Web interface #525
Reference in New Issue
Block a user
No description provided.
Delete Branch "web-interface"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
CodeQL found more than 10 potential problems in the proposed changes. Check the Files changed tab for more details.
Sensitive server cookie exposed to the client
Sensitive server cookie is missing 'httpOnly' flag.
Show more details
Clear text transmission of sensitive cookie
Sensitive cookie sent without enforcing SSL encryption.
Show more details
Missing CSRF middleware
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
Sensitive server cookie exposed to the client
Sensitive server cookie is missing 'httpOnly' flag.
Show more details
Missing CSRF middleware
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
@ -0,0 +78,4 @@
maxAge: 1000 * 60 * 60 * 24 * 30 * 2,
},
store: new SessionMongo(),
});
Clear text transmission of sensitive cookie
Sensitive cookie sent without enforcing SSL encryption.
Show more details
Sensitive server cookie exposed to the client
Sensitive server cookie is missing 'httpOnly' flag.
Show more details
@ -0,0 +169,4 @@
export async function generateUserID() {
let userID: string;
while (true) if (!(await usersCollection.findOne({userID: (userID = random())}))) break;
Insecure randomness
This uses a cryptographically insecure random number generated at crypto. ... ytes(8) in a security context.
This uses a cryptographically insecure random number generated at crypto. ... ytes(4) in a security context.
This uses a cryptographically insecure random number generated at crypto. ... ytes(4) in a security context.
This uses a cryptographically insecure random number generated at crypto. ... ytes(4) in a security context.
This uses a cryptographically insecure random number generated at crypto. ... tes(12) in a security context.
Show more details
@ -0,0 +12,4 @@
server.on("request", app);
app.disable("etag").disable("x-powered-by");
app.use(cookie, authRoute, express.json(), express.urlencoded({ extended: true }));
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
Show more details
@ -0,0 +28,4 @@
export default app;
export const serverSessions = new Map<string, bdsCore.Bedrock.Bedrock<any> | bdsCore.Java.Java<any>>();
app.get("/public", (_req, res, next) => serverCollection.find({ public: true }).toArray().then(data => res.json(data.map(v => ({ ID: v.ID, serverPlatform: v.platform }))), next));
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
@ -0,0 +35,4 @@
return next();
});
app.get("/", (req, res, next) => serverCollection.find({ usersID: [req.session.userID] }).toArray().then(res.json, next));
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
@ -0,0 +82,4 @@
await serverManeger.installServer(version);
return res.json(serverManeger.getVersion(version));
});
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details