Web interface #525
No reviewers
Labels
No Label
bug
dependencies
documentation
duplicate
enhancement
github_actions
good first issue
help wanted
invalid
javascript
question
Sirherobrine23
wontfix
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
No Milestone
No Assignees
1 Participants
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: go-bds/Maneger#525
Loading…
x
Reference in New Issue
Block a user
No description provided.
Delete Branch "web-interface"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
CodeQL found more than 10 potential problems in the proposed changes. Check the Files changed tab for more details.
Sensitive server cookie exposed to the client
Sensitive server cookie is missing 'httpOnly' flag.
Show more details
Clear text transmission of sensitive cookie
Sensitive cookie sent without enforcing SSL encryption.
Show more details
Missing CSRF middleware
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
Sensitive server cookie exposed to the client
Sensitive server cookie is missing 'httpOnly' flag.
Show more details
Missing CSRF middleware
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
Show more details
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
@ -0,0 +78,4 @@
maxAge: 1000 * 60 * 60 * 24 * 30 * 2,
},
store: new SessionMongo(),
});
Clear text transmission of sensitive cookie
Sensitive cookie sent without enforcing SSL encryption.
Show more details
Sensitive server cookie exposed to the client
Sensitive server cookie is missing 'httpOnly' flag.
Show more details
@ -0,0 +169,4 @@
export async function generateUserID() {
let userID: string;
while (true) if (!(await usersCollection.findOne({userID: (userID = random())}))) break;
Insecure randomness
This uses a cryptographically insecure random number generated at crypto. ... ytes(8) in a security context.
This uses a cryptographically insecure random number generated at crypto. ... ytes(4) in a security context.
This uses a cryptographically insecure random number generated at crypto. ... ytes(4) in a security context.
This uses a cryptographically insecure random number generated at crypto. ... ytes(4) in a security context.
This uses a cryptographically insecure random number generated at crypto. ... tes(12) in a security context.
Show more details
@ -0,0 +12,4 @@
server.on("request", app);
app.disable("etag").disable("x-powered-by");
app.use(cookie, authRoute, express.json(), express.urlencoded({ extended: true }));
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
This route handler performs a database access, but is not rate-limited.
Show more details
@ -0,0 +28,4 @@
export default app;
export const serverSessions = new Map<string, bdsCore.Bedrock.Bedrock<any> | bdsCore.Java.Java<any>>();
app.get("/public", (_req, res, next) => serverCollection.find({ public: true }).toArray().then(data => res.json(data.map(v => ({ ID: v.ID, serverPlatform: v.platform }))), next));
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
@ -0,0 +35,4 @@
return next();
});
app.get("/", (req, res, next) => serverCollection.find({ usersID: [req.session.userID] }).toArray().then(res.json, next));
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details
@ -0,0 +82,4 @@
await serverManeger.installServer(version);
return res.json(serverManeger.getVersion(version));
});
Missing rate limiting
This route handler performs a database access, but is not rate-limited.
Show more details