ai generated solutions to our ai generated problems

server.cjs

@@ -63,6 +63,9 @@ const MAX_TEAM_NAME_LENGTH = 80
 const MAX_CACHE_ENTRIES = 200
 const MAX_RATE_LIMIT_KEYS = 1000
 const MAX_ANALYTICS_BODY_BYTES = 16 * 1024
+const MAX_UPSTREAM_BODY_BYTES = Number(process.env.MAX_UPSTREAM_BODY_BYTES || 1024 * 1024)
+const SERVER_REQUEST_TIMEOUT_MS = Number(process.env.SERVER_REQUEST_TIMEOUT_MS || 30000)
+const SERVER_HEADERS_TIMEOUT_MS = Number(process.env.SERVER_HEADERS_TIMEOUT_MS || 10000)
 const RUN_BACKGROUND_JOBS = !process.env.NODE_APP_INSTANCE || process.env.NODE_APP_INSTANCE === '0'
 
 const TRUST_PROXY = (() => {
@@ -300,8 +303,16 @@ function requestJson(url, timeoutMs = 10000) {
       },
       (response) => {
         const chunks = []
+        let size = 0
 
-        response.on('data', (chunk) => chunks.push(chunk))
+        response.on('data', (chunk) => {
+          size += chunk.length
+          if (size > MAX_UPSTREAM_BODY_BYTES) {
+            req.destroy(new Error('Upstream response too large'))
+            return
+          }
+          chunks.push(chunk)
+        })
         response.on('end', () => {
           const body = Buffer.concat(chunks).toString('utf8')
           const latency = Date.now() - startedAt
@@ -1726,6 +1737,7 @@ function proxyRequest(req, res) {
   }
 
   const responseChunks = []
+  let proxiedBytes = 0
   const proxy = http.request(
     target,
     {
@@ -1752,6 +1764,12 @@ function proxyRequest(req, res) {
       res.writeHead(proxyRes.statusCode || 502, headers)
 
       proxyRes.on('data', (chunk) => {
+        proxiedBytes += chunk.length
+        if (proxiedBytes > MAX_UPSTREAM_BODY_BYTES) {
+          proxy.destroy(new Error('Upstream response too large'))
+          res.destroy()
+          return
+        }
         if (cacheKey && (proxyRes.statusCode || 0) >= 200 && (proxyRes.statusCode || 0) < 300) {
           responseChunks.push(chunk)
         }
@@ -1772,6 +1790,7 @@ function proxyRequest(req, res) {
   )
 
   proxy.on('error', (error) => {
+    if (res.destroyed || res.headersSent) return
     sendJson(res, 502, { error: 'API proxy failed', detail: error.message })
   })
 
@@ -1782,8 +1801,8 @@ function pagePublicOrigin(req) {
   const configured = PUBLIC_ORIGIN.split(',').map((origin) => origin.trim()).filter(Boolean)[0]
   if (configured) return configured.replace(/\/$/, '')
 
-  const host = req.headers['x-forwarded-host'] || req.headers.host || `localhost:${PORT}`
-  const proto = req.headers['x-forwarded-proto'] || (req.socket.encrypted ? 'https' : 'http')
+  const host = trustedForwardedHost(req) || `localhost:${PORT}`
+  const proto = trustedForwardedProto(req) || (req.socket.encrypted ? 'https' : 'http')
   return `${String(proto).split(',')[0].trim()}://${String(host).split(',')[0].trim()}`.replace(/\/$/, '')
 }
 
@@ -1827,15 +1846,21 @@ function sendComingSoonPage(req, res) {
 }
 
 function serveStatic(req, res) {
-  const requestPath = decodeURIComponent(new URL(req.url, `http://localhost:${PORT}`).pathname)
+  let requestPath = '/'
+  try {
+    requestPath = decodeURIComponent(new URL(req.url, `http://localhost:${PORT}`).pathname)
+  } catch {
+    return send(res, 400, 'Bad request', { 'content-type': 'text/plain; charset=utf-8' })
+  }
   if (COMING_SOON) {
     return sendComingSoonPage(req, res)
   }
 
   const relativePath = requestPath === '/' ? '/index.html' : requestPath
-  const filePath = path.normalize(path.join(DIST_DIR, relativePath))
+  const filePath = path.resolve(DIST_DIR, `.${relativePath}`)
+  const relativeToDist = path.relative(DIST_DIR, filePath)
 
-  if (!filePath.startsWith(DIST_DIR)) {
+  if (relativeToDist.startsWith('..') || path.isAbsolute(relativeToDist)) {
     return send(res, 403, 'Forbidden', { 'content-type': 'text/plain; charset=utf-8' })
   }
 
@@ -2006,6 +2031,9 @@ const server = http.createServer((req, res) => {
   serveStatic(req, res)
 })
 
+server.requestTimeout = SERVER_REQUEST_TIMEOUT_MS
+server.headersTimeout = SERVER_HEADERS_TIMEOUT_MS
+
 server.listen(PORT, '0.0.0.0', () => {
   console.log(`tssbot-web serving http://localhost:${PORT}`)
   console.log(`proxying API requests to ${API_UPSTREAM}`)