Web interface #525

Closed
Sirherobrine23 wants to merge 7 commits from web-interface into main
No description provided.
github-advanced-security[bot] (Migrated from github.com) reviewed 2023-05-21 04:19:47 +00:00
github-advanced-security[bot] (Migrated from github.com) left a comment
Author
Owner

CodeQL found more than 10 potential problems in the proposed changes. Check the Files changed tab for more details.

CodeQL found more than 10 potential problems in the proposed changes. Check the [Files changed](/Sirherobrine23/bdsManeger/pull/525/files) tab for more details.
github-advanced-security[bot] (Migrated from github.com) reviewed 2023-05-30 04:29:22 +00:00
github-advanced-security[bot] (Migrated from github.com) commented 2023-05-30 04:29:22 +00:00
Author
Owner

Sensitive server cookie is missing 'httpOnly' flag.

Show more details

## Sensitive server cookie exposed to the client Sensitive server cookie is missing 'httpOnly' flag. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/130)
github-advanced-security[bot] (Migrated from github.com) commented 2023-05-30 04:29:22 +00:00
Author
Owner

Sensitive cookie sent without enforcing SSL encryption.

Show more details

## Clear text transmission of sensitive cookie Sensitive cookie sent without enforcing SSL encryption. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/131)
github-advanced-security[bot] (Migrated from github.com) reviewed 2023-05-30 15:34:30 +00:00
github-advanced-security[bot] (Migrated from github.com) commented 2023-05-30 15:34:29 +00:00
Author
Owner

Missing CSRF middleware

This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.

Show more details

## Missing CSRF middleware This cookie middleware is serving a [request handler](1) without CSRF protection. This cookie middleware is serving a [request handler](2) without CSRF protection. This cookie middleware is serving a [request handler](3) without CSRF protection. This cookie middleware is serving a [request handler](4) without CSRF protection. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/132)
github-advanced-security[bot] (Migrated from github.com) commented 2023-05-30 15:34:29 +00:00
Author
Owner

Missing rate limiting

This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.

Show more details

## Missing rate limiting This route handler performs [a database access](1), but is not rate-limited. This route handler performs [a database access](2), but is not rate-limited. This route handler performs [a database access](3), but is not rate-limited. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/133)
github-advanced-security[bot] (Migrated from github.com) commented 2023-05-30 15:34:30 +00:00
Author
Owner

Missing rate limiting

This route handler performs a database access, but is not rate-limited.

Show more details

## Missing rate limiting This route handler performs [a database access](1), but is not rate-limited. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/134)
github-advanced-security[bot] (Migrated from github.com) reviewed 2023-05-31 03:09:08 +00:00
github-advanced-security[bot] (Migrated from github.com) commented 2023-05-31 03:09:07 +00:00
Author
Owner

Missing rate limiting

This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.

Show more details

## Missing rate limiting This route handler performs [a database access](1), but is not rate-limited. This route handler performs [a database access](2), but is not rate-limited. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/135)
github-advanced-security[bot] (Migrated from github.com) commented 2023-05-31 03:09:07 +00:00
Author
Owner

Missing rate limiting

This route handler performs a database access, but is not rate-limited.

Show more details

## Missing rate limiting This route handler performs [a database access](1), but is not rate-limited. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/136)
github-advanced-security[bot] (Migrated from github.com) commented 2023-05-31 03:09:07 +00:00
Author
Owner

Missing rate limiting

This route handler performs a database access, but is not rate-limited.

Show more details

## Missing rate limiting This route handler performs [a database access](1), but is not rate-limited. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/137)
github-advanced-security[bot] (Migrated from github.com) commented 2023-05-31 03:09:07 +00:00
Author
Owner

Missing rate limiting

This route handler performs a database access, but is not rate-limited.

Show more details

## Missing rate limiting This route handler performs [a database access](1), but is not rate-limited. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/138)
github-advanced-security[bot] (Migrated from github.com) commented 2023-05-31 03:09:07 +00:00
Author
Owner

Missing rate limiting

This route handler performs a database access, but is not rate-limited.

Show more details

## Missing rate limiting This route handler performs [a database access](1), but is not rate-limited. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/139)
github-advanced-security[bot] (Migrated from github.com) reviewed 2023-06-01 03:07:18 +00:00
github-advanced-security[bot] (Migrated from github.com) commented 2023-06-01 03:07:17 +00:00
Author
Owner

Sensitive server cookie is missing 'httpOnly' flag.

Show more details

## Sensitive server cookie exposed to the client Sensitive server cookie is missing 'httpOnly' flag. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/140)
github-advanced-security[bot] (Migrated from github.com) commented 2023-06-01 03:07:17 +00:00
Author
Owner

Missing CSRF middleware

This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.

Show more details

## Missing CSRF middleware This cookie middleware is serving a [request handler](1) without CSRF protection. This cookie middleware is serving a [request handler](2) without CSRF protection. This cookie middleware is serving a [request handler](3) without CSRF protection. This cookie middleware is serving a [request handler](4) without CSRF protection. This cookie middleware is serving a [request handler](5) without CSRF protection. This cookie middleware is serving a [request handler](6) without CSRF protection. This cookie middleware is serving a [request handler](7) without CSRF protection. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/141)
github-advanced-security[bot] (Migrated from github.com) commented 2023-06-01 03:07:17 +00:00
Author
Owner

Missing rate limiting

This route handler performs a database access, but is not rate-limited.

Show more details

## Missing rate limiting This route handler performs [a database access](1), but is not rate-limited. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/142)
github-advanced-security[bot] (Migrated from github.com) commented 2023-06-01 03:07:17 +00:00
Author
Owner

Missing rate limiting

This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.

Show more details

## Missing rate limiting This route handler performs [a database access](1), but is not rate-limited. This route handler performs [a database access](2), but is not rate-limited. This route handler performs [a database access](3), but is not rate-limited. This route handler performs [a database access](4), but is not rate-limited. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/143)
github-advanced-security[bot] (Migrated from github.com) commented 2023-06-01 03:07:17 +00:00
Author
Owner

Missing rate limiting

This route handler performs a database access, but is not rate-limited.

Show more details

## Missing rate limiting This route handler performs [a database access](1), but is not rate-limited. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/144)
github-advanced-security[bot] (Migrated from github.com) reviewed 2023-06-19 04:35:52 +00:00
@ -0,0 +78,4 @@
maxAge: 1000 * 60 * 60 * 24 * 30 * 2,
},
store: new SessionMongo(),
});
github-advanced-security[bot] (Migrated from github.com) commented 2023-06-19 04:35:52 +00:00
Author
Owner

Sensitive cookie sent without enforcing SSL encryption.

Show more details

## Clear text transmission of sensitive cookie Sensitive cookie sent without enforcing SSL encryption. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/145)
github-advanced-security[bot] (Migrated from github.com) commented 2023-06-19 04:35:52 +00:00
Author
Owner

Sensitive server cookie is missing 'httpOnly' flag.

Show more details

## Sensitive server cookie exposed to the client Sensitive server cookie is missing 'httpOnly' flag. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/146)
@ -0,0 +169,4 @@
export async function generateUserID() {
let userID: string;
while (true) if (!(await usersCollection.findOne({userID: (userID = random())}))) break;
github-advanced-security[bot] (Migrated from github.com) commented 2023-06-19 04:35:52 +00:00
Author
Owner

Insecure randomness

This uses a cryptographically insecure random number generated at crypto. ... ytes(8) in a security context.
This uses a cryptographically insecure random number generated at crypto. ... ytes(4) in a security context.
This uses a cryptographically insecure random number generated at crypto. ... ytes(4) in a security context.
This uses a cryptographically insecure random number generated at crypto. ... ytes(4) in a security context.
This uses a cryptographically insecure random number generated at crypto. ... tes(12) in a security context.

Show more details

## Insecure randomness This uses a cryptographically insecure random number generated at [crypto. ... ytes(8)](1) in a security context. This uses a cryptographically insecure random number generated at [crypto. ... ytes(4)](2) in a security context. This uses a cryptographically insecure random number generated at [crypto. ... ytes(4)](3) in a security context. This uses a cryptographically insecure random number generated at [crypto. ... ytes(4)](4) in a security context. This uses a cryptographically insecure random number generated at [crypto. ... tes(12)](5) in a security context. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/147)
github-advanced-security[bot] (Migrated from github.com) reviewed 2023-06-20 02:36:26 +00:00
@ -0,0 +12,4 @@
server.on("request", app);
app.disable("etag").disable("x-powered-by");
app.use(cookie, authRoute, express.json(), express.urlencoded({ extended: true }));
github-advanced-security[bot] (Migrated from github.com) commented 2023-06-20 02:36:26 +00:00
Author
Owner

Missing rate limiting

This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.

Show more details

## Missing rate limiting This route handler performs [a database access](1), but is not rate-limited. This route handler performs [a database access](2), but is not rate-limited. This route handler performs [a database access](3), but is not rate-limited. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/148)
@ -0,0 +28,4 @@
export default app;
export const serverSessions = new Map<string, bdsCore.Bedrock.Bedrock<any> | bdsCore.Java.Java<any>>();
app.get("/public", (_req, res, next) => serverCollection.find({ public: true }).toArray().then(data => res.json(data.map(v => ({ ID: v.ID, serverPlatform: v.platform }))), next));
github-advanced-security[bot] (Migrated from github.com) commented 2023-06-20 02:36:26 +00:00
Author
Owner

Missing rate limiting

This route handler performs a database access, but is not rate-limited.

Show more details

## Missing rate limiting This route handler performs [a database access](1), but is not rate-limited. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/149)
@ -0,0 +35,4 @@
return next();
});
app.get("/", (req, res, next) => serverCollection.find({ usersID: [req.session.userID] }).toArray().then(res.json, next));
github-advanced-security[bot] (Migrated from github.com) commented 2023-06-20 02:36:26 +00:00
Author
Owner

Missing rate limiting

This route handler performs a database access, but is not rate-limited.

Show more details

## Missing rate limiting This route handler performs [a database access](1), but is not rate-limited. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/150)
@ -0,0 +82,4 @@
await serverManeger.installServer(version);
return res.json(serverManeger.getVersion(version));
});
github-advanced-security[bot] (Migrated from github.com) commented 2023-06-20 02:36:26 +00:00
Author
Owner

Missing rate limiting

This route handler performs a database access, but is not rate-limited.

Show more details

## Missing rate limiting This route handler performs [a database access](1), but is not rate-limited. [Show more details](https://github.com/Sirherobrine23/bdsManeger/security/code-scanning/151)
This repo is archived. You cannot comment on pull requests.
No reviewers
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: go-bds/Maneger#525
No description provided.