GREEN-40: add debug endpoints behind debug middleware #15
Conversation
GREEN-40 Put Archiver debug endpoints behind debug middleware
See
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| (req, res) => { | ||
| const top = spawn('top', ['-n', '10']) | ||
| top.stdout.on('data', (dataBuffer) => { | ||
| res.send(dataBuffer.toString()) | ||
| top.kill() | ||
| }) | ||
| top.on('close', (code) => { | ||
| console.log(`child process exited with code ${code}`) | ||
| }) | ||
| top.stderr.on('data', (data) => { | ||
| console.log('top command error', data) | ||
| res.send('top command error') | ||
| top.kill() | ||
| }) | ||
| } |
Check failure
Code scanning / CodeQL
Missing rate limiting High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 6 months ago
The best way to fix the problem is to add rate limiting to the route handlers that perform system commands. This can be done by using a rate limiting middleware such as fastify-rate-limit.
The fastify-rate-limit package provides a rate limiting middleware for Fastify applications. It can be used to limit the rate at which requests are accepted, thus preventing denial-of-service attacks.
To fix the problem, you need to install the fastify-rate-limit package and use it in your Fastify application. You can do this by adding the fastify-rate-limit import at the top of your file, initializing the rate limiter, and then applying it to your Fastify server with the register method.
The rate limiter can be configured with various options such as max (the maximum number of requests allowed in the time window), timeWindow (the duration of the time window), and allowList (an array of IP addresses that are not subject to rate limiting).
In this case, you can set max to a reasonable number that allows your application to handle the expected load but prevents excessive requests. The timeWindow can be set to '1 minute' to limit the rate of requests per minute. You can leave the allowList empty if you want to apply rate limiting to all clients.
| @@ -4,2 +4,3 @@ | ||
| import * as fastify from 'fastify' | ||
| import rateLimit from 'fastify-rate-limit' | ||
| import { resourceUsage } from 'process' | ||
| @@ -80,2 +81,7 @@ | ||
|
|
||
| this.server.register(rateLimit, { | ||
| max: 100, // max 100 requests per 1 minute | ||
| timeWindow: '1 minute' | ||
| }) | ||
|
|
||
| this.server.get( |
| @@ -91,3 +91,4 @@ | ||
| "streamroller": "^3.1.3", | ||
| "tydb": "^0.1.5" | ||
| "tydb": "^0.1.5", | ||
| "fastify-rate-limit": "^5.9.0" | ||
| }, |
| Package | Version | Security advisories |
| fastify-rate-limit (npm) | 5.9.0 | None |
| (req, res) => { | ||
| const df = spawn('df') | ||
| df.stdout.on('data', (dataBuffer) => { | ||
| res.send(dataBuffer.toString()) | ||
| df.kill() | ||
| }) | ||
| df.on('close', (code) => { | ||
| console.log(`child process exited with code ${code}`) | ||
| }) | ||
| df.stderr.on('data', (data) => { | ||
| console.log('df command error', data) | ||
| res.send('df command error') | ||
| df.kill() | ||
| }) | ||
| } |
Check failure
Code scanning / CodeQL
Missing rate limiting High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 6 months ago
The best way to fix the problem is to add rate limiting to the route handler that performs the system command. This can be done by using a rate limiting middleware such as fastify-rate-limit.
Here are the steps to fix the problem:
- Install the
fastify-rate-limitpackage. - Import the
fastify-rate-limitpackage in thesrc/profiler/memoryReporting.tsfile. - Register the
fastify-rate-limitplugin with the Fastify instance. - Configure the rate limit options. For example, you can limit the number of requests to 100 per 15 minutes.
| @@ -4,2 +4,3 @@ | ||
| import * as fastify from 'fastify' | ||
| import rateLimit from 'fastify-rate-limit' | ||
| import { resourceUsage } from 'process' | ||
| @@ -41,2 +42,6 @@ | ||
| registerEndpoints(): void { | ||
| this.server.register(rateLimit, { | ||
| max: 100, // max number of connections during windowMs milliseconds before sending a 429 response | ||
| timeWindow: '15 minutes' // duration of the window for max connections | ||
| }) | ||
| this.server.get( |
| @@ -91,3 +91,4 @@ | ||
| "streamroller": "^3.1.3", | ||
| "tydb": "^0.1.5" | ||
| "tydb": "^0.1.5", | ||
| "fastify-rate-limit": "^5.9.0" | ||
| }, |
| Package | Version | Security advisories |
| fastify-rate-limit (npm) | 5.9.0 | None |
https://linear.app/shm/issue/GREEN-40/put-archiver-debug-endpoints-behind-debug-middleware
Add debug endpoints behind debug middleware