chore(deps): upgrade dependencies and remove production vulnerabilities

src/server/index.ts

@@ -34,7 +34,8 @@ import {
 } from "./dailyStatsSnapshot";
 import { getUser } from "./routes/route-utils";
 import config from "../config";
-import { resolveTrustProxy, isCloudflareIP } from "./trustProxy";
+import { resolveTrustProxy } from "./trustProxy";
+import { requestRateLimitKey } from "./rate-limit-key";
 import { createLogger, serializeError } from "../core/logger";
 import { monitorRequests } from "../core/request-monitoring";
 import { startPerformanceMonitoring } from "../core/performance-monitoring";
@@ -156,37 +157,6 @@ export default async function start() {
 
   await redisClient.connect();
 
-  function keyGenerator(
-    request: express.Request,
-    _response: express.Response
-  ): string {
-    // Use request.ip, which Express resolves from X-Forwarded-For honouring
-    // the configured "trust proxy" setting. Do NOT key off the
-    // cf-connecting-ip header unconditionally: when the server isn't actually
-    // behind Cloudflare a client can set that header to an arbitrary value
-    // per request and trivially bypass the rate limiter (CWE-290).
-    let ip = request.ip;
-    if (!ip && request.socket.remoteAddress) {
-      logger.warn("request.ip is missing");
-      ip = request.socket.remoteAddress;
-    }
-    // If resolution stopped at a Cloudflare edge address (X-Forwarded-For no
-    // longer contains the visitor, e.g. after a Cloudflare-side change), fall
-    // back to cf-connecting-ip. This is safe: request.ip can only be a
-    // Cloudflare address when every hop up to it is trusted, i.e. the request
-    // genuinely traversed Cloudflare. A direct client forging the header is
-    // keyed by its own untrusted address instead, so the CWE-290 bypass above
-    // does not apply.
-    if (ip && isCloudflareIP(ip)) {
-      const cfConnectingIP = request.headers["cf-connecting-ip"];
-      if (typeof cfConnectingIP === "string" && cfConnectingIP) {
-        ip = cfConnectingIP.trim();
-      }
-    }
-    // remove port number from IPv4 addresses
-    return (ip || "").replace(/:\d+[^:]*$/, "");
-  }
-
   const rate = rateLimit({
     store: new RedisStore({
       sendCommand: (...args: string[]) => redisClient.sendCommand(args),
@@ -201,7 +171,7 @@ export default async function start() {
       }
       return false;
     },
-    max: async (request: express.Request, _response: express.Response) => {
+    limit: async (request: express.Request, _response: express.Response) => {
       try {
         const user = await getUser(request);
         if (user) return config.RATE_LIMIT;
@@ -211,8 +181,8 @@ export default async function start() {
       // if not logged in, limit to half the rate
       return config.RATE_LIMIT / 2;
     },
-    keyGenerator,
-    standardHeaders: true,
+    keyGenerator: requestRateLimitKey,
+    standardHeaders: "draft-6",
     legacyHeaders: false,
     message: (_request: express.Request, _response: express.Response) => {
       return `You can only make ${config.RATE_LIMIT} requests every 15min. Please try again later.`;
@@ -223,14 +193,14 @@ export default async function start() {
     delayAfter: 50,
     delayMs: () => 150,
     maxDelayMs: 5000,
-    keyGenerator,
+    keyGenerator: requestRateLimitKey,
   });
   const webViewSpeedLimiter = slowDown({
     windowMs: 15 * 60 * 1000, // 15 minutes
     delayAfter: 200,
     delayMs: () => 150,
     maxDelayMs: 5000,
-    keyGenerator,
+    keyGenerator: requestRateLimitKey,
   });
 
   app.use("/github", rate, speedLimiter, githubAppRouter);

src/server/rate-limit-key.ts

@@ -0,0 +1,16 @@
+import { Request } from "express";
+import { ipKeyGenerator } from "express-rate-limit";
+import { isCloudflareIP } from "./trustProxy";
+
+export function requestRateLimitKey(request: Request): string {
+  // Express resolves request.ip using the configured trusted proxies.
+  let ip = request.ip || request.socket.remoteAddress || "";
+  // Only accept Cloudflare's visitor header when resolution reached its edge.
+  if (isCloudflareIP(ip)) {
+    const visitor = request.headers["cf-connecting-ip"];
+    if (typeof visitor === "string" && visitor.trim()) ip = visitor.trim();
+  }
+  // Some proxies append a port to IPv4 addresses. Do not truncate IPv6.
+  ip = ip.replace(/^(\d{1,3}(?:\.\d{1,3}){3}):\d+$/, "$1");
+  return ipKeyGenerator(ip);
+}

src/server/routes/admin.ts

@@ -600,15 +600,15 @@ router.delete("/errors", async (req, res) => {
     // SCAN the hourly counter keys and del them along with the list and
     // dropped counter so the admin page comes back to a clean slate.
     const hourlyKeys: string[] = [];
-    let cursor = 0;
+    let cursor = "0";
     do {
       const reply = await client.scan(cursor, {
         MATCH: `${ERROR_LOG_HOURLY_PREFIX}*`,
         COUNT: 100,
       });
-      cursor = Number(reply.cursor);
+      cursor = reply.cursor;
       for (const k of reply.keys) hourlyKeys.push(k);
-    } while (cursor !== 0);
+    } while (cursor !== "0");
     const pipe = client.multi();
     pipe.del(ERROR_LOG_KEY);
     pipe.del(ERROR_LOG_DROPPED_KEY);

src/server/routes/connection.ts

@@ -1,7 +1,7 @@
 import { createClient } from "redis";
 import * as passport from "passport";
 import * as session from "express-session";
-import RedisStore from "connect-redis";
+import { RedisStore } from "connect-redis";
 import * as OAuth2Strategy from "passport-oauth2";
 import { Profile, Strategy } from "passport-github2";
 import * as express from "express";
@@ -166,7 +166,6 @@ passport.deserializeUser(async (id: string, done) => {
 
 export function initSession() {
   const redisClient = createClient({
-    legacyMode: false,
     socket: {
       port: config.REDIS_PORT,
       host: config.REDIS_HOSTNAME,

src/server/routes/webview.ts

@@ -189,7 +189,7 @@ async function webView(
     if (f.extension() == "md") {
       try {
         const content = await streamToString(await f.anonymizedContent());
-        const body = sanitizeHtml(marked.marked(content, { headerIds: false, mangle: false }), sanitizeOptions);
+        const body = sanitizeHtml(marked.marked.parse(content, { async: false }), sanitizeOptions);
         const html = `<!DOCTYPE html><html><head><title>Content</title></head><link rel="stylesheet" href="/css/all.min.css" /><body><div class="container p-3 file-content markdown-body">${body}</div></body></html>`;
         res.contentType("text/html").send(html);
       } catch {