Move the go examples to use go-agent

[prathamesh-sonpatki]

No description provided.

In general, to fix this type of issue you must validate and bound any user-controlled duration before passing it to setTimeout (or similar APIs). Reject values that are not finite integers or that exceed a reasonable maximum, and optionally enforce a minimum of zero.

For this codebase, the best fix is to validate req.query.delay in the /slow route, enforce an upper bound (for example, 10 seconds), and return a 400 Bad Request for invalid or out-of-range values. This preserves existing behavior for typical small delays while preventing attackers from creating arbitrarily long-lived timers. Concretely, in nodejs/node10-express/app.js:

• Replace the current line that computes delay with a slightly more explicit parse.
• Add checks:
  • If delay is NaN or negative, respond with HTTP 400 and an error message.
  • If delay exceeds a chosen maximum (for example, MAX_DELAY_MS = 10000), respond with HTTP 400 and an error message.
• Keep using setTimeout with the now-validated delay.

No new imports or external libraries are required; we can use built-in Number.isNaN and standard operators.

In general, the problem is fixed by adding rate-limiting middleware so that each client can only call expensive routes a limited number of times per time window. In Express, a common approach is to use the express-rate-limit package, configure a limiter, and apply it either globally (app.use(limiter)) or per-route (app.get('/path', limiter, handler)).

For this specific code, the least invasive and clearest fix is to add express-rate-limit at the top of db-examples.js, configure a limiter appropriate for database-backed endpoints (e.g. 100 requests per 15 minutes per IP), and then apply that limiter specifically to the PostgreSQL routes that touch the database. This avoids changing existing behavior except when a client exceeds the defined limit, and it doesn’t require altering the database logic itself. Concretely: (1) add const rateLimit = require('express-rate-limit'); near the other require calls, (2) define a dbRateLimiter instance after the app is created, and (3) change the PostgreSQL route definitions to include dbRateLimiter as middleware, e.g. app.get('/api/pg/users', dbRateLimiter, async (req, res) => { ... }) and similarly for app.post('/api/pg/users', dbRateLimiter, ...).

In general, to fix missing rate limiting on an Express route that performs expensive work (like DB access), you add a rate-limiting middleware (e.g., express-rate-limit) and apply it either globally or specifically to the sensitive route(s). This constrains how many requests a client (typically defined by IP) can make in a given time window, reducing DoS risk.

For this specific code, the least-invasive and most targeted fix is:

• Import express-rate-limit at the top of db-examples.js.
• Define a limiter instance configured for write-heavy/database-intensive routes (for example, relatively small max per time window).
• Apply that limiter only to the POST /api/pg/users route (the one flagged by CodeQL) by passing it as middleware before the async handler in app.post(...).

This preserves existing route behavior for allowed requests and only adds HTTP 429 responses when a client exceeds the configured rate. No changes to the DB logic, tracing, or response schemas are required.

Concretely:

• Add const RateLimit = require('express-rate-limit'); after the other require statements.
• Define const writeLimiter = RateLimit({ ... }) after the app and port declarations, but before routes.
• Change the app.post('/api/pg/users', async (req, res) => { ... }) signature to app.post('/api/pg/users', writeLimiter, async (req, res) => { ... }).

In general, to fix missing rate limiting you should introduce a rate-limiting middleware (for example using express-rate-limit) and apply it either globally (app.use(limiter)) or to particular expensive routes (app.get(path, limiter, handler) / app.post(...)). This middleware will cap the number of requests an individual client can make over a time window, reducing the risk of denial-of-service through excessive DB calls.

For this specific code, the least intrusive and clearest fix is to:

1. Import and configure express-rate-limit once near the top of db-examples.js.
2. Create a limiter instance suitable for these DB operations (e.g., a reasonable per-IP ceiling per time window).
3. Apply that limiter specifically to the MySQL routes that perform database access, by inserting it as a middleware parameter before the async handlers. This avoids changing any existing functionality inside the handlers and keeps the tracing and DB logic intact.

Concretely:

• Add const rateLimit = require('express-rate-limit'); near the other require calls.
• Define a limiter constant such as const dbRateLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }); after const app = express();.
• Update app.get('/api/mysql/orders/:userId', async (req, res) => { ... }) to app.get('/api/mysql/orders/:userId', dbRateLimiter, async (req, res) => { ... }).
• Similarly, rate-limit the batch-insert endpoint app.post('/api/mysql/products/bulk', ...) with the same limiter (or a stricter one) to protect the DB from heavy write load.

In general, the problem is best fixed by adding a rate-limiting middleware to the Express application for routes that perform expensive operations like database access. A widely used solution is the express-rate-limit package, which can be configured with reasonable defaults and applied either globally or per-route. This ensures the application will only process a bounded number of requests per client over a configured time window, mitigating denial-of-service risks.

For this specific code, the minimal, non-breaking fix is to import express-rate-limit, configure a limiter instance, and apply it to the /api/mysql/products/bulk POST route. This avoids altering the existing behavior of the handler itself; only the number of allowed requests per client in a time window is constrained. Concretely, in nodejs/node10-express/db-examples.js, we will (1) add a require('express-rate-limit') near the top, (2) define a limiter configuration tuned for bulk operations (e.g., relatively low max requests per 15 minutes), and (3) attach this limiter as middleware in the app.post('/api/mysql/products/bulk', ...) definition by inserting it as an argument before the async handler.

In general, to fix missing rate limiting on an expensive route, introduce a rate-limiting middleware (either globally or per-route) that constrains the number of requests an individual client can make within a time window. In Express, a common approach is to use the well-known express-rate-limit package and either apply it to all routes (app.use(limiter)) or to specific sensitive routes (app.put('/path', limiter, handler)).

For this specific case, the minimal, non-breaking fix is to add express-rate-limit as a dependency, require it near the top of db-examples.js, create a limiter configuration appropriate for database operations (e.g., some number of requests per minute per IP), and then apply that limiter specifically to the /api/mongo/cart/:userId route. This avoids changing the behavior of unrelated routes in this example file and keeps existing functionality intact while protecting the MongoDB upsert endpoint from easy abuse. Concretely: above the route definitions, add const rateLimit = require('express-rate-limit'); and define a cartUpdateLimiter limiter (e.g., windowMs: 1 minute, max: 60). Then change app.put('/api/mongo/cart/:userId', async (req, res) => { ... }) to insert cartUpdateLimiter as a middleware: app.put('/api/mongo/cart/:userId', cartUpdateLimiter, async (req, res) => { ... }).

In general, to fix missing rate limiting on an expensive route, you introduce a rate-limiting mechanism (middleware or inline logic) that tracks per-client usage over a time window and rejects requests that exceed a threshold with HTTP 429, while leaving allowed requests’ behavior unchanged. This can be implemented via a library such as express-rate-limit or via a custom Redis-based limiter, especially appropriate here because Redis is already in use.

The best fix here, without changing existing functionality, is to apply a lightweight, per-IP rate limit specifically to /api/cache/user/:id, using the same Redis client that the file already configures. That avoids new external dependencies and keeps behavior consistent. We can factor out a small helper that enforces a configurable limit and call it at the top of the cache route, returning 429 before performing any Redis get or PostgreSQL query if the client exceeds the limit. We’ll mirror the semantics of the existing /api/rate-limited/resource endpoint: using INCR, setting an expiry for the window, recording telemetry attributes, and adding standard rate-limit headers, but adapt it to be callable from within handlers. Concretely:

• Above the cache route, define an async function checkRateLimit(redisClient, keyPrefix, clientIp, maxRequests, windowSeconds, span) that:
  • Builds a Redis key (e.g., ${keyPrefix}:${clientIp}).
  • INCRs the counter and sets expiry on first use.
  • Retrieves TTL.
  • Populates span attributes.
  • Returns an object such as { allowed, current, ttl, maxRequests } instead of directly sending a response.
• In /api/cache/user/:id, right after starting the span and before any Redis/DB calls:
  • Call checkRateLimit(redisClient, 'rate:cache_user', clientIp, 100, 60, span) (or similar).
  • If !allowed, respond with 429 and appropriate headers and JSON, end the span, and return.
  • If allowed, set rate-limit headers and proceed exactly as before with the Redis get / PostgreSQL query / Redis setEx logic.

All changes are confined to nodejs/node10-express/db-examples.js in the shown region; no new imports are needed because we reuse the existing redisClient and opentelemetry objects.

---

In general, to fix this kind of issue, you introduce a rate-limiting middleware that runs before the handler and caps the number of requests per client over a time window. In Express, this is commonly done with express-rate-limit. The middleware can be applied globally (app.use(limiter)) or per-route (app.get('/path', limiter, handler)); per-route application avoids affecting unrelated endpoints.

For this file, the least intrusive fix that preserves existing behavior is:

1. Add a require('express-rate-limit') near the other top-level imports.
2. Configure a small, generic limiter (e.g., 60 requests per minute) that uses in-memory storage (default) so it does not depend on Redis and does not interfere with the internal Redis-based rate-limiting logic.
3. Apply this middleware only to /api/rate-limited/resource by adding it as the first argument after the path string:
   app.get('/api/rate-limited/resource', rateLimiter, async (req, res) => { ... }).

This adds the required rate limiting in front of the Redis calls, satisfies CodeQL’s rule, and leaves the rest of the logic (including the demonstration Redis-based rate limiting and telemetry) unchanged.

---

In general, to fix this class of issue you should never pass raw user input directly into the URL of an outgoing HTTP request. Instead, validate and normalize the input, and/or map it to a controlled value (for example, numeric IDs or values from an allow-list) before interpolating it into the path or query string.

For this endpoint, the simplest, non‑breaking fix is to constrain userId to a safe format before using it in the axios calls. The JSONPlaceholder API expects numeric IDs for users, posts, and todos, so we can parse the userId path parameter into an integer, ensure it is a positive finite number, and reject the request with a 400 error if validation fails. We then use this validated numericUserId when constructing the URLs. This preserves existing functionality for legitimate callers while preventing arbitrary strings from reaching the request URL.

Concretely, in nodejs/node10-express/db-examples.js within the /api/external/user-dashboard/:userId handler:

• Introduce validation logic right after extracting userId from req.params. Convert it to an integer with parseInt, and check that it is a positive integer (Number.isInteger, > 0, Number.isFinite).
• If validation fails, respond with HTTP 400 and do not make any external calls.
• Replace all uses of userId in the axios URLs with the validated numericUserId.
• Optionally, set a span attribute user.id using the validated value instead of the raw parameter.

No new helper methods or imports are required; we can use plain JavaScript number parsing and checks.

---

In general, the problem is best fixed by adding a rate‑limiting middleware to the Express application, either globally or specifically on routes that perform heavy database or external-service operations. A standard library such as express-rate-limit can be used to cap the number of requests per IP within a time window, limiting the potential for denial‑of‑service through excessive calls to the order-processing workflow.

For this codebase, the least invasive fix that preserves existing behavior is to: (1) import express-rate-limit near the top of nodejs/node10-express/db-examples.js, (2) define a rate limiter configuration dedicated to order processing (e.g., a modest per‑IP cap per minute), and (3) apply this limiter as middleware on the /api/orders/process route only. This avoids changing behavior of unrelated routes such as /health while protecting the expensive multi‑DB workflow. Concretely, add const rateLimit = require('express-rate-limit'); close to the other require calls, define const orderLimiter = rateLimit({...}) somewhere after the app is created, and change the route definition from app.post('/api/orders/process', async (req, res) => { ... }) to app.post('/api/orders/process', orderLimiter, async (req, res) => { ... }). No other logic in the handler needs to change.