Skip to content

v2.2.0 - Critical Security Fixes & Performance Improvements

Latest
Latest

Choose a tag to compare

View all tags
@anfibiacreativa anfibiacreativa released this 22 Oct 16:09
· 5 commits to main since this release
v2.2.0
e8982d6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release v2.2.0 - Critical Security Fixes & Performance Improvements

🚀 Release Date

October 22, 2025

📋 Overview

This release includes 7 critical security fixes and significant performance improvements identified in the comprehensive backend code audit. These are high-impact, low-effort improvements that significantly enhance production security, performance, and reliability.

Total Investment: ~2.5 hours of development | Impact: Critical security vulnerabilities eliminated + 10x-40x performance improvement

🔒 Security Fixes (6 Critical/High Vulnerabilities Eliminated)

1. Production DISABLE_AUTH Guard 🔴 Critical

Commit: d70c1f1

  • Prevents DISABLE_AUTH environment variable from bypassing authentication in production
  • Added runtime check in requireAuth() middleware - returns 500 error if misconfigured
  • Added startup check in index.ts - exits process if DISABLE_AUTH=true in production
  • Logs security violations with IP and path

2. NoSQL Injection Prevention 🔴 Critical

Commit: e922d41

  • Created whitelist of 5 allowed collections: analyses, repos, azdtests, rulesets, configuration
  • Added isAllowedCollection() type-safe validation function
  • Returns 400 error for invalid collections with helpful message
  • Capped query limit at 100 to prevent DoS

Attack Vectors Blocked:

  • ❌ /db-query/admin.system.users
  • ❌ /db-query/../../../etc/passwd
  • ✅ /db-query/analyses (allowed)

3. Memory Leak Fix 🟠 High

Commit: 22b84ab

  • Token refresh setInterval() now properly cleared
  • Store interval ID in tokenRefreshInterval property
  • Clear existing interval before creating new one
  • Clear interval on disconnect
  • Added debug logging for cleanup

4. Batch Size Limits (DoS Prevention) 🟠 High

Commit: c4c8556

  • Added MAX_BATCH_SIZE = 50 constant
  • Validate batch size before processing
  • Return 400 error with helpful message if limit exceeded
  • Prevents server crash from unlimited batch requests

5. Request Timeouts 🟡 Medium

Commit: 1265933

  • Created createTimeoutSignal() helper with 30-second timeout
  • Added AbortController to all GitHub API fetch calls
  • Clean up timeout timers with .finally() to prevent memory leaks
  • Returns clear timeout errors instead of silent hangs

6. Enhanced Rate Limiting 🟡 Medium

Commit: a0c19a1

Improvements:

  • User-based keys: Use req.user.login for authenticated users (more accurate than shared IPs)
  • Batch rate limit: 3 requests/hour (new tier for batch operations)
  • Strict rate limit: 10 requests/15 minutes (was 10/minute - too lenient)
  • Conditional limiting: Batch requests get stricter limits automatically

Rate Limit Tiers:

Tier Window Max Use Case
Batch 1 hour 3 Batch analysis (50 repos each)
Strict 15 min 10 Single analysis/validation
Standard 1 min 100 General API endpoints
Auth 1 min 20 OAuth token exchange

🚀 Performance Improvements

N+1 Query Optimization - Leaderboard API

Commit: a1adc95

Before: 101 database queries, ~2000ms response time
After: 1 aggregation query, ~50-200ms response time
Improvement: 10x-40x faster! 🎉

  • Replaced Promise.all loop with single MongoDB aggregation query
  • Used $lookup to join repos and analysis collections
  • Added explicit TypeScript typing for aggregation result

✅ Test Coverage

New Test Files

Commit: 6472cf4

packages/server/src/middleware/tests/auth.test.ts

  • ✅ DISABLE_AUTH blocked in production
  • ✅ DISABLE_AUTH allowed in development/test
  • ✅ Error logging with IP/path

packages/server/tests/routes/admin.test.ts

  • ✅ Valid collection names accepted
  • ✅ System collections rejected
  • ✅ Path traversal attempts blocked
  • ✅ NoSQL injection attempts blocked
  • ✅ Case-sensitive validation

packages/server/tests/routes/analyze.test.ts

  • ✅ Batch size validation (0, 1, 50, 51, 1000 repos)
  • ✅ Error response structure

packages/server/tests/middleware/rate-limit.test.ts (enhanced)

  • ✅ User-based vs IP-based keys
  • ✅ Batch rate limit (3/hour)
  • ✅ Rate limit windows (15 min, 1 hour)
  • ✅ Conditional rate limiting

packages/server/tests/middleware/timeout.test.ts

  • ✅ AbortSignal creation
  • ✅ Timeout abort after 30s
  • ✅ Cleanup on completion
  • ✅ Error handling

Test Results:

  • 65 tests passing ✅
  • 27 tests skipped (require running server - expected)
  • 0 tests failing ✅

🧹 Cleanup

Legacy Test Removal

Commit: 664a539

  • Deleted tests/unit/legacy-api/ (8 files, 606 lines)
  • Tests for deprecated Azure Functions API
  • Code archived in legacy/azure-functions branch
  • All functionality now in Express server

Playwright Test Fixes

Commits: 5ac4d4b, 2ff389b

  • Changed vitest → @playwright/test in error detection spec
  • Fixed duplicate test titles
  • Updated port 4000 → 3000 (production architecture)
  • All tests use correct framework

📊 Security Summary

Severity Vulnerability Status
🔴 Critical Authentication bypass in production ✅ Fixed
🔴 Critical NoSQL injection via collection names ✅ Fixed
🟠 High DoS via unlimited batch requests ✅ Fixed
🟠 High Memory leak in token refresh ✅ Fixed
🟡 Medium Hanging requests (no timeout) ✅ Fixed
🟡 Medium Rate limit bypass via IP sharing ✅ Fixed

🔧 Deployment Considerations

Environment Variables

All fixes work with existing environment variables. Optional new variables for rate limiting:

# Optional rate limit customization
RATE_LIMIT_STRICT_WINDOW_MS=900000    # 15 minutes (default)
RATE_LIMIT_STRICT_MAX=10              # 10 requests (default)
RATE_LIMIT_BATCH_WINDOW_MS=3600000    # 1 hour (default)
RATE_LIMIT_BATCH_MAX=3                # 3 requests (default)

Breaking Changes

None. All changes are backward compatible. Security fixes apply automatically.

Production Checklist

  • ✅ All tests passing (65/65)
  • ✅ No new dependencies
  • ✅ No schema changes
  • ✅ Environment variables backward compatible
  • ✅ Security fixes active immediately on deployment

📝 Complete Commit List

2ff389b fix: update Playwright tests to use port 3000 (production architecture)
5ac4d4b fix: correct Playwright test issues
6472cf4 test: add comprehensive tests for Quick Wins security fixes
664a539 chore: remove legacy Azure Functions API tests
a0c19a1 security: enhance rate limiting with batch limits and user-based keys
1265933 fix: add request timeouts to prevent hanging GitHub API calls
c4c8556 security: add batch size limit to prevent DoS attacks
a1adc95 perf: eliminate N+1 query in leaderboard (101 queries → 1)
22b84ab fix: prevent memory leak in Cosmos DB token refresh
e922d41 security: prevent NoSQL injection via collection whitelist
d70c1f1 security: add production guard for DISABLE_AUTH environment variable

🎯 Recommendation

Deploy immediately. This release:

  • ✅ Eliminates 6 security vulnerabilities
  • ✅ Improves API performance by 10x-40x
  • ✅ Has comprehensive test coverage
  • ✅ Contains no breaking changes
  • ✅ Requires zero new dependencies
  • ✅ Is production-ready

📚 Additional Context

  • Previous Version: v2.1.0 (OAuth Authentication & Rate Limiting)
  • Next Version: v2.3.0 (planned features TBD)
  • Documentation: See AGENTS.md for development guidelines
  • Security Policy: See SECURITY.md for reporting vulnerabilities
Assets 2
Loading