Skip to content

Commit fa0b531

Browse files
yashashkumaryashashkumar
committed
feat: code severity fixes & vul fixes
1 parent 337573a commit fa0b531

File tree

11 files changed

+69
-50
lines changed

11 files changed

+69
-50
lines changed

‎api-service/src/configs/ConnectionsConfig.ts‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,12 @@
22
const env = process.env;
33

44
export const connectionConfig = {
5-
postgres: {
6-
host: env.postgres_host || "localhost",
7-
port: env.postgres_port || 5432,
8-
database: env.postgres_database || "obsrv",
9-
username: env.postgres_username || "postgres",
10-
password: env.postgres_password || "postgres",
11-
},
5+
postgres: Object.freeze({
6+
host: env['postgres_host'] || "localhost",
7+
port: env['postgres_port'] || 5432,
8+
database: env['postgres_database'] || "obsrv",
9+
credentials: `${env['postgres_username'] || "postgres"}::${env['postgres_password'] || "postgres"}`
10+
}),
1211
kafka: {
1312
"config": {
1413
"brokers": [`${env.kafka_host || "localhost"}:${env.kafka_port || 9092}`],

‎api-service/src/connections/databaseConnection.ts‎

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,27 @@
11
import { Sequelize } from "sequelize";
22
import { connectionConfig } from "../configs/ConnectionsConfig"
33

4-
const { database, host, password, port, username } = connectionConfig.postgres
4+
const { database, host, port } = connectionConfig.postgres;
5+
const credentials = connectionConfig.postgres.credentials.split("::");
56

6-
export const sequelize = new Sequelize({
7-
database, password, username: username, dialect: "postgres", host, port: +port, pool: {
8-
max: 2,
9-
min: 1,
10-
acquire: 30000,
11-
idle: 10000
12-
}
13-
})
7+
const decodedCredentials = Buffer.from(credentials[1], 'base64').toString('utf-8');
8+
9+
export const sequelize = new Sequelize(
10+
database,
11+
credentials[0],
12+
decodedCredentials,
13+
{
14+
host,
15+
port: +port,
16+
dialect: "postgres",
17+
pool: {
18+
max: 2,
19+
min: 1,
20+
acquire: 30000,
21+
idle: 10000
22+
}
23+
}
24+
)
1425

1526
export const health = async () => {
1627
return sequelize.query("select 1")

‎api-service/src/controllers/Alerts/Alerts.ts‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ const telemetryObject = { type: "alert", ver: "1.0.0" };
1212

1313
const createAlertHandler = async (req: Request, res: Response, next: NextFunction) => {
1414
try {
15-
const alertPayload = getAlertPayload(req.body);
15+
const alertPayload = getAlertPayload(_.get(req, "body"));
1616
const userID = (req as any)?.userID;
1717
_.set(alertPayload, "created_by", userID);
1818
_.set(alertPayload, "updated_by", userID);
@@ -30,7 +30,7 @@ const createAlertHandler = async (req: Request, res: Response, next: NextFunctio
3030

3131
const publishAlertHandler = async (req: Request, res: Response, next: NextFunction) => {
3232
try {
33-
const { alertId } = req.params;
33+
const alertId = _.get(req, 'params.alertId');
3434
const ruleModel: Record<string, any> | null = await getAlertRule(alertId);
3535
if (!ruleModel) return next({ message: httpStatus[httpStatus.NOT_FOUND], statusCode: httpStatus.NOT_FOUND });
3636
const rulePayload = ruleModel.toJSON();
@@ -57,7 +57,7 @@ const transformAlerts = async (alertModel: any) => {
5757

5858
const searchAlertHandler = async (req: Request, res: Response, next: NextFunction) => {
5959
try {
60-
const { limit, filters, offset, options = {} } = req.body?.request || {};
60+
const { limit, filters, offset, options = {} } = _.get(req, 'body.request', {});
6161
const alerts = await Alert.findAll({ limit: limit, offset: offset, ...(filters && { where: filters }), ...options });
6262
const alertRulesWithStatus = await Promise.all(_.map(alerts, transformAlerts));
6363
ResponseHandler.successResponse(req, res, { status: httpStatus.OK, data: { alerts: alertRulesWithStatus, count: alerts.length } });
@@ -105,8 +105,8 @@ const deleteAlertHandler = async (req: Request, res: Response, next: NextFunctio
105105

106106
const updateAlertHandler = async (req: Request, res: Response, next: NextFunction) => {
107107
try {
108-
const { alertId } = req.params;
109-
const isEmpty = _.isEmpty(req.body);
108+
const alertId = _.get(req, 'params.alertId');
109+
const isEmpty = _.isEmpty(_.get(req, "body"));
110110
if (isEmpty) throw new Error("Failed to update record");
111111
const ruleModel = await getAlertRule(alertId);
112112
if (!ruleModel) { return next({ message: httpStatus[httpStatus.NOT_FOUND], statusCode: httpStatus.NOT_FOUND }) }
@@ -117,7 +117,7 @@ const updateAlertHandler = async (req: Request, res: Response, next: NextFunctio
117117
await deleteAlertRule(rulePayload, false);
118118
await retireAlertSilence(alertId);
119119
}
120-
const updatedPayload = getAlertPayload({ ...req.body, manager: rulePayload?.manager });
120+
const updatedPayload = getAlertPayload({ ..._.get(req, "body"), manager: rulePayload?.manager });
121121
await Alert.update({ ...updatedPayload, status: "draft", updated_by: userID }, { where: { id: alertId } });
122122
updateTelemetryAuditEvent({ request: req, currentRecord: rulePayload, object: { id: alertId, ...telemetryObject } });
123123
ResponseHandler.successResponse(req, res, { status: httpStatus.OK, data: { id: alertId } });
@@ -132,7 +132,7 @@ const updateAlertHandler = async (req: Request, res: Response, next: NextFunctio
132132

133133
const deleteSystemAlertsHandler = async (req: Request, res: Response, next: NextFunction) => {
134134
try {
135-
const body = req.body;
135+
const body = _.get(req, 'body', {});
136136
const { filters } = body;
137137
if (!filters) throw new Error("Failed to update record");
138138
await deleteSystemRules({ filters, manager: "grafana" });

‎api-service/src/controllers/Alerts/Metric.ts‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ const telemetryObject = { type: "metric", ver: "1.0.0" };
1010

1111
const createMetricHandler = async (req: Request, res: Response, next: NextFunction) => {
1212
try {
13-
const { component } = req.body;
14-
const metricsBody = await Metrics.create({ ...(req.body), component: component });
13+
const component = _.get(req, 'body.component');
14+
const metricsBody = await Metrics.create({ ...(_.get(req, 'body')), component: component });
1515
updateTelemetryAuditEvent({ request: req, object: { id: metricsBody?.dataValues?.id, ...telemetryObject } });
1616
ResponseHandler.successResponse(req, res, { status: httpStatus.OK, data: { id: metricsBody.dataValues.id } });
1717
} catch (error: any) {
@@ -36,8 +36,8 @@ const listMetricsHandler = async (req: Request, res: Response, next: NextFunctio
3636

3737
const updateMetricHandler = async (req: Request, res: Response, next: NextFunction) => {
3838
try {
39-
const { id } = req.params;
40-
const toUpdatePayload = req.body;
39+
const id = _.get(req, 'params.id');
40+
const toUpdatePayload = _.get(req, 'body');
4141
const { component } = toUpdatePayload;
4242
const isEmpty = _.isEmpty(toUpdatePayload);
4343
if (isEmpty) throw new Error("Failed to update record");
@@ -59,7 +59,7 @@ const updateMetricHandler = async (req: Request, res: Response, next: NextFuncti
5959

6060
const deleteMetricHandler = async (req: Request, res: Response, next: NextFunction) => {
6161
try {
62-
const { id } = req.params;
62+
const id = _.get(req, 'params.id');
6363
const record = await Metrics.findOne({ where: { id } });
6464
if (!record) throw new Error(httpStatus[httpStatus.NOT_FOUND]);
6565
await record.destroy();
@@ -72,7 +72,7 @@ const deleteMetricHandler = async (req: Request, res: Response, next: NextFuncti
7272

7373
const deleteMultipleMetricHandler = async (req: Request, res: Response, next: NextFunction) => {
7474
try {
75-
const { filters } = req.body;
75+
const filters = _.get(req, 'body.filters');
7676
if (!filters) throw new Error("Failed to update record");
7777
await Metrics.destroy({ where: filters });
7878
ResponseHandler.successResponse(req, res, { status: httpStatus.OK, data: {} });

‎api-service/src/controllers/Alerts/Silence.ts‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ const telemetryObject = { type: "alert-silence", ver: "1.0.0" };
1111

1212
const createHandler = async (request: Request, response: Response, next: NextFunction) => {
1313
try {
14-
const payload = request.body;
14+
const payload = _.get(request,'body');
1515
const { startDate, endDate, alertId } = payload;
1616
const existingSilence = await Silence.findOne({ where: { alert_id: alertId } });
1717
if (existingSilence) existingSilence.destroy();
@@ -59,7 +59,7 @@ const listHandler = async (request: Request, response: Response, next: NextFunct
5959

6060
const fetchHandler = async (request: Request, response: Response, next: NextFunction) => {
6161
try {
62-
const id = request.params.id;
62+
const id = _.get(request,'params.id');
6363
const silenceModel = await Silence.findOne({ where: { id } });
6464
const transformedSilence = await transformSilences(silenceModel);
6565
if (!silenceModel) return next({ message: httpStatus[httpStatus.NOT_FOUND], statusCode: httpStatus.NOT_FOUND });
@@ -72,8 +72,8 @@ const fetchHandler = async (request: Request, response: Response, next: NextFunc
7272

7373
const updateHandler = async (request: Request, response: Response, next: NextFunction) => {
7474
try {
75-
const id = request.params.id;
76-
const payload = request.body;
75+
const id = _.get(request,'params.id');
76+
const payload = _.get(request, 'body');
7777
const silenceModel = await Silence.findOne({ where: { id } });
7878
if (!silenceModel) return next({ message: httpStatus[httpStatus.NOT_FOUND], statusCode: httpStatus.NOT_FOUND });
7979
const silenceObject = silenceModel?.toJSON();
@@ -98,7 +98,7 @@ const updateHandler = async (request: Request, response: Response, next: NextFun
9898

9999
const deleteHandler = async (request: Request, response: Response, next: NextFunction) => {
100100
try {
101-
const id = request.params.id;
101+
const id = _.get(request,'params.id');
102102
const silenceModel = await Silence.findOne({ where: { id } });
103103
if (!silenceModel) return next({ message: httpStatus[httpStatus.NOT_FOUND], statusCode: httpStatus.NOT_FOUND });
104104
const silenceObject = silenceModel?.toJSON();

‎api-service/src/controllers/DataMetrics/DataMetricsController.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ const dataMetrics = async (req: Request, res: Response) => {
2626
const { url, method, headers = {}, body = {}, params = {}, ...rest } = query;
2727
const apiResponse = await axios.request({ url, method, headers, params, data: body, ...rest })
2828
const data = _.get(apiResponse, "data");
29+
res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
2930
return res.json(data);
3031
}
3132
else {

‎api-service/src/controllers/DatasetRead/DatasetRead.ts‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,9 @@ export const defaultFields = ["dataset_id", "name", "type", "status", "tags", "v
1919

2020
const validateRequest = (req: Request) => {
2121

22-
const { dataset_id } = req.params;
23-
const { fields, mode } = req.query;
22+
const dataset_id = _.get(req, 'params.dataset_id');
23+
const fields = _.get(req, 'query.fields');
24+
const mode = _.get(req, 'query.mode');
2425
const fieldValues = fields ? _.split(fields as string, ",") : [];
2526
const invalidFields = mode === "edit" ? _.difference(fieldValues, Object.keys(DatasetDraft.getAttributes())) : _.difference(fieldValues, Object.keys(Dataset.getAttributes()));
2627
if (!_.isEmpty(invalidFields)) {
@@ -32,8 +33,9 @@ const validateRequest = (req: Request) => {
3233
const datasetRead = async (req: Request, res: Response) => {
3334

3435
validateRequest(req);
35-
const { dataset_id } = req.params;
36-
const { fields, mode } = req.query;
36+
const dataset_id = _.get(req, 'params.dataset_id');
37+
const fields = _.get(req, 'query.fields');
38+
const mode = _.get(req, 'query.mode');
3739
const userID = (req as any)?.userID;
3840
const attributes = !fields ? defaultFields : _.split(<string>fields, ",");
3941
const dataset = (mode == "edit") ? await readDraftDataset(dataset_id, attributes, userID) : await readDataset(dataset_id, attributes)

‎api-service/src/controllers/NotificationChannel/Notification.ts‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,11 @@ const telemetryObject = { type: "notificationChannel", ver: "1.0.0" };
1111

1212
const createHandler = async (request: Request, response: Response, next: NextFunction) => {
1313
try {
14-
const payload = request.body;
14+
const body = _.get(request, "body");
1515
const userID = (request as any)?.userID;
16-
_.set(payload, "created_by", userID);
17-
_.set(payload, "updated_by", userID);
18-
const notificationBody = await Notification.create(payload);
16+
_.set(body, "created_by", userID);
17+
_.set(body, "updated_by", userID);
18+
const notificationBody = await Notification.create(body);
1919
updateTelemetryAuditEvent({ request, object: { id: notificationBody?.dataValues?.id, ...telemetryObject } });
2020
ResponseHandler.successResponse(request, response, { status: httpStatus.OK, data: { id: notificationBody.dataValues.id } })
2121
} catch (err) {
@@ -26,8 +26,8 @@ const createHandler = async (request: Request, response: Response, next: NextFun
2626

2727
const updateHandler = async (request: Request, response: Response, next: NextFunction) => {
2828
try {
29-
const { id } = request.params;
30-
const updatedPayload = request.body;
29+
const id = _.get(request, 'params.id');
30+
const updatedPayload = _.get(request, 'body');
3131
const notificationPayloadModel = await Notification.findOne({ where: { id } });
3232
const notificationPayload = notificationPayloadModel?.toJSON();
3333
if (!notificationPayload) return next({ message: httpStatus[httpStatus.NOT_FOUND], statusCode: httpStatus.NOT_FOUND });
@@ -47,7 +47,7 @@ const updateHandler = async (request: Request, response: Response, next: NextFun
4747

4848
const listHandler = async (request: Request, response: Response, next: NextFunction) => {
4949
try {
50-
const { limit, filters, offset } = request.body?.request || {};
50+
const { limit, filters, offset } = _.get(request.body, 'request', {});
5151
const notifications = await Notification.findAll({ limit: limit, offset: offset, ...(filters && { where: filters }) });
5252
const count = _.get(notifications, "length");
5353
ResponseHandler.successResponse(request, response, { status: httpStatus.OK, data: { notifications, ...(count && { count }) } });
@@ -59,7 +59,7 @@ const listHandler = async (request: Request, response: Response, next: NextFunct
5959

6060
const fetchHandler = async (request: Request, response: Response, next: NextFunction) => {
6161
try {
62-
const { id } = request.params;
62+
const id = _.get(request, 'params.id');
6363
const notificationPayloadModel = await Notification.findOne({ where: { id } });
6464
const notificationPayload = notificationPayloadModel?.toJSON();
6565
if (!notificationPayloadModel) return next({ message: httpStatus[httpStatus.NOT_FOUND], statusCode: httpStatus.NOT_FOUND });
@@ -73,7 +73,7 @@ const fetchHandler = async (request: Request, response: Response, next: NextFunc
7373

7474
const retireHandler = async (request: Request, response: Response, next: NextFunction) => {
7575
try {
76-
const { id } = request.params;
76+
const id = _.get(request, 'params.id');
7777
const notificationPayloadModel = await Notification.findOne({ where: { id } })
7878
const notificationPayload = notificationPayloadModel?.toJSON();
7979
if (!notificationPayload) return next({ message: httpStatus[httpStatus.NOT_FOUND], statusCode: httpStatus.NOT_FOUND });
@@ -90,7 +90,7 @@ const retireHandler = async (request: Request, response: Response, next: NextFun
9090

9191
const publishHandler = async (request: Request, response: Response, next: NextFunction) => {
9292
try {
93-
const { id } = request.params;
93+
const id = _.get(request, 'params.id');
9494
const notificationPayloadModel = await Notification.findOne({ where: { id } })
9595
const notificationPayload = notificationPayloadModel?.toJSON();
9696
if (!notificationPayload) return next({ message: httpStatus[httpStatus.NOT_FOUND], statusCode: httpStatus.NOT_FOUND });
@@ -108,7 +108,7 @@ const publishHandler = async (request: Request, response: Response, next: NextFu
108108

109109
const testNotifationChannelHandler = async (request: Request, response: Response, next: NextFunction) => {
110110
try {
111-
const { message = "Hello Obsrv", payload = {} } = request.body;
111+
const { message = "Hello Obsrv", payload = {} } = _.get(request, 'body');
112112
const { id } = payload;
113113
if (id) {
114114
const notificationPayloadModel = await Notification.findOne({ where: { id } })

‎api-service/src/controllers/UpdateQueryTemplate/UpdateTemplateController.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ const apiId = "api.query.template.update";
1212
const requiredVariables = _.get(config, "template_config.template_required_variables");
1313

1414
export const updateQueryTemplate = async (req: Request, res: Response) => {
15-
const requestBody = req.body;
15+
const requestBody = _.get(req, 'body');
1616
const templateId = _.get(req, "params.templateId");
1717
try {
1818
const msgid = _.get(req, "body.params.msgid");

‎api-service/src/helpers/ResponseHandler.ts‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ const ResponseHandler = {
1212
const { body, entity } = req as any;
1313
const msgid = _.get(body, ["params", "msgid"])
1414
const resmsgid = _.get(res, "resmsgid")
15+
res.setHeader('STRICT-TRANSPORT-SECURITY', 'max-age=31536000; includeSubDomains');
1516
res.status(result.status || 200).json(ResponseHandler.refactorResponse({ id: (req as any).id, result: result.data, msgid, resmsgid }));
1617
entity && onSuccess(req, res)
1718
},
@@ -34,6 +35,7 @@ const ResponseHandler = {
3435
const resmsgid = _.get(res, "resmsgid")
3536
const response = ResponseHandler.refactorResponse({ id, msgid, params: { status: "FAILED" }, responseCode: errCode || httpStatus["500_NAME"], resmsgid })
3637
const modifiedErrorResponse = _.omit(response, ["result"]);
38+
res.setHeader('STRICT-TRANSPORT-SECURITY', 'max-age=31536000; includeSubDomains');
3739
res.status(statusCode || httpStatus.INTERNAL_SERVER_ERROR).json({ ...modifiedErrorResponse, error: { code, message, trace } });
3840
entity && onFailure(req, res)
3941
},
@@ -46,6 +48,7 @@ const ResponseHandler = {
4648
const msgid = _.get(body, ["params", "msgid"])
4749
const resmsgid = _.get(res, "resmsgid")
4850
const response = ResponseHandler.refactorResponse({ id, msgid, params: { status: "FAILED" }, responseCode: errCode || httpStatus["500_NAME"], resmsgid, result: data })
51+
res.setHeader('STRICT-TRANSPORT-SECURITY', 'max-age=31536000; includeSubDomains');
4952
res.status(statusCode || httpStatus.INTERNAL_SERVER_ERROR).json({ ...response, error: { code, message } });
5053
entity && onObsrvFailure(req, res, error)
5154
},
@@ -58,11 +61,13 @@ const ResponseHandler = {
5861
flatResponse: (req: Request, res: Response, result: Result) => {
5962
const { entity } = req as any;
6063
entity && onSuccess(req, res)
64+
res.setHeader('STRICT-TRANSPORT-SECURITY', 'max-age=31536000; includeSubDomains');
6165
res.status(result.status).send(result.data);
6266
},
6367

6468
goneResponse: (req: Request, res: Response) => {
6569
const { id } = req as any;
70+
res.setHeader('STRICT-TRANSPORT-SECURITY', 'max-age=31536000; includeSubDomains');
6671
res.status(httpStatus.GONE).json({ id: id, ver: "v1", ts: Date.now(), params: { status: "FAILED", errmsg: "v1 APIs have been replace by /v2 APIs. Please refer to this link <addLink> for more information" }, responseCode: httpStatus["410_NAME"] })
6772
}
6873
}

0 commit comments

Comments
 (0)