Merge pull request #10 from DaalBot/alert-autofix-9

Fix code scanning alert no. 9: Missing rate limiting

Server/index.js

@@ -3,6 +3,7 @@ const { Colors } = require('discord.js');
 const DJS = require('discord.js');
 const client = require('../client');
 const express = require('express');
+const rateLimit = require('express-rate-limit');
 const app = express();
 const port = 8923;
 const axios = require('axios');
@@ -11,6 +12,16 @@ const { execSync } = require('child_process');
 
 app.use(express.json());
 
+// Set up rate limiter: maximum of 100 requests per 15 minutes
+const limiter = rateLimit({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: 100, // limit each IP to 100 requests per windowMs
+});
+
+// Apply rate limiter to specific routes
+app.use('/md/privacy', limiter);
+app.use('/md/tos', limiter);
+
 app.get('/api/status', (req, res) => {
     // Status type not defined so send all data about the client
     if (req.headers['user-agent'].toLowerCase().includes('mozilla') && !req.query.noinject) {

package.json

@@ -26,6 +26,7 @@
     "express": "^4.21.1",
     "node-html-parser": "^6.1.10",
     "rss-to-json": "^2.1.1",
-    "wokcommands": "^2.1.9"
+    "wokcommands": "^2.1.9",
+    "express-rate-limit": "^7.4.1"
   }
 }