Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -139,6 +139,7 @@
"@types/express": "^5.0.4",
"@types/i18n": "^0.13.12",
"@types/jasmine": "2.5.38",
"@types/jsonwebtoken": "^9.0.10",
"@types/node": "^18.19.130",
"@types/passport": "^1.0.17",
"@types/request-promise": "^4.1.51",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,17 +3,18 @@ if (process.env.NODE_ENV !== 'production') {
require('dotenv').config()
}

const i18n = require('i18n')
import i18n from 'i18n'
const dateFormat = require('dateformat')
const moment = require('moment')
import moment from 'moment'
const models = require('../../../models')
const constants = require('../../../modules/mail/constants')
const TaskMail = require('../../../modules/mail/task')
const SendMail = require('../../../modules/mail/mail')
const IssueClosedMail = require('../../../modules/mail/issueClosed')
import type { Request, Response } from 'express'

exports.github = async (req, res) => {
const response = req.body || res.body
export const github = async (req: Request, res: Response) => {
const response = req.body || (res as any).body
const labels = response && response.issue && response.issue.labels
if (req.headers.authorization === `Bearer ${process.env.GITHUB_WEBHOOK_APP_TOKEN}`) {
// below would update issue status if someone updates it on Github
Expand Down Expand Up @@ -55,9 +56,9 @@ exports.github = async (req, res) => {
}
if (response.action === 'labeled') {
try {
const totalLabelResponse = []
const totalLabelResponse: any[] = []
await Promise.all(
labels.map(async (label) => {
labels.map(async (label: any) => {
let persistedLabel = await models.Label.findOne({
where: {
name: label.name
Expand All @@ -70,7 +71,7 @@ exports.github = async (req, res) => {
}
const labelId = persistedLabel.dataValues.id
if (label.name === 'notify') {
let finalResponse = {}
let finalResponse: any = {}
try {
console.log('it is labeled notify')
const user = await models.User.findOne({
Expand Down Expand Up @@ -155,7 +156,7 @@ exports.github = async (req, res) => {
if (label.name === 'gitpay') {
// eslint-disable-next-line no-console
console.log('it is labeled Gitpay')
let finalResponse = {}
let finalResponse: any = {}
try {
const user = await models.User.findOne({
where: {
Expand Down
48 changes: 24 additions & 24 deletions src/app/index.js → src/app/index.ts
Original file line number Diff line number Diff line change
@@ -1,35 +1,35 @@
const express = require('express')
require('../models')

const routerProject = require('./routes/projects')
const routerTask = require('./routes/tasks')
const routerTeam = require('./routes/team')
const routerOrder = require('./routes/orders')
const routerWebhook = require('./routes/webhooks')
const routerInfo = require('./routes/info')
const routerOrganization = require('./routes/organization')
const routerContact = require('./routes/contact')
const routerTypes = require('./routes/types')
const routerTaskSolution = require('./routes/taskSolutions')
const routerCoupon = require('./routes/coupon')
const routerLabel = require('./routes/label')
const routerOffer = require('./routes/offer')
const routerTransfer = require('./routes/transfer')
const routerPayout = require('./routes/payout')
const routerWallet = require('./routes/wallet')
const routerWalletOrder = require('./routes/walletOrder')
const routerLanguage = require('./routes/language')
const routerPaymentRequest = require('./routes/paymentRequest')
const routerPaymentRequestTransfer = require('./routes/paymentRequestTransfer')
import express from 'express'
import '../models'

import routerProject from './routes/projects'
import routerTask from './routes/tasks'
import routerTeam from './routes/team'
import routerOrder from './routes/orders'
import routerWebhook from './routes/webhooks'
import routerInfo from './routes/info'
import routerOrganization from './routes/organization'
import routerContact from './routes/contact'
import routerTypes from './routes/types'
import routerTaskSolution from './routes/taskSolutions'
import routerCoupon from './routes/coupon'
import routerLabel from './routes/label'
import routerOffer from './routes/offer'
import routerTransfer from './routes/transfer'
import routerPayout from './routes/payout'
import routerWallet from './routes/wallet'
import routerWalletOrder from './routes/walletOrder'
import routerLanguage from './routes/language'
import routerPaymentRequest from './routes/paymentRequest'
import routerPaymentRequestTransfer from './routes/paymentRequestTransfer'
import routerAuth from './routes/auth'
import routerUsers from './routes/users'
import routerUser from './routes/user'
import routerPaymentRequestPayments from './routes/paymentRequestPayment'
import routerPaymentRequestBalance from './routes/paymentRequestBalance'
import routerDashboard from './routes/dashboard'
import type { Express } from 'express'

exports.init = (app) => {
export const init = (app: Express) => {
app.use('/webhooks', express.raw({ type: 'application/json' }), routerWebhook)

app.use(express.json())
Expand Down
7 changes: 0 additions & 7 deletions src/app/routes/contact.js

This file was deleted.

8 changes: 8 additions & 0 deletions src/app/routes/contact.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
import express from 'express'
import * as controllers from '../controllers/contact'

const router = express.Router()

router.post('/recruiters', controllers.contactRecruiters)

export default router
11 changes: 0 additions & 11 deletions src/app/routes/coupon.js

This file was deleted.

12 changes: 12 additions & 0 deletions src/app/routes/coupon.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
import express from 'express'
import '../../modules/authenticationHelpers'
import * as controllers from '../controllers/coupon'
import secure from './secure'

const router = express.Router()

router.use(secure)

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.

Copilot Autofix

AI 6 months ago

In general, you should ensure that any routes that trigger potentially expensive operations (such as authentication, authorization, or database-backed coupon validation) are protected by rate limiting. In an Express-based app, this is commonly done by using a middleware from a well-known library like express-rate-limit and attaching it either globally (to the main app) or locally (to specific routers/routes).

For this specific router, the best way to fix the issue without changing existing functionality is to apply a rate-limiting middleware to the coupon router. We can import express-rate-limit, configure a limiter suited to this endpoint (e.g., a reasonable number of requests per 15-minute window), and install it before the secure middleware so that abusive traffic is rejected before invoking potentially expensive authorization logic. Concretely, in src/app/routes/coupon.ts we should: (1) add an import for express-rate-limit, (2) define a couponRateLimiter configured for a sane default (e.g., 100 requests per 15 minutes from the same IP), and (3) insert router.use(couponRateLimiter) before router.use(secure). This will ensure that all routes on this router, including /validate, are rate-limited.

Suggested changeset 2
src/app/routes/coupon.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/app/routes/coupon.ts b/src/app/routes/coupon.ts
--- a/src/app/routes/coupon.ts
+++ b/src/app/routes/coupon.ts
@@ -2,9 +2,16 @@
 import '../../modules/authenticationHelpers'
 import * as controllers from '../controllers/coupon'
 import secure from './secure'
+import rateLimit from 'express-rate-limit'
 
 const router = express.Router()
 
+const couponRateLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 100, // limit each IP to 100 requests per windowMs
+})
+
+router.use(couponRateLimiter)
 router.use(secure)
 
 router.post('/validate', controllers.validateCoupon)
EOF
@@ -2,9 +2,16 @@
import '../../modules/authenticationHelpers'
import * as controllers from '../controllers/coupon'
import secure from './secure'
import rateLimit from 'express-rate-limit'

const router = express.Router()

const couponRateLimiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100, // limit each IP to 100 requests per windowMs
})

router.use(couponRateLimiter)
router.use(secure)

router.post('/validate', controllers.validateCoupon)
package.json
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/package.json b/package.json
--- a/package.json
+++ b/package.json
@@ -128,7 +128,8 @@
     "url": "^0.11.0",
     "url-search-params": "^1.0.2",
     "x-frame-options": "^1.0.0",
-    "zone.js": "^0.8.4"
+    "zone.js": "^0.8.4",
+    "express-rate-limit": "^8.2.1"
   },
   "devDependencies": {
     "@playwright/test": "^1.53.0",
EOF
@@ -128,7 +128,8 @@
"url": "^0.11.0",
"url-search-params": "^1.0.2",
"x-frame-options": "^1.0.0",
"zone.js": "^0.8.4"
"zone.js": "^0.8.4",
"express-rate-limit": "^8.2.1"
},
"devDependencies": {
"@playwright/test": "^1.53.0",
This fix introduces these dependencies
Package Version Security advisories
express-rate-limit (npm) 8.2.1 None
Copilot is powered by AI and may make mistakes. Always verify output.

router.post('/validate', controllers.validateCoupon)

export default router
9 changes: 0 additions & 9 deletions src/app/routes/info.js

This file was deleted.

10 changes: 10 additions & 0 deletions src/app/routes/info.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
import express from 'express'
import '../../models'
import '../../modules/authenticationHelpers'
import * as controllers from '../controllers/info'

const router = express.Router()

router.get('/all', controllers.info)

export default router
8 changes: 0 additions & 8 deletions src/app/routes/label.js

This file was deleted.

9 changes: 9 additions & 0 deletions src/app/routes/label.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
import express from 'express'
import '../../modules/authenticationHelpers'
import * as controllers from '../controllers/label'

const router = express.Router()

router.get('/search', controllers.labelSearchController)

export default router
9 changes: 5 additions & 4 deletions src/app/routes/language.js → src/app/routes/language.ts
Original file line number Diff line number Diff line change
@@ -1,9 +1,10 @@
const express = require('express')
import express from 'express'
import '../../modules/authenticationHelpers'
import * as controllers from '../controllers/language'

const router = express.Router()
require('../../modules/authenticationHelpers')
const controllers = require('../controllers/language')

router.get('/search', controllers.languageSearchController)
router.get('/task/search', controllers.projectLanguageSearchController)

module.exports = router
export default router
11 changes: 0 additions & 11 deletions src/app/routes/offer.js

This file was deleted.

11 changes: 11 additions & 0 deletions src/app/routes/offer.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
import express from 'express'
import '../../modules/authenticationHelpers'
import * as controllers from '../controllers/offer'
import secure from './secure'

const router = express.Router()

router.use(secure)

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.

Copilot Autofix

AI 6 months ago

In general, the problem is fixed by introducing a rate-limiting middleware and applying it to routes that perform authorization and/or expensive operations. A common approach in Express applications is to use a well-known library such as express-rate-limit, configure sensible limits, and attach the limiter either globally or per-route.

For this specific file, the best minimal change is to import express-rate-limit, define a limiter configured for this router (e.g., a reasonable number of requests per time window for update operations), and insert it into the middleware chain for the PUT /:id route. That preserves existing behavior (authentication via secure and the updateOffer controller) while adding protection against abuse. Concretely:

  • Add an import of express-rate-limit at the top of src/app/routes/offer.ts.
  • Define a const limiter (e.g., offerUpdateLimiter) after creating the router.
  • Apply this limiter using router.use(offerUpdateLimiter) or, more tightly scoped, by passing it as middleware specifically for router.put('/:id', ...). To avoid affecting other routes in this router that we haven’t seen, we limit it to the PUT /:id handler.
  • Keep all other imports and logic unchanged.
Suggested changeset 2
src/app/routes/offer.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/app/routes/offer.ts b/src/app/routes/offer.ts
--- a/src/app/routes/offer.ts
+++ b/src/app/routes/offer.ts
@@ -2,10 +2,16 @@
 import '../../modules/authenticationHelpers'
 import * as controllers from '../controllers/offer'
 import secure from './secure'
+import rateLimit from 'express-rate-limit'
 
 const router = express.Router()
 
+const offerUpdateLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 100, // limit each IP to 100 update requests per windowMs
+})
+
 router.use(secure)
-router.put('/:id', controllers.updateOffer)
+router.put('/:id', offerUpdateLimiter, controllers.updateOffer)
 
 export default router
EOF
@@ -2,10 +2,16 @@
import '../../modules/authenticationHelpers'
import * as controllers from '../controllers/offer'
import secure from './secure'
import rateLimit from 'express-rate-limit'

const router = express.Router()

const offerUpdateLimiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100, // limit each IP to 100 update requests per windowMs
})

router.use(secure)
router.put('/:id', controllers.updateOffer)
router.put('/:id', offerUpdateLimiter, controllers.updateOffer)

export default router
package.json
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/package.json b/package.json
--- a/package.json
+++ b/package.json
@@ -128,7 +128,8 @@
     "url": "^0.11.0",
     "url-search-params": "^1.0.2",
     "x-frame-options": "^1.0.0",
-    "zone.js": "^0.8.4"
+    "zone.js": "^0.8.4",
+    "express-rate-limit": "^8.2.1"
   },
   "devDependencies": {
     "@playwright/test": "^1.53.0",
EOF
@@ -128,7 +128,8 @@
"url": "^0.11.0",
"url-search-params": "^1.0.2",
"x-frame-options": "^1.0.0",
"zone.js": "^0.8.4"
"zone.js": "^0.8.4",
"express-rate-limit": "^8.2.1"
},
"devDependencies": {
"@playwright/test": "^1.53.0",
This fix introduces these dependencies
Package Version Security advisories
express-rate-limit (npm) 8.2.1 None
Copilot is powered by AI and may make mistakes. Always verify output.
router.put('/:id', controllers.updateOffer)

export default router
15 changes: 8 additions & 7 deletions src/app/routes/orders.js → src/app/routes/orders.ts
Original file line number Diff line number Diff line change
@@ -1,14 +1,15 @@
const express = require('express')
import express from 'express'
import 'passport'
import secure from './secure'
import '../../modules/authenticationHelpers'
import '../../models'
import * as controllers from '../controllers/order'

const router = express.Router()
require('passport')
const secure = require('./secure')
require('../../modules/authenticationHelpers')
require('../../models')
const controllers = require('../controllers/order')

router.get('/authorize', controllers.authorizeOrder)

router.use(secure)

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.
router.get('/', controllers.listOrders)
router.post('/', controllers.createOrder)
router.get('/:id/details', controllers.detailsOrder)
Expand All @@ -20,4 +21,4 @@
router.post('/:id/payments', controllers.paymentOrder)
router.put('/:id', controllers.updateOrder)

module.exports = router
export default router
Original file line number Diff line number Diff line change
@@ -1,16 +1,17 @@
const express = require('express')
import express from 'express'
import 'passport'
import '../../modules/authenticationHelpers'
import '../../models'
import * as controllers from '../controllers/organization'
import secure from './secure'

const router = express.Router()
require('passport')
require('../../modules/authenticationHelpers')
require('../../models')
const controllers = require('../controllers/organization')

router.get('/list', controllers.listOrganizations)
router.get('/fetch/:id', controllers.fetchOrganization)
const secure = require('./secure')

router.use(secure)

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.
router.post('/create', controllers.createOrganization)
router.put('/update', controllers.updateOrganization)

module.exports = router
export default router
Original file line number Diff line number Diff line change
@@ -1,12 +1,13 @@
const express = require('express')
import express from 'express'
import '../../modules/authenticationHelpers'
import secure from './secure'
import * as controllers from '../controllers/payment-request'

const router = express.Router()
require('../../modules/authenticationHelpers')
const secure = require('./secure')
const controllers = require('../controllers/payment-request')

router.use(secure)

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.
router.post('/', controllers.createPaymentRequest)
router.get('/', controllers.listPaymentRequests)
router.put('/:id', controllers.updatePaymentRequest)

module.exports = router
export default router
Original file line number Diff line number Diff line change
@@ -1,14 +1,15 @@
const express = require('express')
import express from 'express'
import secure from './secure'
import '../../modules/authenticationHelpers'
import * as controllers from '../controllers/payment-request-transfer'

const router = express.Router()
const secure = require('./secure')
require('../../modules/authenticationHelpers')
const controllers = require('../controllers/payment-request-transfer')

router.use(secure)

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.
router.post('/', controllers.createPaymentRequestTransfer)
router.get('/', controllers.listPaymentRequestTransfers)
router.put('/:id', controllers.updatePaymentRequestTransfer)
//router.get('/search', controllers.searchPaymentRequestTransfer)
//router.get('/:id', controllers.fetchPaymentRequestTransfer)

module.exports = router
export default router
11 changes: 6 additions & 5 deletions src/app/routes/payout.js → src/app/routes/payout.ts
Original file line number Diff line number Diff line change
@@ -1,12 +1,13 @@
const express = require('express')
import express from 'express'
import secure from './secure'
import '../../modules/authenticationHelpers'
import * as controllers from '../controllers/payout'

const router = express.Router()
const secure = require('./secure')
require('../../modules/authenticationHelpers')
const controllers = require('../controllers/payout')

router.use(secure)

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.
router.post('/create', controllers.createPayout)
router.post('/request', controllers.requestPayout)
router.get('/search', controllers.searchPayout)

module.exports = router
export default router
9 changes: 0 additions & 9 deletions src/app/routes/projects.js

This file was deleted.

10 changes: 10 additions & 0 deletions src/app/routes/projects.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
import express from 'express'
import '../../modules/authenticationHelpers'
import * as controllers from '../controllers/project'

const router = express.Router()

router.get('/fetch/:id', controllers.fetchProject)
router.get('/list', controllers.listProjects)

export default router
Loading
Loading