Repository navigation
Potential fix for code scanning alert no. 363: Missing rate limiting - #88
Closed
mmeerrkkaa wants to merge 1 commit into
Closed
mmeerrkkaa wants to merge 1 commit into
mmeerrkkaa wants to merge 1 commit into
Conversation
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 58 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configuration
📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThe PR introduces a shared express-rate-limit middleware for both plugin installation routes, limiting each IP to 10 attempts per 15 minutes while leaving the existing installation, authentication, and authorization flows intact. Sequence diagram for rate-limited plugin installationsequenceDiagram
actor Client
participant Express as ExpressRouter
participant Limiter as pluginInstallRateLimiter
participant Auth as authenticateUniversal
participant Access as checkBotAccess
participant Authorize as authorize
participant Install as PluginInstallation
Client->>Express: POST /:botId/plugins/install/local or /zip
Express->>Limiter: rateLimit(req)
alt 10 requests exceeded in 15 minutes per IP
Limiter-->>Client: 429 error
else request allowed
Limiter->>Auth: authenticateUniversal(req, res, next)
Auth->>Access: checkBotAccess(req, res, next)
Access->>Authorize: authorize(plugin:install)
Authorize->>Install: Execute installation
Install-->>Client: Installation response
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
mmeerrkkaa
marked this pull request as ready for review
October 5, 2026 22:42
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 2 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="backend/src/api/routes/bots.js" line_range="6" />
<code_context>
const path = require('path');
const fs = require('fs/promises');
const fse = require('fs-extra');
+const rateLimit = require('express-rate-limit');
const { botManager, pluginManager } = require('../../core/services');
const UserService = require('../../core/UserService');
</code_context>
<issue_to_address>
**Backend fails to start**
When the backend loads `bots.js`, the module declares `rateLimit` twice, so Node throws a duplicate-identifier `SyntaxError` and the backend cannot start.
Remove the duplicate declaration or reuse the existing `rateLimit` declaration.
</issue_to_address>
### Comment 2
<location path="backend/src/api/routes/bots.js" line_range="402" />
<code_context>
+ message: { error: 'Слишком много запросов на установку плагинов. Попробуйте позже.' }
+});
+
+router.post('/:botId/plugins/install/local', pluginInstallRateLimiter, authenticateUniversal, checkBotAccess, authorize('plugin:install'), async (req, res) => {
const { botId } = req.params;
const { path } = req.body;
</code_context>
<issue_to_address>
**Unauthenticated requests block installs**
When unauthenticated requests share an IP with authorized users and use up the ten-request quota, `pluginInstallRateLimiter` counts requests before authentication and authorization checks, so legitimate users from that IP receive 429 responses for plugin installs.
Run the limiter after authentication and authorization checks on both install routes.
Also at `backend/src/api/routes/bots.js:396-400`, `backend/src/api/routes/bots.js:413`.
</issue_to_address>| const path = require('path'); | ||
| const fs = require('fs/promises'); | ||
| const fse = require('fs-extra'); | ||
| const rateLimit = require('express-rate-limit'); |
Contributor
There was a problem hiding this comment.
🔴 Critical · Backend fails to start
When the backend loads bots.js, the module declares rateLimit twice, so Node throws a duplicate-identifier SyntaxError and the backend cannot start.
Remove the duplicate declaration or reuse the existing rateLimit declaration.
Prompt for AI agents
In `backend/src/api/routes/bots.js` at line 6:
**Backend fails to start**
When the backend loads `bots.js`, the module declares `rateLimit` twice, so Node throws a duplicate-identifier `SyntaxError` and the backend cannot start.
Remove the duplicate declaration or reuse the existing `rateLimit` declaration.| message: { error: 'Слишком много запросов на установку плагинов. Попробуйте позже.' } | ||
| }); | ||
|
|
||
| router.post('/:botId/plugins/install/local', pluginInstallRateLimiter, authenticateUniversal, checkBotAccess, authorize('plugin:install'), async (req, res) => { |
Contributor
There was a problem hiding this comment.
🟡 Medium · Unauthenticated requests block installs
When unauthenticated requests share an IP with authorized users and use up the ten-request quota, pluginInstallRateLimiter counts requests before authentication and authorization checks, so legitimate users from that IP receive 429 responses for plugin installs.
Run the limiter after authentication and authorization checks on both install routes.
Also at backend/src/api/routes/bots.js:396-400, backend/src/api/routes/bots.js:413.
Prompt for AI agents
In `backend/src/api/routes/bots.js` at line 402:
**Unauthenticated requests block installs**
When unauthenticated requests share an IP with authorized users and use up the ten-request quota, `pluginInstallRateLimiter` counts requests before authentication and authorization checks, so legitimate users from that IP receive 429 responses for plugin installs.
Run the limiter after authentication and authorization checks on both install routes.
Also at `backend/src/api/routes/bots.js:396-400`, `backend/src/api/routes/bots.js:413`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Potential fix for https://github.com/blockmineJS/blockmine/security/code-scanning/363
Add explicit Express rate-limiting middleware to the expensive plugin installation endpoints, especially the ZIP upload route at line 404 (the flagged location).
Best fix: use
express-rate-limitand apply a dedicated limiter to plugin install routes so authenticated users cannot spam heavy operations. This does not change existing business functionality; it only throttles request frequency.In
backend/src/api/routes/bots.js:express-rate-limit.router.post('/:botId/plugins/install/zip', ...)(required for the alert)router.post('/:botId/plugins/install/local', ...)(same expensive class, good single fix coverage).Suggested fixes powered by Copilot Autofix. Review carefully before merging.
Summary by Sourcery
Bug Fixes: