chore(deps): upgrade dependencies and remove production vulnerabilities

test/rate-limit-key.test.js

@@ -0,0 +1,47 @@
+/* global fetch */
+const { expect } = require("chai");
+const express = require("express");
+const { rateLimit } = require("express-rate-limit");
+require("ts-node/register/transpile-only");
+const { requestRateLimitKey } = require("../src/server/rate-limit-key");
+
+describe("rate limiter client addresses", function () {
+  const key = (ip, headers = {}, remoteAddress = "127.0.0.1") =>
+    requestRateLimitKey({ ip, headers, socket: { remoteAddress } });
+
+  it("normalizes IPv4 ports and mapped IPv6 without truncating native IPv6", function () {
+    expect(key("192.0.2.1:1234")).to.equal("192.0.2.1");
+    expect(key("::ffff:192.0.2.1")).to.equal("192.0.2.1");
+    expect(key("2001:db8:abcd:1200::1234")).to.equal("2001:db8:abcd:1200::/56");
+    expect(key("2001:db8:abcd:1300::1234")).not.to.equal(key("2001:db8:abcd:1200::1234"));
+  });
+
+  it("accepts the visitor header only for a Cloudflare edge address", function () {
+    expect(key("192.0.2.1", { "cf-connecting-ip": "198.51.100.1" })).to.equal("192.0.2.1");
+    expect(key("104.16.0.1", { "cf-connecting-ip": " 198.51.100.1 " })).to.equal("198.51.100.1");
+    expect(key("104.16.0.1", { "cf-connecting-ip": " " })).to.equal("104.16.0.1");
+    expect(key(undefined, {}, "::ffff:192.0.2.1")).to.equal("192.0.2.1");
+  });
+
+  it("shares limits across IPv6 addresses within a subnet and ignores forged Cloudflare headers", async function () {
+    const app = express();
+    app.set("trust proxy", "loopback");
+    app.use(rateLimit({ windowMs: 60000, limit: 1, keyGenerator: requestRateLimitKey }));
+    app.get("/", (_req, res) => res.send("ok"));
+    let server;
+    await new Promise(resolve => { server = app.listen(0, "127.0.0.1", resolve); });
+    const request = (ip, visitor) => fetch(`http://127.0.0.1:${server.address().port}/`, {
+      headers: { "x-forwarded-for": ip, "cf-connecting-ip": visitor },
+    });
+    try {
+      expect((await request("2001:db8:abcd:1200::1", "198.51.100.1")).status).to.equal(200);
+      expect((await request("2001:db8:abcd:12ff::2", "198.51.100.2")).status).to.equal(429);
+      expect((await request("2001:db8:abcd:1300::1", "198.51.100.1")).status).to.equal(200);
+      expect((await request("192.0.2.1", "198.51.100.1")).status).to.equal(200);
+      expect((await request("::ffff:192.0.2.1", "198.51.100.2")).status).to.equal(429);
+    } finally {
+      server.closeAllConnections();
+      await new Promise(resolve => server.close(resolve));
+    }
+  });
+});