Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feature/update nces fetching #398

Merged
merged 4 commits into from
Mar 21, 2024
Merged

Feature/update nces fetching #398

merged 4 commits into from
Mar 21, 2024

Conversation

courtneymyers
Copy link
Collaborator

Related Issues:

  • CSBAPP-311

Main Changes:

  • Update to Feature/fetch nces from s3 #394 – Updates server to fetch NCES.json data before starting Express app, and stores it on the Express app's locals object for use in the Formio NCES endpoint.

Steps To Test:

  1. Hit the app's NCES endpoint several times (replicating several concurrent users hitting that endpoint) and ensure the memory use doesn't spike causing the app to crash.

@courtneymyers
Move server app's s3 config file from utilities directory to config d…
fba00a8 
…irectory
@courtneymyers
Add old NCES.json back to the top level /assets directory (along with…
d269590 
… a README file), as the JSON file is still used in the 2022 FRF, so must stay at this location
@courtneymyers
Update server app to fetch NCES.json file from S3 bucket before start…
d2fe35c 
…ing Express app, and caching the data on the Express app's locals object
@courtneymyers
Update fetched content files to be logged locally and update BAP conn…
8e40914 
…ection comment to be consistent with other data stored on Express app's locals object
github-advanced-security[bot]
github-advanced-security bot found potential problems Mar 21, 2024
View reviewed changes
app/server/app/index.js
const logMessage = `Server listening on port ${port}`;
log({ level: "info", message: logMessage });
app.use(express.json({ limit: JSON_PAYLOAD_LIMIT || "5mb" }));
app.use(cookieParser());

Check failure

Code scanning / CodeQL

Missing CSRF middleware High

This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a
request handler
Loading
without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
app/server/app/index.js
* Use regex to add trailing slash on static requests
* (required when using sub path).
*/
const pathRegex = new RegExp(`^\\${SERVER_BASE_PATH || ""}$`);

Check failure

Code scanning / CodeQL

Regular expression injection High

This regular expression is constructed from a
environment variable
Loading
.
app/server/app/index.js
app.use(basePath, express.static(resolve(__dirname, "public")));

/** Ensure that requested client route exists (otherwise send 404). */
app.use(checkClientRouteExists);

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
a file system access
Loading
, but is not rate-limited.
app/server/app/index.js
app.use(checkClientRouteExists);

/** Ensure user is authenticated on all client-side routes except / and /welcome */
app.use(protectClientRoutes);

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
Loading
, but is not rate-limited.
This route handler performs
authorization
Loading
, but is not rate-limited.
app/server/app/index.js
Comment on lines +162 to +164
app.get("*", (req, res) => {
res.sendFile(resolve(__dirname, "public/index.html"));
});

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
a file system access
Loading
, but is not rate-limited.
@courtneymyers courtneymyers merged commit e9f2cdc into develop Mar 21, 2024
1 of 2 checks passed
@courtneymyers courtneymyers deleted the feature/update-nces-fetching branch March 21, 2024 21:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@courtneymyers