Potential fix for code scanning alert no. 353: Missing rate limiting

[EugeniyKiyashko]

Potential fix for https://github.com/DevExpress/DevExtreme/security/code-scanning/353

To fix this, add rate limiting middleware to the Express app and apply it to the routes that trigger the expensive file-system operations (demoIndexHandler). The most straightforward way, consistent with the background example, is to use the well-known express-rate-limit package. This keeps existing functionality (same handler logic and routes) while enforcing a maximum number of requests per client in a time window, reducing DOS risk from repeated calls to readFileSync and readdirSync.

Concretely:

• In apps/demos/utils/server/csp-server.js, require express-rate-limit near the other require calls.
• Configure a limiter instance with a reasonable window and max value; since this is a demo server, a generic configuration (e.g., 100 requests per 15 minutes per IP) is acceptable and mirrors the background example.
• Apply the limiter as middleware specifically for the demo routes, not globally, to avoid changing behavior of unrelated endpoints. For example, define const demoIndexLimiter = RateLimit({...}) and then change the route definitions to app.get('/apps/demos/...', demoIndexLimiter, demoIndexHandler);.
• No changes are needed inside demoIndexHandler itself; only the route wiring is updated.

All changes are limited to the shown file and keep existing behavior aside from introducing rate limiting on the risky endpoints.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

Adds request rate limiting to the CSP demo server’s expensive demo index endpoints to address code scanning alert #353 (“Missing rate limiting”) and reduce DoS risk from repeated synchronous filesystem access.

Changes:

• Added express-rate-limit to the demos app dependencies and lockfile.
• Wired a rate limiter middleware into the two /apps/demos/Demos/... routes handled by demoIndexHandler.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
pnpm-lock.yaml	Records the new express-rate-limit resolution for the demos app.
apps/demos/utils/server/csp-server.js	Imports and applies an express-rate-limit middleware to demo index routes.
apps/demos/package.json	Adds express-rate-limit to the demos app package manifest.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported