Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: create new annotationFile #2432

Draft
wants to merge 5 commits into
base: main
Choose a base branch
from
Draft

fix: create new annotationFile #2432

wants to merge 5 commits into from

Conversation

Jimmy-Joseph19
Copy link
Contributor

For discussing creation of new annotation file for CPE

@changeset-bot changeset-bot
Copy link

changeset-bot bot commented Oct 2, 2024 •
edited
Loading

⚠️ No Changeset found

Latest commit: f38ba5b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 2, 2024
View reviewed changes
packages/adp-tooling/src/preview/adp-preview.ts
@@ -198,6 +200,8 @@
router.post(ApiRoutes.CONTROLLER, this.routesHandler.handleWriteControllerExt as RequestHandler);

router.get(ApiRoutes.CODE_EXT, this.routesHandler.handleGetControllerExtensionData as RequestHandler);

router.post(ApiRoutes.ANNOTATION_FILE, this.routesHandler.handleCreateAnnoationFile as RequestHandler);

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
a file system access
Loading
, but is not rate-limited.
This route handler performs
a file system access
Loading
, but is not rate-limited.
This route handler performs
a file system access
Loading
, but is not rate-limited.
This route handler performs
a file system access
Loading
, but is not rate-limited.

Copilot Autofix AI 7 days ago

To fix the problem, we will introduce a rate-limiting middleware using the express-rate-limit package. This middleware will limit the number of requests to the route handler handleCreateAnnoationFile to a reasonable number within a specified time window. This will help prevent potential DoS attacks by ensuring that the server can handle requests without being overwhelmed.

  1. Install the express-rate-limit package if it is not already installed.
  2. Import the express-rate-limit package in the file.
  3. Create a rate limiter with a specified window and maximum number of requests.
  4. Apply the rate limiter to the specific route handler handleCreateAnnoationFile.
Suggested changeset 2
packages/adp-tooling/src/preview/adp-preview.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/packages/adp-tooling/src/preview/adp-preview.ts b/packages/adp-tooling/src/preview/adp-preview.ts
--- a/packages/adp-tooling/src/preview/adp-preview.ts
+++ b/packages/adp-tooling/src/preview/adp-preview.ts
@@ -4,2 +4,3 @@
 import type { NextFunction, Request, Response, Router, RequestHandler } from 'express';
+import rateLimit from 'express-rate-limit';
 
@@ -196,2 +197,7 @@
     addApis(router: Router): void {
+        const limiter = rateLimit({
+            windowMs: 15 * 60 * 1000, // 15 minutes
+            max: 100, // limit each IP to 100 requests per windowMs
+        });
+
         router.get(ApiRoutes.FRAGMENT, this.routesHandler.handleReadAllFragments as RequestHandler);
@@ -203,3 +209,3 @@
 
-        router.post(ApiRoutes.ANNOTATION_FILE, this.routesHandler.handleCreateAnnoationFile as RequestHandler);
+        router.post(ApiRoutes.ANNOTATION_FILE, limiter, this.routesHandler.handleCreateAnnoationFile as RequestHandler);
     }
EOF
@@ -4,2 +4,3 @@
import type { NextFunction, Request, Response, Router, RequestHandler } from 'express';
import rateLimit from 'express-rate-limit';

@@ -196,2 +197,7 @@
addApis(router: Router): void {
const limiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100, // limit each IP to 100 requests per windowMs
});

router.get(ApiRoutes.FRAGMENT, this.routesHandler.handleReadAllFragments as RequestHandler);
@@ -203,3 +209,3 @@

router.post(ApiRoutes.ANNOTATION_FILE, this.routesHandler.handleCreateAnnoationFile as RequestHandler);
router.post(ApiRoutes.ANNOTATION_FILE, limiter, this.routesHandler.handleCreateAnnoationFile as RequestHandler);
}
packages/adp-tooling/package.json
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/packages/adp-tooling/package.json b/packages/adp-tooling/package.json
--- a/packages/adp-tooling/package.json
+++ b/packages/adp-tooling/package.json
@@ -53,3 +53,4 @@
         "sanitize-filename": "1.6.3",
-        "uuid": "10.0.0"
+        "uuid": "10.0.0",
+        "express-rate-limit": "^7.4.1"
     },
EOF
@@ -53,3 +53,4 @@
"sanitize-filename": "1.6.3",
"uuid": "10.0.0"
"uuid": "10.0.0",
"express-rate-limit": "^7.4.1"
},
This fix introduces these dependencies
Package Version Security advisories
express-rate-limit (npm) 7.4.1 None
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
Jimmy-Joseph19
Jimmy-Joseph19 commented Oct 2, 2024
View reviewed changes
packages/adp-tooling/src/base/abap.ts
if (metadataPath?.settings?.localUri) {//v2
metadataUrl = `${appInfo.url}/${metadataPath.settings.localUri}`;
} else if (metadataPath?.uri) { //v4
metadataUrl = `${appInfo.url}/${metadataPath.uri}$metadata`;
Copy link
Contributor Author

@Jimmy-Joseph19 Jimmy-Joseph19 Oct 2, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was able to get metadata for all v2 apps i tested.
For one V4 app tested the request was failing. But the same request passes in CPE when baseUrl is localhost.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@Jimmy-Joseph19