Merge pull request #47 from henrythasler/bugfix/codeql-findings

Fix CodeQL findings

.github/workflows/deploy-lambda.yml

@@ -0,0 +1,31 @@
+name: Deploy Nodejs Lambda
+
+on:
+ push:
+ branches: [ "master" ]
+ tags: [ '*' ] 
+
+jobs:
+ deploy:
+ runs-on: ubuntu-latest
+
+ steps:
+ - uses: actions/checkout@main
+ - name: Use Node.js 20.x
+ uses: actions/setup-node@main
+ with:
+ node-version: 20.x
+ cache: 'npm'
+ - name: predeploy
+ run: | 
+ npm ci
+ npm run predeploy
+ - name: Setup AWS CLI
+ uses: aws-actions/configure-aws-credentials@main
+ with:
+ aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+ aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+ aws-region: eu-central-1
+ - name: deploy to AWS lambda
+ run: aws lambda update-function-code --function-name tileserver --zip-file fileb://dist/function.zip
+ #run: aws lambda create-function --dry-run --function-name tileserver --description "Deploy commit ${{github.sha}} by ${{github.actor}}" --runtime nodejs18.x --handler handler --role ${{ secrets.AWS_LAMBDA_TILESERVER_ROLE }} --zip-file fileb://dist/function.zip

package.json

@@ -1,6 +1,6 @@
 {
  "name": "cloud-tileserver",
- "version": "1.3.0",
+ "version": "1.3.1",
  "description": "AWS lambda function to handle vectortile queries via REST",
  "main": "index.js",
  "scripts": {

src/tileserver.ts

@@ -21,8 +21,8 @@ export class Log {
  this.loglevel = level;
  }
 
- show(msg: any, level: number) {
- if (level <= this.loglevel) console.log(msg);
+ show(msg: string, level: number) {
+ if (level <= this.loglevel) console.log(msg.replace(/\n|\r/g, ""));
  }
 }
 
@@ -103,6 +103,10 @@ export class Tileserver {
  * @return a tile for subsequent use or null if no valid Tile could be extracted. 
  */
  extractTile(path: string): Tile | null {
+ if (path.length > 1000) {
+ this.log.show(`extractTile(): input path length exceeds limit`, LogLevels.ERROR);
+ return null;
+ }
  const tile: Tile = { x: 0, y: 0, z: 0 };
  const tilepath: RegExpMatchArray | null = path.match(/\d+\/\d+\/\d+(?=\.mvt\b)/g);
  if (tilepath) {
@@ -121,6 +125,10 @@ export class Tileserver {
  * @return the name of the source if found
  */
  extractSource(path: string): string | null {
+ if (path.length > 1000) {
+ this.log.show(`extractSource(): input path length exceeds limit`, LogLevels.ERROR);
+ return null;
+ }
  // match the last word between slashes before the actual tile (3-numbers + extension)
  const sourceCandidates: RegExpMatchArray | null = path.match(/(?!\/)\w+(?=\/\d+\/\d+\/\d+\.mvt\b)/g)
  if (sourceCandidates != null && sourceCandidates.length > 0) {
@@ -352,7 +360,7 @@ export class Tileserver {
  const error: Error = _e as Error;
  mvt.res = -4;
  mvt.status = `[ERROR] - Database error: ${error.message}`;
- this.log.show(error, LogLevels.ERROR);
+ this.log.show(error.message, LogLevels.ERROR);
  return mvt;
  }
  }
@@ -365,7 +373,7 @@ export class Tileserver {
  data = Buffer.from("");
  }
 
- this.log.show(data, LogLevels.TRACE);
+ this.log.show(data.toString("base64"), LogLevels.TRACE);
 
  const uncompressedBytes = data.byteLength;
  if (this.gzip) mvt.data = await asyncgzip(data) as Buffer;

test/parser.test.ts

@@ -35,11 +35,16 @@ describe("Parsing functions", function () {
  let tile: Tile | null = tileserver.extractTile("foo");
  expect(tile).to.be.null;
  });
- it("extractTile negative #3 - invalid extension", function () {
+ it("extractTile negative #4 - invalid extension", function () {
  let tile: Tile | null = tileserver.extractTile("/local/14/8691/5677.mvtinvalid");
  expect(tile).to.be.null;
  });
-
+ it("extractTile negative #5 - oversized input", function () {
+ const longString = '9'.repeat(1024);
+ let tile: Tile | null = tileserver.extractTile(longString);
+ expect(tile).to.be.null;
+ });
+
 
  it("extractSource regular #1 - simple path", function () {
  let source: string | null = tileserver.extractSource("/local/0/0/0.mvt");
@@ -58,6 +63,11 @@ describe("Parsing functions", function () {
  let source: string | null = tileserver.extractSource("foo");
  expect(source).to.be.null;
  });
+ it("extractSource negative #3 - input length limit exceeded", function () {
+ const longString = '9'.repeat(1024);
+ let source: string | null = tileserver.extractSource(longString);
+ expect(source).to.be.null;
+ }); 
  it("extractSource SQL-Injection #1 - `select now()`", function () {
  let source: string | null = tileserver.extractSource("/select+now%28%29/0/0/0.mvt");
  expect(source).to.be.equal('29');