Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions samples/nodejs-file-upload/Dockerfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
# Use an official Node runtime based on slim as a parent image
FROM node:20-slim

# Set the working directory to /app
WORKDIR /app

# Install curl and any other dependencies
RUN apt-get update \
\
&& apt-get install -y --no-install-recommends \
curl \
&& rm -rf /var/lib/apt/lists/*

# Copy package.json and package-lock.json into the container at /app
COPY package*.json ./

# Install any needed packages specified in package.json
RUN npm install

# Copy the current directory contents into the container
COPY . .

# Make port 3000 available to the world outside this container
EXPOSE 3000

# Run the app when the container launches
ENTRYPOINT [ "node", "main.js" ]
12 changes: 12 additions & 0 deletions samples/nodejs-file-upload/compose.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
services:
service1:
restart: always
build:
context: .
dockerfile: Dockerfile
ports:
- mode: ingress
target: 3000
published: 3000
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:3000/"]
39 changes: 39 additions & 0 deletions samples/nodejs-file-upload/main.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
const express = require('express');
const multer = require('multer');
const fs = require('fs');
const path = require('path');

const app = express();
const upload = multer({ dest: 'uploads/' });

app.use(express.static('uploads'));

app.get('/', (req, res) => {
fs.readdir('uploads', (err, files) => {
if (err) {
return res.status(500).send('Unable to scan files!');
}
let fileList = files.map(file => `<li><a href="/${file}">${file}</a></li>`).join('');
res.send(`
<h1>File Upload</h1>
<form ref='uploadForm'
id='uploadForm'
action='/'
method='post'
encType="multipart/form-data">
<input type="file" name="file" />
<input type='submit' value='Upload!' />
</form>
<h2>Uploaded Files</h2>
<ul>${fileList}</ul>
`);
Comment on lines +17 to +29

Check failure

Code scanning / CodeQL

Stored cross-site scripting High

Stored cross-site scripting vulnerability due to
stored value
.

Copilot Autofix

AI 10 months ago

To fix the stored cross-site scripting vulnerability, we need to sanitize the filenames before using them to generate HTML content. The best way to do this is to use a library like escape-html to escape any potentially dangerous characters in the filenames. This will ensure that any HTML tags or scripts in the filenames are rendered harmless.

  1. Install the escape-html library.
  2. Import the escape-html library in the main.js file.
  3. Use the escape-html function to escape the filenames before embedding them in the HTML content.
Suggested changeset 2
samples/nodejs-file-upload/main.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/samples/nodejs-file-upload/main.js b/samples/nodejs-file-upload/main.js
--- a/samples/nodejs-file-upload/main.js
+++ b/samples/nodejs-file-upload/main.js
@@ -4,2 +4,3 @@
 const path = require('path');
+const escapeHtml = require('escape-html');
 
@@ -15,3 +16,3 @@
         }
-        let fileList = files.map(file => `<li><a href="/${file}">${file}</a></li>`).join('');
+        let fileList = files.map(file => `<li><a href="/${escapeHtml(file)}">${escapeHtml(file)}</a></li>`).join('');
         res.send(`
EOF
@@ -4,2 +4,3 @@
const path = require('path');
const escapeHtml = require('escape-html');

@@ -15,3 +16,3 @@
}
let fileList = files.map(file => `<li><a href="/${file}">${file}</a></li>`).join('');
let fileList = files.map(file => `<li><a href="/${escapeHtml(file)}">${escapeHtml(file)}</a></li>`).join('');
res.send(`
samples/nodejs-file-upload/package.json
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/samples/nodejs-file-upload/package.json b/samples/nodejs-file-upload/package.json
--- a/samples/nodejs-file-upload/package.json
+++ b/samples/nodejs-file-upload/package.json
@@ -10,3 +10,4 @@
 	  "express": "^4.17.1",
-	  "multer": "^1.4.4"
+	  "multer": "^1.4.4",
+	  "escape-html": "^1.0.3"
 	}
EOF
@@ -10,3 +10,4 @@
"express": "^4.17.1",
"multer": "^1.4.4"
"multer": "^1.4.4",
"escape-html": "^1.0.3"
}
This fix introduces these dependencies
Package Version Security advisories
escape-html (npm) 1.0.3 None
Copilot is powered by AI and may make mistakes. Always verify output.
});
});
Comment on lines +11 to +31

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
a file system access
, but is not rate-limited.

Copilot Autofix

AI 10 months ago

To fix the problem, we need to introduce rate limiting to the Express application. The best way to do this is by using the express-rate-limit package, which allows us to set a maximum number of requests that can be made to the server within a specified time window. This will help prevent denial-of-service attacks by limiting the rate at which requests are accepted.

We will:

  1. Install the express-rate-limit package.
  2. Import the express-rate-limit package in the code.
  3. Set up a rate limiter with appropriate configuration.
  4. Apply the rate limiter to all routes in the application.
Suggested changeset 2
samples/nodejs-file-upload/main.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/samples/nodejs-file-upload/main.js b/samples/nodejs-file-upload/main.js
--- a/samples/nodejs-file-upload/main.js
+++ b/samples/nodejs-file-upload/main.js
@@ -4,2 +4,3 @@
 const path = require('path');
+const RateLimit = require('express-rate-limit');
 
@@ -8,2 +9,8 @@
 
+const limiter = RateLimit({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: 100, // max 100 requests per windowMs
+});
+
+app.use(limiter);
 app.use(express.static('uploads'));
EOF
@@ -4,2 +4,3 @@
const path = require('path');
const RateLimit = require('express-rate-limit');

@@ -8,2 +9,8 @@

const limiter = RateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100, // max 100 requests per windowMs
});

app.use(limiter);
app.use(express.static('uploads'));
samples/nodejs-file-upload/package.json
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/samples/nodejs-file-upload/package.json b/samples/nodejs-file-upload/package.json
--- a/samples/nodejs-file-upload/package.json
+++ b/samples/nodejs-file-upload/package.json
@@ -10,3 +10,4 @@
 	  "express": "^4.17.1",
-	  "multer": "^1.4.4"
+	  "multer": "^1.4.4",
+	  "express-rate-limit": "^7.4.1"
 	}
EOF
@@ -10,3 +10,4 @@
"express": "^4.17.1",
"multer": "^1.4.4"
"multer": "^1.4.4",
"express-rate-limit": "^7.4.1"
}
This fix introduces these dependencies
Package Version Security advisories
express-rate-limit (npm) 7.4.1 None
Copilot is powered by AI and may make mistakes. Always verify output.

app.post('/', upload.single('file'), (req, res) => {
res.redirect('/');
});

app.listen(3000, () => {
console.log('Server started on port 3000');
});
13 changes: 13 additions & 0 deletions samples/nodejs-file-upload/package.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
{
"name": "service1",
"version": "1.0.0",
"description": "",
"main": "main.js",
"scripts": {
"start": "exec node main.js"
},
"dependencies": {
"express": "^4.17.1",
"multer": "^1.4.4"
}
}
Loading