get('/api/store/:path', async function (req, res) {
+app.get('/api/store/:path', storeLimiter, async function (req, res) {
   try {
-    const reqPath = req.params.path
-
-    if (!reqPath.startsWith(storeDir)) {
-      throw Error('Path not allowed')
-    }
+    const reqPath = sanitizePath(req.params.path)
 
     const stat = await fs.lstat(reqPath)
 
@@ -322,13 +342,9 @@ app.get('/api/store/:path', async function (req, res) {
   }
 })
 
-app.put('/api/store/:path', async function (req, res) {
+app.put('/api/store/:path', storeLimiter, async function (req, res) {
   try {
-    const reqPath = req.params.path
-
-    if (!reqPath.startsWith(storeDir)) {
-      throw Error('Path not allowed')
-    }
+    const reqPath = sanitizePath(req.params.path)
 
     const stat = await fs.lstat(reqPath)
 
@@ -345,13 +361,9 @@ app.put('/api/store/:path', async function (req, res) {
   }
 })
 
-app.delete('/api/store/:path', async function (req, res) {
+app.delete('/api/store/:path', storeLimiter, async function (req, res) {
   try {
-    const reqPath = req.params.path
-
-    if (!reqPath.startsWith(storeDir)) {
-      throw Error('Path not allowed')
-    }
+    const reqPath = sanitizePath(req.params.path)
 
     await fs.remove(reqPath)
 
@@ -362,7 +374,7 @@ app.delete('/api/store/:path', async function (req, res) {
   }
 })
 
-app.put('/api/store-multi', async function (req, res) {
+app.put('/api/store-multi', storeLimiter, async function (req, res) {
   try {
     const files = req.body.files || []
     for (const f of files) {
@@ -375,7 +387,7 @@ app.put('/api/store-multi', async function (req, res) {
   }
 })
 
-app.post('/api/store-multi', function (req, res) {
+app.post('/api/store-multi', storeLimiter, function (req, res) {
   const files = req.body.files || []
 
   const archive = archiver('zip')

lib/ZwaveClient.js

@@ -101,8 +101,7 @@ function driverReady () {
     .on('heal network progress', onHealNetworkProgress.bind(this))
   // .on('heal network done', onHealNetworkDone.bind(this))
 
-  // eslint-disable-next-line no-unused-vars
-  for (const [nodeId, node] of this.driver.controller.nodes) {
+  for (const [, node] of this.driver.controller.nodes) {
     // node added will not be triggered if the node is in cache
     addNode.call(this, node)
 

package.json

@@ -104,6 +104,7 @@
     "debug": "^4.3.1",
     "ejs": "^3.1.5",
     "express": "^4.17.1",
+    "express-rate-limit": "^5.2.3",
     "fs-extra": "^9.1.0",
     "jsonfile": "^6.1.0",
     "morgan": "~1.10.0",

src/modules/ColumnFilterHelper.js

@@ -33,7 +33,7 @@ export class ColumnFilterHelper {
     const filter = {}
     ColumnFilterHelper.filterProps(colType).forEach(key => {
       if (value[key] !== undefined && value[key] !== null) {
-        if (Array.isArray(value[key]) && !value[key].length > 0) {
+        if (Array.isArray(value[key]) && value[key].length === 0) {
           // Skip empty arrays
           return
         }