Vulnerability fix changes #370
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,9 +1,50 @@ | ||
| # Build stage | ||
| FROM --platform=linux/amd64 public.ecr.aws/docker/library/node:24.13.1-slim AS builder | ||
| RUN npm install -g npm@11.10.1 \ | ||
| && npm pack tar@7.5.11 \ | ||
| && tar -xzf tar-7.5.11.tgz -C /usr/local/lib/node_modules/npm/node_modules/tar --strip-components=1 \ | ||
| && rm tar-7.5.11.tgz \ | ||
| && npm install -g minimatch@10.2.2 \ | ||
| && npm cache clean --force \ | ||
| && rm -rf /usr/local/lib/node_modules/npm/node_modules/minimatch \ | ||
| && cp -r /usr/local/lib/node_modules/minimatch /usr/local/lib/node_modules/npm/node_modules/ | ||
| RUN apt-get update \ | ||
| && apt-get install -y --no-install-recommends ca-certificates openssl \ | ||
| && apt-get upgrade -y \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
| WORKDIR /opt/api-service | ||
| # Install all dependencies for building | ||
| COPY api-service/package.json api-service/package-lock.json ./ | ||
| RUN npm ci --ignore-scripts | ||
| # Copy source code and build | ||
| COPY api-service/tsconfig.json ./ | ||
| COPY api-service/src/ ./src/ | ||
| COPY api-service/@types/ ./@types/ | ||
| RUN npm run build | ||
| # Remove declaration files to avoid module resolution conflicts | ||
| RUN find dist -name "*.d.ts" -delete | ||
|
|
||
| # Production stage | ||
| FROM --platform=linux/amd64 public.ecr.aws/docker/library/node:24.13.1-slim AS production | ||
| RUN npm install -g npm@11.10.1 \ | ||
| && npm pack tar@7.5.11 \ | ||
| && tar -xzf tar-7.5.11.tgz -C /usr/local/lib/node_modules/npm/node_modules/tar --strip-components=1 \ | ||
| && rm tar-7.5.11.tgz \ | ||
| && npm install -g minimatch@10.2.2 \ | ||
| && npm cache clean --force \ | ||
| && rm -rf /usr/local/lib/node_modules/npm/node_modules/minimatch \ | ||
| && cp -r /usr/local/lib/node_modules/minimatch /usr/local/lib/node_modules/npm/node_modules/ | ||
| RUN apt-get update \ | ||
| && apt-get install -y --no-install-recommends ca-certificates openssl \ | ||
| && apt-get upgrade -y \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
| WORKDIR /opt/api-service | ||
| # Copy package.json and install only production dependencies | ||
| COPY api-service/package.json api-service/package-lock.json ./ | ||
| RUN npm ci --omit=dev --ignore-scripts | ||
| # Copy built application from build stage | ||
| COPY --from=builder /opt/api-service/dist ./ | ||
| # Verify the structure and ensure no declaration files | ||
| RUN ls -la && echo "=== Checking for .d.ts files ===" && find . -name "*.d.ts" | head -5 || echo "No .d.ts files found" | ||
| EXPOSE 3000 | ||
| CMD ["node", "app.js"] | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,45 @@ | ||||||||||||||||||||||
| import js from '@eslint/js'; | ||||||||||||||||||||||
| import typescript from '@typescript-eslint/eslint-plugin'; | ||||||||||||||||||||||
| import typescriptParser from '@typescript-eslint/parser'; | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| export default [ | ||||||||||||||||||||||
|
Comment on lines
+1
to
+5
There was a problem hiding this comment. Module type mismatch: ESM syntax with CommonJS package type. The Either rename the file to 🔧 Option 1: Rename to `eslint.config.mjs` (preferred for ESLint 9)Rename the file from 🔧 Option 2: Convert to CommonJS syntax-import js from '@eslint/js';
-import typescript from '@typescript-eslint/eslint-plugin';
-import typescriptParser from '@typescript-eslint/parser';
+const js = require('@eslint/js');
+const typescript = require('@typescript-eslint/eslint-plugin');
+const typescriptParser = require('@typescript-eslint/parser');
-export default [
+module.exports = [
{
files: ['**/*.ts', '**/*.tsx'],
// ... rest unchanged
}
];📝 Committable suggestion
Suggested change
🧰 Tools🪛 Biome (2.4.9)[error] 1-1: Illegal use of an import declaration outside of a module (parse) [error] 2-2: Illegal use of an import declaration outside of a module (parse) [error] 3-3: Illegal use of an import declaration outside of a module (parse) 🤖 Prompt for AI Agents |
||||||||||||||||||||||
| { | ||||||||||||||||||||||
| files: ['**/*.ts', '**/*.tsx'], | ||||||||||||||||||||||
| languageOptions: { | ||||||||||||||||||||||
| parser: typescriptParser, | ||||||||||||||||||||||
| parserOptions: { | ||||||||||||||||||||||
| ecmaVersion: 'latest', | ||||||||||||||||||||||
| sourceType: 'module' | ||||||||||||||||||||||
| } | ||||||||||||||||||||||
| }, | ||||||||||||||||||||||
| plugins: { | ||||||||||||||||||||||
| '@typescript-eslint': typescript | ||||||||||||||||||||||
| }, | ||||||||||||||||||||||
| rules: { | ||||||||||||||||||||||
| ...js.configs.recommended.rules, | ||||||||||||||||||||||
| ...typescript.configs.recommended.rules, | ||||||||||||||||||||||
| '@typescript-eslint/no-unused-vars': ['error', { 'argsIgnorePattern': '^_' }], | ||||||||||||||||||||||
| '@typescript-eslint/no-explicit-any': 'off', | ||||||||||||||||||||||
| '@typescript-eslint/quotes': [ | ||||||||||||||||||||||
| 'error', | ||||||||||||||||||||||
| 'double', | ||||||||||||||||||||||
| { | ||||||||||||||||||||||
| 'allowTemplateLiterals': true | ||||||||||||||||||||||
| } | ||||||||||||||||||||||
| ] | ||||||||||||||||||||||
| } | ||||||||||||||||||||||
| }, | ||||||||||||||||||||||
| { | ||||||||||||||||||||||
| files: ['**/*.js'], | ||||||||||||||||||||||
| languageOptions: { | ||||||||||||||||||||||
| ecmaVersion: 'latest', | ||||||||||||||||||||||
| sourceType: 'module' | ||||||||||||||||||||||
| }, | ||||||||||||||||||||||
| rules: { | ||||||||||||||||||||||
| ...js.configs.recommended.rules | ||||||||||||||||||||||
| } | ||||||||||||||||||||||
| }, | ||||||||||||||||||||||
| { | ||||||||||||||||||||||
| ignores: ['dist/', 'node_modules/', '**/*.d.ts'] | ||||||||||||||||||||||
| } | ||||||||||||||||||||||
| ]; | ||||||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,7 +11,7 @@ const telemetryObject = { type: "alert-silence", ver: "1.0.0" }; | |
|
|
||
| const createHandler = async (request: Request, response: Response, next: NextFunction) => { | ||
| try { | ||
| const payload = _.get(request,'body'); | ||
| const { startDate, endDate, alertId } = payload; | ||
|
Comment on lines
+14
to
15
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
rg -n "_\.get\(request,\s*['\"]body['\"]\)" api-service/src/controllers/Alerts/Silence.ts
echo
sed -n '12,18p;73,84p' api-service/src/controllers/Alerts/Silence.tsRepository: Sanketika-Obsrv/obsrv-api-service Length of output: 1370 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Get the full createHandler function (lines 12-30 should cover the try-catch)
echo "=== createHandler ==="
sed -n '12,35p' api-service/src/controllers/Alerts/Silence.ts
echo
echo "=== updateHandler ==="
# Get the full updateHandler function
sed -n '73,95p' api-service/src/controllers/Alerts/Silence.tsRepository: Sanketika-Obsrv/obsrv-api-service Length of output: 2776 🏁 Script executed: #!/bin/bash
set -euoelpipefail
# Get more lines to see the complete catch blocks
sed -n '12,45p' api-service/src/controllers/Alerts/Silence.tsRepository: Sanketika-Obsrv/obsrv-api-service Length of output: 751 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Get more lines to see the complete catch blocks
sed -n '12,45p' api-service/src/controllers/Alerts/Silence.tsRepository: Sanketika-Obsrv/obsrv-api-service Length of output: 1718 Return 400 for missing request bodies;
🛠️ Suggested fix- const payload = _.get(request,'body');
+ const payload = _.get(request, "body", {});
+ if (_.isEmpty(payload)) {
+ return next({ message: httpStatus[httpStatus.BAD_REQUEST], statusCode: httpStatus.BAD_REQUEST });
+ }
const { startDate, endDate, alertId } = payload;
@@
- const payload = _.get(request, 'body');
+ const payload = _.get(request, "body", {});
+ if (_.isEmpty(payload)) {
+ return next({ message: httpStatus[httpStatus.BAD_REQUEST], statusCode: httpStatus.BAD_REQUEST });
+ }Also applies to: line 76 in updateHandler. 🤖 Prompt for AI Agents |
||
| const existingSilence = await Silence.findOne({ where: { alert_id: alertId } }); | ||
| if (existingSilence) existingSilence.destroy(); | ||
|
|
@@ -59,7 +59,7 @@ const listHandler = async (request: Request, response: Response, next: NextFunct | |
|
|
||
| const fetchHandler = async (request: Request, response: Response, next: NextFunction) => { | ||
| try { | ||
| const id = _.get(request,'params.id'); | ||
| const silenceModel = await Silence.findOne({ where: { id } }); | ||
| const transformedSilence = await transformSilences(silenceModel); | ||
| if (!silenceModel) return next({ message: httpStatus[httpStatus.NOT_FOUND], statusCode: httpStatus.NOT_FOUND }); | ||
|
|
@@ -72,8 +72,8 @@ const fetchHandler = async (request: Request, response: Response, next: NextFunc | |
|
|
||
| const updateHandler = async (request: Request, response: Response, next: NextFunction) => { | ||
| try { | ||
| const id = _.get(request,'params.id'); | ||
| const payload = _.get(request, 'body'); | ||
| const silenceModel = await Silence.findOne({ where: { id } }); | ||
| if (!silenceModel) return next({ message: httpStatus[httpStatus.NOT_FOUND], statusCode: httpStatus.NOT_FOUND }); | ||
| const silenceObject = silenceModel?.toJSON(); | ||
|
|
@@ -98,7 +98,7 @@ const updateHandler = async (request: Request, response: Response, next: NextFun | |
|
|
||
| const deleteHandler = async (request: Request, response: Response, next: NextFunction) => { | ||
| try { | ||
| const id = _.get(request,'params.id'); | ||
| const silenceModel = await Silence.findOne({ where: { id } }); | ||
| if (!silenceModel) return next({ message: httpStatus[httpStatus.NOT_FOUND], statusCode: httpStatus.NOT_FOUND }); | ||
| const silenceObject = silenceModel?.toJSON(); | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -26,6 +26,7 @@ const dataMetrics = async (req: Request, res: Response) => { | |
| const { url, method, headers = {}, body = {}, params = {}, ...rest } = query; | ||
| const apiResponse = await axios.request({ url, method, headers, params, data: body, ...rest }) | ||
| const data = _.get(apiResponse, "data"); | ||
| res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains'); | ||
| return res.json(data); | ||
| } | ||
| else { | ||
|
|
||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: Sanketika-Obsrv/obsrv-api-service
Length of output: 12569
🏁 Script executed:
Repository: Sanketika-Obsrv/obsrv-api-service
Length of output: 11458
Copy JSON schema files into
distduring the build stage.api-service/src/controllers/DataMetrics/DataMetricsController.tsand 39+ other files import JSON schemas (e.g.,DataMetricsValidationSchema.json,Constants.json,SchemaMapping.json). The build script at line 23 runsnpm run buildwhich compiles TypeScript withresolveJsonModule: true, but only copiespackage.jsontodist/. The build does not copy schema/config JSON files fromsrc/intodist/, so those files will be missing at runtime when the compiled application tries to load them.📦 Suggested fix
Also applies to: lines 46-48
🤖 Prompt for AI Agents