-
Notifications
You must be signed in to change notification settings - Fork 6
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Improvements and bug fixes #87
Changes from all commits
dac6865
0207e91
62f3e0a
b0ed584
7dd098a
f2bd855
6900516
f1deec2
8bf56b1
6a96909
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,13 +1,56 @@ | ||
import { Router } from "express"; | ||
import { dbConnect, unescapeObjectKeys } from "../db/utils"; | ||
import { AdapterStats } from "../global/adapter-stats"; | ||
import { AdapterStats, AdapterVersions } from "../global/adapter-stats"; | ||
import { Statistics } from "../global/iobroker"; | ||
|
||
const router = Router(); | ||
|
||
router.get("/api/adapter/:name/stats", async function (req, res) { | ||
router.get("/api/adapter/:name/stats/now", async function (req, res) { | ||
try { | ||
const { name } = req.params; | ||
if (!isValidAdapterName(name)) { | ||
res.status(404).send("Adapter not found"); | ||
return; | ||
} | ||
|
||
const db = await dbConnect(); | ||
const rawStatistics = db.rawStatistics(); | ||
|
||
const stats = await rawStatistics | ||
.find() | ||
.project<Statistics>({ | ||
adapters: { [name]: 1 }, | ||
versions: { [name]: 1 }, | ||
Check failure Code scanning / CodeQL Remote property injection High
A property name to write to depends on a
user-provided value Error loading related location Loading Check failure Code scanning / CodeQL Remote property injection High
A property name to write to depends on a
user-provided value Error loading related location Loading There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Name is now checked against some regexes that ensure it can only be a valid adapter name. These names can't be used for prototype pollution or similar attacks. |
||
date: 1, | ||
Check failure Code scanning / CodeQL Remote property injection High
A property name to write to depends on a
user-provided value Error loading related location Loading There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Name is now checked against some regexes that ensure it can only be a valid adapter name. These names can't be used for prototype pollution or similar attacks. |
||
_id: 0, | ||
}) | ||
.sort({ date: -1 }) | ||
.limit(1) | ||
.toArray(); | ||
if (stats.length === 0) { | ||
res.status(404).send("Adapter not found"); | ||
return; | ||
} | ||
|
||
const stat = unescapeObjectKeys(stats[0]); | ||
const versions: AdapterVersions = { | ||
total: stat.adapters[name] ?? 0, | ||
versions: stat.versions[name] ?? {}, | ||
}; | ||
res.send(versions); | ||
} catch (error: any) { | ||
console.error(error); | ||
res.status(500).send("An unexpected error occurred"); | ||
} | ||
}); | ||
|
||
router.get("/api/adapter/:name/stats/history", async function (req, res) { | ||
try { | ||
const { name } = req.params; | ||
if (!isValidAdapterName(name)) { | ||
res.status(404).send("Adapter not found"); | ||
return; | ||
} | ||
const db = await dbConnect(); | ||
const rawStatistics = db.rawStatistics(); | ||
const repoAdapters = db.repoAdapters(); | ||
|
@@ -62,15 +105,25 @@ | |
|
||
console.log(result); | ||
if (Object.keys(result.counts).length === 0) { | ||
res.status(404).send(`Adapter ${name} not found`); | ||
res.status(404).send("Adapter not found"); | ||
return; | ||
} | ||
|
||
res.send(result); | ||
} catch (error: any) { | ||
console.error(error); | ||
res.status(500).send(error.message || error); | ||
res.status(500).send("An unexpected error occurred"); | ||
} | ||
}); | ||
|
||
function isValidAdapterName(name: string) { | ||
const forbiddenChars = /[^a-z0-9\-_]/g; | ||
if (forbiddenChars.test(name)) { | ||
return false; | ||
} | ||
|
||
// the name must start with a letter | ||
return /^[a-z]/.test(name); | ||
} | ||
|
||
export default router; |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,7 +1,7 @@ | ||
import { useUserContext } from "../../contexts/UserContext"; | ||
import { CardButton } from "../CardButton"; | ||
|
||
export function LoginButton() { | ||
export function LoginButton({ variant }: { variant?: string }) { | ||
const { login } = useUserContext(); | ||
return <CardButton text="Login" onClick={login} />; | ||
return <CardButton text="Login" onClick={login} variant={variant} />; | ||
} |
Check failure
Code scanning / CodeQL
Remote property injection High