vnclagoon/vnctalk-muc-rest
14
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: parameterize SQL, escape XML, and drop deprecated Buffer

Browse Source 
Addresses PERFORMANCE-FINDINGS #3, #7, #8:
- Parameterize GET /groupchats query with $n placeholders and parseInt
  validation to close SQL injection and restore pg prepared-statement cache.
- Fix xmlEscape: use real regexes (& first) instead of no-op string patterns.
- Replace deprecated new Buffer() with Buffer.from() for Basic auth header.

Part-of: <http://gitlab.vnc.biz/uxf/prosody-muc-rest/-/merge_requests/3>
This commit is contained in:
Stefan-Sanger
2026-07-10 14:46:44 +02:00
parent 1fad2ef1d2
commit ff07fa5621
1 changed files with 18 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/routes/index.js
+18 -10
View File
@@ -98,11 +98,10 @@ function setMucData(actor, muc, data) {
historylength = dres.rows[0].config.historylength;
}
let vdata = JSON.stringify(data);
vdata = vdata.replace('/\&/g', '&amp;');
vdata = vdata.replace('/\"/g', '&quot;');
vdata = vdata.replace('/</g', '&lt;');
vdata = vdata.replace('/>/g', '&gt;');
vdata = vdata.replace('/"/g', '&quot;');
vdata = vdata.replace(/&/g, '&amp;');
vdata = vdata.replace(/"/g, '&quot;');
vdata = vdata.replace(/</g, '&lt;');
vdata = vdata.replace(/>/g, '&gt;');
var messageStanza = "";
@@ -127,9 +126,9 @@ function setMucData(actor, muc, data) {
var authHeader = "";
if (config.prosodyRESTuser && config.prosodyRESTuser !="") {
authHeader = "Basic " + new Buffer(config.prosodyRESTuser + ":" + config.prosodyRESTsecret).toString("base64");
authHeader = "Basic " + Buffer.from(config.prosodyRESTuser + ":" + config.prosodyRESTsecret).toString("base64");
} else {
authHeader = "Basic " + new Buffer("prosody:" + config.prosodyRESTsecret).toString("base64");
authHeader = "Basic " + Buffer.from("prosody:" + config.prosodyRESTsecret).toString("base64");
}
console.log(moment().format("LTS") + " [xmpp-rest] messageStanza", messageStanza);
request.post(
@@ -184,12 +183,21 @@ var dbpool = new Pool(dbPoolOpts);
*/
router.get('/groupchats', async function (req, res) {
var queryparams = [];
var sqlquery="select room, created, updated from group_owners where room LIKE '%" + config.mucDomain +"'";
var sqlquery="select room, created, updated from group_owners where room LIKE '%' || $1";
queryparams.push(config.mucDomain);
if (req.query.created) {
sqlquery += " AND created > " + req.query.created;
var created = parseInt(req.query.created, 10);
if (!isNaN(created)) {
queryparams.push(created);
sqlquery += " AND created > $" + queryparams.length;
}
}
if (req.query.updated) {
sqlquery += " AND updated > " + req.query.updated;
var updated = parseInt(req.query.updated, 10);
if (!isNaN(updated)) {
queryparams.push(updated);
sqlquery += " AND updated > $" + queryparams.length;
}
}
dbpool.query(sqlquery, queryparams, function (derr, dres) {
if (derr == null) {