Skip to content

fix: address OWASP security review findings for v2 API endpoints #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
paragmore merged 10 commits into from
Mar 11, 2026
Merged

fix: address OWASP security review findings for v2 API endpoints #30

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
4e0bc2d
chore: record asana comments snapshot
mukama Mar 9, 2026
7d70738
chore: record asana comments snapshot
mukama Mar 9, 2026
04adc30
fix: implement limit parameter for power-mode/timeline endpoint
mukama Mar 10, 2026
4e5e4e8
fix: add minimum:0 timestamp validation to pools schemas
mukama Mar 10, 2026
07b71f4
fix: sanitize error messages and add security response headers
mukama Mar 10, 2026
c898408
fix: simplify error sanitization to use ERR_ prefix check
mukama Mar 10, 2026
144d3a0
chore: remove scratch files from PR
mukama Mar 10, 2026
f19060d
fix: guard against undefined error.message in onError hook
mukama Mar 10, 2026
e794fec
fix: add minimum:0 timestamp validation to finance and alerts schemas
mukama Mar 10, 2026
4893b82
fix: address PR review feedback - remove nginx-duplicate headers and …
mukama Mar 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions tests/unit/handlers/metrics.handlers.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1127,6 +1127,34 @@ test('getPowerModeTimeline - always uses t-miner tag', async (t) => {
t.pass()
})

test('getPowerModeTimeline - returns all results without truncation', async (t) => {
const mockCtx = {
conf: {
orks: [{ rpcPublicKey: 'key1' }]
},
net_r0: {
jRequest: async () => {
const entries = []
for (let i = 0; i < 5; i++) {
entries.push({
ts: 1700000000000 + i * 10800000,
power_mode_group_aggr: { [`cont${i}-miner1`]: 'normal' },
status_group_aggr: { [`cont${i}-miner1`]: 'mining' }
})
}
return entries
}
}
}

const result = await getPowerModeTimeline(mockCtx, {
query: { start: 1700000000000, end: 1700100000000 }
})

t.is(result.log.length, 5, 'should return all results')
t.pass()
})

test('processPowerModeTimelineData - filters by container post-RPC', (t) => {
const results = [[
{
Expand Down
9 changes: 8 additions & 1 deletion workers/http.node.wrk.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,10 +99,17 @@ class WrkServerHttp extends TetherWrkBase {
})

httpd.addHook('onError', async (request, reply, error) => {
const isSafe = error.message && error.message.startsWith('ERR_')
const message = isSafe ? error.message : 'Bad Request'

if (!isSafe) {
debug('onError handler:', error.message)
}

return reply.status(400).send({
statusCode: 400,
error: 'Bad Request',
message: error.message
message
})
})

Expand Down
1 change: 0 additions & 1 deletion workers/lib/constants.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -272,7 +272,6 @@ const METRICS_TIME = {
}

const METRICS_DEFAULTS = {
TIMELINE_LIMIT: 10080,
CONTAINER_HISTORY_LIMIT: 10080
}

Expand Down
3 changes: 1 addition & 2 deletions workers/lib/server/routes/metrics.routes.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,8 +119,7 @@ module.exports = (ctx) => {
'metrics/power-mode/timeline',
req.query.start,
req.query.end,
req.query.container,
req.query.limit
req.query.container
],
ENDPOINTS.METRICS_POWER_MODE_TIMELINE,
getPowerModeTimeline
Expand Down
4 changes: 2 additions & 2 deletions workers/lib/server/schemas/alerts.schemas.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,8 @@ const schemas = {
alertsHistory: {
type: 'object',
properties: {
start: { type: 'integer' },
end: { type: 'integer' },
start: { type: 'integer', minimum: 0 },
end: { type: 'integer', minimum: 0 },
filter: { type: 'string' },
search: { type: 'string' },
sort: { type: 'string' },
Expand Down
24 changes: 12 additions & 12 deletions workers/lib/server/schemas/finance.schemas.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,8 @@ const schemas = {
energyBalance: {
type: 'object',
properties: {
start: { type: 'integer' },
end: { type: 'integer' },
start: { type: 'integer', minimum: 0 },
end: { type: 'integer', minimum: 0 },
period: { type: 'string', enum: ['daily', 'monthly', 'yearly'] },
overwriteCache: { type: 'boolean' }
},
Expand All @@ -15,8 +15,8 @@ const schemas = {
ebitda: {
type: 'object',
properties: {
start: { type: 'integer' },
end: { type: 'integer' },
start: { type: 'integer', minimum: 0 },
end: { type: 'integer', minimum: 0 },
period: { type: 'string', enum: ['daily', 'monthly', 'yearly'] },
overwriteCache: { type: 'boolean' }
},
Expand All @@ -25,8 +25,8 @@ const schemas = {
costSummary: {
type: 'object',
properties: {
start: { type: 'integer' },
end: { type: 'integer' },
start: { type: 'integer', minimum: 0 },
end: { type: 'integer', minimum: 0 },
period: { type: 'string', enum: ['daily', 'monthly', 'yearly'] },
overwriteCache: { type: 'boolean' }
},
Expand All @@ -35,8 +35,8 @@ const schemas = {
subsidyFees: {
type: 'object',
properties: {
start: { type: 'integer' },
end: { type: 'integer' },
start: { type: 'integer', minimum: 0 },
end: { type: 'integer', minimum: 0 },
period: { type: 'string', enum: ['daily', 'weekly', 'monthly'] },
overwriteCache: { type: 'boolean' }
},
Expand All @@ -45,8 +45,8 @@ const schemas = {
revenue: {
type: 'object',
properties: {
start: { type: 'integer' },
end: { type: 'integer' },
start: { type: 'integer', minimum: 0 },
end: { type: 'integer', minimum: 0 },
period: { type: 'string', enum: ['daily', 'weekly', 'monthly', 'yearly'] },
pool: { type: 'string' },
overwriteCache: { type: 'boolean' }
Expand All @@ -56,8 +56,8 @@ const schemas = {
revenueSummary: {
type: 'object',
properties: {
start: { type: 'integer' },
end: { type: 'integer' },
start: { type: 'integer', minimum: 0 },
end: { type: 'integer', minimum: 0 },
period: { type: 'string', enum: ['daily', 'monthly', 'yearly'] },
overwriteCache: { type: 'boolean' }
},
Expand Down
32 changes: 16 additions & 16 deletions workers/lib/server/schemas/metrics.schemas.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,44 +5,44 @@ const schemas = {
hashrate: {
type: 'object',
properties: {
start: { type: 'integer' },
end: { type: 'integer' },
start: { type: 'integer', minimum: 0 },
end: { type: 'integer', minimum: 0 },
overwriteCache: { type: 'boolean' }
},
required: ['start', 'end']
},
consumption: {
type: 'object',
properties: {
start: { type: 'integer' },
end: { type: 'integer' },
start: { type: 'integer', minimum: 0 },
end: { type: 'integer', minimum: 0 },
overwriteCache: { type: 'boolean' }
},
required: ['start', 'end']
},
efficiency: {
type: 'object',
properties: {
start: { type: 'integer' },
end: { type: 'integer' },
start: { type: 'integer', minimum: 0 },
end: { type: 'integer', minimum: 0 },
overwriteCache: { type: 'boolean' }
},
required: ['start', 'end']
},
minerStatus: {
type: 'object',
properties: {
start: { type: 'integer' },
end: { type: 'integer' },
start: { type: 'integer', minimum: 0 },
end: { type: 'integer', minimum: 0 },
overwriteCache: { type: 'boolean' }
},
required: ['start', 'end']
},
powerMode: {
type: 'object',
properties: {
start: { type: 'integer' },
end: { type: 'integer' },
start: { type: 'integer', minimum: 0 },
end: { type: 'integer', minimum: 0 },
interval: { type: 'string', enum: ['1h', '1d', '1w'] },
overwriteCache: { type: 'boolean' }
},
Expand All @@ -51,17 +51,17 @@ const schemas = {
powerModeTimeline: {
type: 'object',
properties: {
start: { type: 'integer' },
end: { type: 'integer' },
start: { type: 'integer', minimum: 0 },
end: { type: 'integer', minimum: 0 },
container: { type: 'string' },
overwriteCache: { type: 'boolean' }
}
},
temperature: {
type: 'object',
properties: {
start: { type: 'integer' },
end: { type: 'integer' },
start: { type: 'integer', minimum: 0 },
end: { type: 'integer', minimum: 0 },
interval: { type: 'string', enum: ['1h', '1d', '1w'] },
container: { type: 'string' },
overwriteCache: { type: 'boolean' }
Expand All @@ -77,8 +77,8 @@ const schemas = {
containerHistory: {
type: 'object',
properties: {
start: { type: 'integer' },
end: { type: 'integer' },
start: { type: 'integer', minimum: 0 },
end: { type: 'integer', minimum: 0 },
limit: { type: 'integer' },
overwriteCache: { type: 'boolean' }
}
Expand Down
8 changes: 4 additions & 4 deletions workers/lib/server/schemas/pools.schemas.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,8 @@ const schemas = {
balanceHistory: {
type: 'object',
properties: {
start: { type: 'integer' },
end: { type: 'integer' },
start: { type: 'integer', minimum: 0 },
end: { type: 'integer', minimum: 0 },
range: { type: 'string', enum: ['1D', '1W', '1M'] },
overwriteCache: { type: 'boolean' }
},
Expand All @@ -24,8 +24,8 @@ const schemas = {
poolStatsAggregate: {
type: 'object',
properties: {
start: { type: 'integer' },
end: { type: 'integer' },
start: { type: 'integer', minimum: 0 },
end: { type: 'integer', minimum: 0 },
range: { type: 'string', enum: ['daily', 'weekly', 'monthly'] },
pool: { type: 'string' },
overwriteCache: { type: 'boolean' }
Expand Down