Repository navigation
security: rate-limit every route (express-rate-limit) — fixes CodeQL js/missing-rate-limiting - #76
Merged
Merged
Conversation
…issing-rate-limiting) Fixes the 11 open js/missing-rate-limiting alerts on master (#64-#74: backup.js:20, library.js:35/56/90/114/176/293, sessions.js:180/227, watch.js:196, server.js:67) and #78 on #75. Every route handler touches the filesystem and none had a limiter. lib/rate-limit.js: express-rate-limit 8.7.1, 600 requests / 60 s per client IP, draft-8 RateLimit headers, JSON 429 body. Mounted with app.use() in server.js before the static files, /api/version and every route module, so it covers API, static and the SPA fallback. Not disabled in tests: each test file starts its own server and no test comes near 600 requests a minute. New test (test/api.test.js) asserts the RateLimit-Policy q=600 / w=60 on /api/version, / and the SPA fallback, so the test count is 349: claims.json test-count and docs/ROADMAP.md updated to 349 (the number follows the code, the gate is unchanged). Local (Node 22.23.3): npm ci + build OK, no pure.js/diagnostics.cjs drift, biome exit 0, npm test 349/349, verify-claims 16 ok / 0 error / 3 manual.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
根因
CodeQL 的
js/missing-rate-limiting在 master 上有 11 条开着的告警，#75 上还有 1 条（#78）。原因是每个路由处理函数都会读写文件系统，但没有任何限流：修复
lib/rate-limit.js：express-rate-limit 8.7.1（2026-10-06 发布，持续维护）。按客户端 IP 每 60 秒最多 600 个请求，返回 draft-8 的RateLimit/RateLimit-Policy头，超出返回 429 和 JSON 错误。server.js：在静态文件、/api/version和所有路由模块之前app.use(limiter)，API、静态资源和 SPA 兜底都覆盖到。test/api.test.js）：检查/api/version、/和 SPA 兜底都带RateLimit-Policy，且q=600、w=60。测试总数因此变成 349，claims.json的 test-count 和docs/ROADMAP.md同步改成 349。只改数字，门槛不变。本地验证（Node 22.23.3）
npm ci（完整构建 UI）：✓ built in 2.76s；pure.js 和 diagnostics.cjs 没有漂移；biome checkexit 0npm test：# tests 349 · # pass 349 · # fail 0 · # cancelled 016 machine-checked · 16 ok · 0 failed · 0 error · 3 manual验收标准
# tests 349 # pass 349 # fail 016 ok · 0 failed · 0 errorjs/missing-rate-limiting告警数为 0