fix: fix security issue in index.ts

telemetry-dashboard/src/index.ts

@@ -157,6 +157,19 @@ async function loginRateLimitOk(env: Env, request: Request): Promise<boolean> {
   }
 }
 
+/** Best-effort abuse cap on the authenticated API surface, keyed by client IP. */
+async function apiRateLimitOk(env: Env, request: Request): Promise<boolean> {
+  const key = request.headers.get('cf-connecting-ip') ?? 'unknown';
+  try {
+    const { success } = await env.API_RATE_LIMITER.limit({ key });
+    return success;
+  } catch (err) {
+    // Fail open: a rate-limiter outage must not take the dashboard down.
+    console.error(JSON.stringify({ msg: 'api rate limiter unavailable', err: String(err) }));
+    return true;
+  }
+}
+
 async function handleLoginPage(env: Env, request: Request, url: URL): Promise<Response> {
   const next = safeNextPath(url.searchParams.get('next'));
   if (await hasValidSession(env, request)) return redirect(next);
@@ -260,6 +273,9 @@ export default {
         if (!isRead) {
           return json({ error: 'method not allowed' }, { status: 405, headers: { allow: 'GET' } });
         }
+        if (!(await apiRateLimitOk(env, request))) {
+          return json({ error: 'too many requests' }, { status: 429 });
+        }
         return await apiResponse(env, url);
       }
 

telemetry-dashboard/wrangler.jsonc

@@ -46,6 +46,11 @@
       "name": "LOGIN_RATE_LIMITER",
       "namespace_id": "2001",
       "simple": { "limit": 5, "period": 60 }
+    },
+    {
+      "name": "API_RATE_LIMITER",
+      "namespace_id": "2002",
+      "simple": { "limit": 120, "period": 60 }
     }
   ]
 }