Fixes #371 - Preventing reDoS

sonar-project.properties

@@ -9,7 +9,7 @@ sonar.javascript.lcov.reportPaths=coverage/lcov.info
 
 # Path is relative to the sonar-project.properties file. Replace "\" by "/" on Windows.
 sonar.sources=src
-sonar.exclusions=src/api-docs/**
+sonar.exclusions=src/api-docs/**, src/helpers/timed-match/match-proc.js
 sonar.tests=tests
 sonar.language=js
 

src/client/resolvers.js

@@ -213,21 +213,21 @@ function checkFlags(config, group, domain, environment) {
     }
 }
 
-function checkStrategy(entry, strategies, environment) {
+async function checkStrategy(entry, strategies, environment) {
     if (strategies) {
         for (const strategy of strategies) {
             if (!strategy.activated[environment]) 
                 continue;
 
-            checkStrategyInput(entry, strategy);
+            await checkStrategyInput(entry, strategy);
         }
     }
 }
 
-function checkStrategyInput(entry, { strategy, operation, values }) {
+async function checkStrategyInput(entry, { strategy, operation, values }) {
     if (entry && entry.length) {
         const strategyEntry = entry.filter(e => e.strategy === strategy);
-        if (strategyEntry.length == 0 || !processOperation(strategy, operation, strategyEntry[0].input, values)) {
+        if (strategyEntry.length == 0 || !(await processOperation(strategy, operation, strategyEntry[0].input, values))) {
             throw new Error(`Strategy '${strategy}' does not agree`);
         }
     } else {
@@ -260,7 +260,7 @@ export async function resolveCriteria(config, context, strategyFilter) {
 
     try {
         checkFlags(config, group, domain, environment);
-        checkStrategy(context.entry, strategies, environment);
+        await checkStrategy(context.entry, strategies, environment);
         await resolveRelay(config, environment, context.entry, response);
     } catch (e) {
         response.result = false;

src/helpers/timed-match/match-proc.js

@@ -0,0 +1,15 @@
+function tryMatch(values, input) {
+    let result = false;
+    for (const value of values) {
+        if (input.match(value)) {
+            result = true;
+            break;
+        }
+    }
+
+    return result;
+}
+
+process.on('message', ({ values, input }) => {
+    process.send(tryMatch(values, input));
+});

src/helpers/timed-match/try-match.js

@@ -0,0 +1,34 @@
+import cp from 'child_process';
+
+export default async function tryMatch(values, input, timeout = 3000) {
+    let result = false;
+    let cp, timer;
+
+    const matchPromise = new Promise((resolve) => {
+        cp = createChildProcess();
+        cp.on('message', resolve);
+        cp.send({ values, input });
+    });
+
+    const matchTimer = new Promise((resolve) => {
+        timer = setTimeout(resolve, timeout, false);
+    });
+
+    await Promise.any([matchPromise, matchTimer]).then((value) => {
+        cp.kill();
+        clearTimeout(timer);
+        result = value;
+    });
+
+    return result;
+}
+
+function createChildProcess() {
+    const match_proc = cp.fork(`${__dirname}/match-proc.js`, {
+        stdio: 'ignore'
+    });
+
+    match_proc.unref();
+    match_proc.channel.unref();
+    return match_proc;
+}

src/models/config-strategy.js

@@ -5,6 +5,7 @@ import moment from 'moment';
 import { NotFoundError } from '../exceptions';
 import { parseJSON, payloadReader } from '../helpers';
 import IPCIDR from '../helpers/ipcidr';
+import tryMatch from '../helpers/timed-match/try-match';
 
 export const StrategiesType = Object.freeze({
     NETWORK: 'NETWORK_VALIDATION',
@@ -147,7 +148,7 @@ export function strategyRequirements(strategy) {
     };
 }
 
-export function processOperation(strategy, operation, input, values) {
+export async function processOperation(strategy, operation, input, values) {
     switch(strategy) {
         case StrategiesType.NETWORK:
             return processNETWORK(operation, input, values);
@@ -262,18 +263,12 @@ function processDATE(operation, input, values) {
     }
 }
 
-function processREGEX(operation, input, values) {
+async function processREGEX(operation, input, values) {
     switch(operation) {
-        case OperationsType.EXIST: {
-            for (const value of values) {
-                if (input.match(value)) {
-                    return true;
-                }
-            }
-            return false;
-        }
+        case OperationsType.EXIST:
+            return await tryMatch(values, input);
         case OperationsType.NOT_EXIST:
-            return !processREGEX(OperationsType.EXIST, input, values);
+            return !(await processREGEX(OperationsType.EXIST, input, values));
         case OperationsType.EQUAL:
             return input.match(`\\b${values[0]}\\b`) != null;
         case OperationsType.NOT_EQUAL:

tests/client-api.test.js

@@ -31,22 +31,22 @@ import {
 import { RouterTypes } from '../src/models/permission';
 
 const changeStrategy = async (strategyId, newOperation, status, environment) => {
-    const strategy = await ConfigStrategy.findById(strategyId);
+    const strategy = await ConfigStrategy.findById(strategyId).exec();
     strategy.operation = newOperation ? newOperation : strategy.operation;
     strategy.activated.set(environment, status !== undefined ? status : strategy.activated.get(environment));
     strategy.updatedBy = adminMasterAccountId;
     await strategy.save();
 };
 
 const changeConfigStatus = async (configid, status, environment) => {
-    const config = await Config.findById(configid);
+    const config = await Config.findById(configid).exec();
     config.activated.set(environment, status !== undefined ? status : config.activated.get(environment));
     config.updatedBy = adminMasterAccountId;
     await config.save();
 };
 
 const changeConfigDisableMetricFlag = async (configid, status, environment) => {
-    const config = await Config.findById(configid);
+    const config = await Config.findById(configid).exec();
     if (!config.disable_metrics)
         config.disable_metrics = new Map;
 
@@ -56,14 +56,14 @@ const changeConfigDisableMetricFlag = async (configid, status, environment) => {
 };
 
 const changeGroupConfigStatus = async (groupconfigid, status, environment) => {
-    const groupConfig = await GroupConfig.findById(groupconfigid);
+    const groupConfig = await GroupConfig.findById(groupconfigid).exec();
     groupConfig.activated.set(environment, status !== undefined ? status : groupConfig.activated.get(environment));
     groupConfig.updatedBy = adminMasterAccountId;
     await groupConfig.save();
 };
 
 const changeDomainStatus = async (domainid, status, environment) => {
-    const domain = await Domain.findById(domainid);
+    const domain = await Domain.findById(domainid).exec();
     domain.activated.set(environment, status !== undefined ? status : domain.activated.get(environment));
     domain.updatedBy = adminMasterAccountId;
     await domain.save();
@@ -363,7 +363,7 @@ describe('Testing criteria [GraphQL] ', () => {
             .expect(200);
 
         //get total of metric data
-        const numMetricData = await Metric.find({ config: configId }).countDocuments();
+        const numMetricData = await Metric.find({ config: configId }).countDocuments().exec();
 
         //disable metrics
         await changeConfigDisableMetricFlag(configId, true, EnvType.DEFAULT);
@@ -379,7 +379,7 @@ describe('Testing criteria [GraphQL] ', () => {
             .expect(200);
 
         //test
-        const afterNumMetricData = await Metric.find({ config: configId }).countDocuments();
+        const afterNumMetricData = await Metric.find({ config: configId }).countDocuments().exec();
         expect(numMetricData === afterNumMetricData).toBe(true);
     });
 });
@@ -902,7 +902,7 @@ describe('Testing domain [Adm-GraphQL] ', () => {
 
     test('CLIENT_SUITE - Should NOT return domain structure for an excluded team member', async () => {
         //given
-        const admin = await Admin.findById(adminAccountId);
+        const admin = await Admin.findById(adminAccountId).exec();
         admin.teams = [];
         await admin.save();
 

tests/config-strategy.test.js

@@ -42,7 +42,7 @@ describe('Testing strategy creation #1', () => {
             }).expect(201);
 
         // DB validation - document created
-        const configStrategy = await ConfigStrategy.findById(response.body._id).lean();
+        const configStrategy = await ConfigStrategy.findById(response.body._id).lean().exec();
         expect(configStrategy).not.toBeNull();
 
         // Response validation
@@ -339,7 +339,7 @@ describe('Testing reading strategies #1', () => {
             }).expect(201);
 
         // DB validation - document created
-        const configStrategy = await ConfigStrategy.findById(response.body._id).lean();
+        const configStrategy = await ConfigStrategy.findById(response.body._id).lean().exec();
         expect(configStrategy).not.toBeNull();
 
         response = await request(app)
@@ -418,43 +418,43 @@ describe('Testing reading strategies #2', () => {
 
     test('STRATEGY_SUITE - Should delete Config Strategy', async () => {
         // DB validation Before deleting
-        let domain = await Domain.findById(domainId).lean();
+        let domain = await Domain.findById(domainId).lean().exec();
         expect(domain).not.toBeNull();
 
-        let group = await GroupConfig.findById(groupConfigId).lean();
+        let group = await GroupConfig.findById(groupConfigId).lean().exec();
         expect(group).not.toBeNull();
 
-        let config1 = await Config.findById(configId1).lean();
+        let config1 = await Config.findById(configId1).lean().exec();
         expect(config1).not.toBeNull();
 
-        let config2 = await Config.findById(configId2).lean();
+        let config2 = await Config.findById(configId2).lean().exec();
         expect(config2).not.toBeNull();
 
-        let configStrategy = await ConfigStrategy.findById(configStrategyId).lean();
+        let configStrategy = await ConfigStrategy.findById(configStrategyId).lean().exec();
         expect(configStrategy).not.toBeNull();
 
         await request(app)
             .delete('/configstrategy/' + configStrategyId)
             .set('Authorization', `Bearer ${adminMasterAccountToken}`)
             .send().expect(200);
 
-        const admin = await Admin.findById(adminMasterAccountId).lean();
+        const admin = await Admin.findById(adminMasterAccountId).lean().exec();
         expect(admin).not.toBeNull();
 
         // DB validation After - Verify deleted dependencies
-        domain = await Domain.findById(domainId).lean();
+        domain = await Domain.findById(domainId).lean().exec();
         expect(domain).not.toBeNull();
 
-        group = await GroupConfig.findById(groupConfigId).lean();
+        group = await GroupConfig.findById(groupConfigId).lean().exec();
         expect(group).not.toBeNull();
 
-        config1 = await Config.findById(configId1).lean();
+        config1 = await Config.findById(configId1).lean().exec();
         expect(config1).not.toBeNull();
 
-        config2 = await Config.findById(configId2).lean();
+        config2 = await Config.findById(configId2).lean().exec();
         expect(config2).not.toBeNull();
 
-        configStrategy = await ConfigStrategy.findById(configStrategyId).lean();
+        configStrategy = await ConfigStrategy.findById(configStrategyId).lean().exec();
         expect(configStrategy).toBeNull();
     });
 
@@ -476,7 +476,7 @@ describe('Testing update strategies #1', () => {
 
     test('STRATEGY_SUITE - Should update Config Strategy info', async () => {
 
-        let configStrategy = await ConfigStrategy.findById(configStrategyId).lean();
+        let configStrategy = await ConfigStrategy.findById(configStrategyId).lean().exec();
         expect(configStrategy).not.toBeNull();
 
         await request(app)
@@ -487,7 +487,7 @@ describe('Testing update strategies #1', () => {
             }).expect(200);
 
         // DB validation - verify flag updated
-        configStrategy = await ConfigStrategy.findById(configStrategyId).lean();
+        configStrategy = await ConfigStrategy.findById(configStrategyId).lean().exec();
         expect(configStrategy).not.toBeNull();
         expect(configStrategy.description).toEqual('New description');
     });
@@ -556,7 +556,7 @@ describe('Testing update strategies #1', () => {
         expect(response.body).not.toEqual([]);
 
         // DB validation
-        let history = await History.find({ elementId: strategyId }).lean();
+        let history = await History.find({ elementId: strategyId }).lean().exec();
         expect(history[0].oldValue['description']).toEqual('Description of my new Config Strategy');
         expect(history[0].newValue['description']).toEqual('New description');
 
@@ -568,7 +568,7 @@ describe('Testing update strategies #1', () => {
             }).expect(200);
 
         // DB validation
-        history = await History.find({ elementId: strategyId }).lean();
+        history = await History.find({ elementId: strategyId }).lean().exec();
         expect(history.length).toEqual(2);
     });
 
@@ -624,15 +624,15 @@ describe('Testing update strategies #1', () => {
                 description: 'New description'
             }).expect(200);
 
-        let history = await History.find({ elementId: strategyId }).lean();
+        let history = await History.find({ elementId: strategyId }).lean().exec();
         expect(history.length > 0).toEqual(true);
 
         await request(app)
             .delete('/configstrategy/history/' + strategyId)
             .set('Authorization', `Bearer ${adminMasterAccountToken}`)
             .send().expect(200);
 
-        history = await History.find({ elementId: strategyId }).lean();
+        history = await History.find({ elementId: strategyId }).lean().exec();
         expect(history.length > 0).toEqual(false);
     });
 
@@ -675,7 +675,7 @@ describe('Testing update strategies #1', () => {
         expect(response.body.values[response.body.values.length - 1]).toEqual('USER_4');
 
         // DB validation
-        const configStrategy = await ConfigStrategy.findOne({ _id: configStrategyId }).lean();
+        const configStrategy = await ConfigStrategy.findOne({ _id: configStrategyId }).lean().exec();
         const foundExistingOne = configStrategy.values.find((element) => element === 'USER_4');
         expect('USER_4').toEqual(foundExistingOne);
     });
@@ -762,7 +762,7 @@ describe('Testing update strategies #1', () => {
         expect(response.body.values[response.body.values.length - 1]).toEqual('USER_THREE');
 
         // DB validation
-        const configStrategy = await ConfigStrategy.findOne({ _id: configStrategyId }).lean();
+        const configStrategy = await ConfigStrategy.findOne({ _id: configStrategyId }).lean().exec();
         const foundExistingOne = configStrategy.values.find((element) => element === 'USER_THREE');
         expect('USER_THREE').toEqual(foundExistingOne);
 
@@ -822,7 +822,7 @@ describe('Testing update strategies #2', () => {
     });
 
     test('STRATEGY_SUITE - Should remove a value from Strategy values', async () => {
-        let configStrategy = await ConfigStrategy.findOne({ _id: configStrategyId }).lean();
+        let configStrategy = await ConfigStrategy.findOne({ _id: configStrategyId }).lean().exec();
         const numberOfValues = configStrategy.values.length;
 
         let response = await request(app)
@@ -835,7 +835,7 @@ describe('Testing update strategies #2', () => {
         expect(response.body.values.length + 1).toEqual(numberOfValues);
 
         // DB validation
-        configStrategy = await ConfigStrategy.findOne({ _id: configStrategyId }).lean();
+        configStrategy = await ConfigStrategy.findOne({ _id: configStrategyId }).lean().exec();
         const notFoundOldOne = configStrategy.values.find((element) => element === 'USER_3');
         expect(notFoundOldOne).toEqual(undefined);
     });
@@ -935,7 +935,7 @@ describe('Testing fetch strategies', () => {
         expect(response.body.activated[EnvType.DEFAULT]).toEqual(false);
 
         // DB validation - verify status updated
-        const strategy = await ConfigStrategy.findById(configStrategyId).lean();
+        const strategy = await ConfigStrategy.findById(configStrategyId).lean().exec();
         expect(strategy.activated[EnvType.DEFAULT]).toEqual(false);
     });
 
@@ -976,7 +976,7 @@ describe('Scenario: creating QA environment and modifying its status', () => {
         expect(response.body.activated['QA']).toEqual(true);
 
         // DB validation - verify status updated
-        let strategy = await ConfigStrategy.findById(newStrategy.body._id).lean();
+        let strategy = await ConfigStrategy.findById(newStrategy.body._id).lean().exec();
         expect(strategy.activated['QA']).toEqual(true);
 
         // Inactivating QA. Default environment should stay activated
@@ -987,7 +987,7 @@ describe('Scenario: creating QA environment and modifying its status', () => {
                 QA: false
             }).expect(200);
 
-        strategy = await ConfigStrategy.findById(newStrategy.body._id).lean();
+        strategy = await ConfigStrategy.findById(newStrategy.body._id).lean().exec();
         expect(strategy.activated['QA']).toEqual(false);
     });