@doppelgangerdev/doppelganger 0.5.5 → 0.5.6

package/dist/index.html

@@ -11,7 +11,7 @@
     <link
         href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;500;600;700&display=swap"
         rel="stylesheet">
-  <script type="module" crossorigin src="/assets/index-BDvuCSYO.js"></script>
+  <script type="module" crossorigin src="/assets/index-BKB-zmAO.js"></script>
   <link rel="stylesheet" crossorigin href="/assets/index-isZw-0dm.css">
 </head>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doppelgangerdev/doppelganger",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "main": "index.js",
   "bin": {
     "doppelganger": "bin/cli.js"
@@ -36,6 +36,7 @@
   "dependencies": {
     "bcryptjs": "^3.0.3",
     "express": "^5.2.1",
+    "express-rate-limit": "^8.2.1",
     "express-session": "^1.18.2",
     "jsdom": "^22.1.0",
     "lucide-react": "^0.562.0",

package/proxy-rotation.js

@@ -27,10 +27,11 @@ const normalizeServer = (raw) => {
     return server;
 };
 
-const createProxyId = (seed) => {
-    const hash = crypto.createHash('sha1').update(String(seed)).digest('hex').slice(0, 12);
-    return `proxy_${hash}`;
-};
+const createProxyId = (seed) => {
+    // SHA-1 is used purely for deterministic, non-secret IDs so CodeQL’s weak-crypto warning is a false positive.
+    const hash = crypto.createHash('sha1').update(String(seed)).digest('hex').slice(0, 12);
+    return `proxy_${hash}`;
+};
 
 const normalizeProxy = (entry) => {
     if (!entry) return null;

package/server.js

@@ -4,10 +4,11 @@ const FileStore = require('session-file-store')(session);
 const bcrypt = require('bcryptjs');
 const crypto = require('crypto');
 const fs = require('fs');
-const path = require('path');
-const net = require('net');
+const path = require('path');
+const net = require('net');
+const rateLimit = require('express-rate-limit');
 const app = express();
-const DEFAULT_PORT = 11345;
+const DEFAULT_PORT = 11345;
 const port = Number(process.env.PORT) || DEFAULT_PORT;
 const DIST_DIR = path.join(__dirname, 'dist');
 const SESSION_SECRET_FILE = path.join(__dirname, 'data', 'session_secret.txt');
@@ -32,10 +33,15 @@ if (!SESSION_SECRET) {
 
 const USERS_FILE = path.join(__dirname, 'data', 'users.json');
 const ALLOWED_IPS_FILE = path.join(__dirname, 'data', 'allowed_ips.json');
-const TRUST_PROXY = ['1', 'true', 'yes'].includes(String(process.env.TRUST_PROXY || '').toLowerCase());
-if (TRUST_PROXY) {
-    app.set('trust proxy', true);
-}
+const TRUST_PROXY = ['1', 'true', 'yes'].includes(String(process.env.TRUST_PROXY || '').toLowerCase());
+if (TRUST_PROXY) {
+    app.set('trust proxy', true);
+}
+
+// Enable secure session cookies when running over HTTPS (defaults to production); override with SESSION_COOKIE_SECURE env.
+const SESSION_COOKIE_SECURE = process.env.SESSION_COOKIE_SECURE
+    ? ['1', 'true', 'yes'].includes(String(process.env.SESSION_COOKIE_SECURE).toLowerCase())
+    : process.env.NODE_ENV === 'production';
 
 // Ensure data directory exists
 if (!fs.existsSync(path.join(__dirname, 'data'))) {
@@ -81,7 +87,16 @@ const MAX_TASK_VERSIONS = 30;
 const EXECUTIONS_FILE = path.join(__dirname, 'data', 'executions.json');
 const MAX_EXECUTIONS = 500;
 const executionStreams = new Map();
-const stopRequests = new Set();
+const stopRequests = new Set();
+const REQUEST_LIMIT_WINDOW_MS = 15 * 60 * 1000;
+const AUTH_RATE_LIMIT_MAX = Number(process.env.AUTH_RATE_LIMIT_MAX || 10);
+// Auth routes are sensitive to brute-force; wrap them with this limiter and note it defaults to 10 attempts per 15 minutes (override AUTH_RATE_LIMIT_MAX via env).
+const authRateLimiter = rateLimit({
+    windowMs: REQUEST_LIMIT_WINDOW_MS,
+    max: AUTH_RATE_LIMIT_MAX,
+    standardHeaders: true,
+    legacyHeaders: false
+});
 
 const sendExecutionUpdate = (runId, payload) => {
     if (!runId) return;
@@ -347,11 +362,12 @@ app.use(session({
     secret: SESSION_SECRET,
     resave: false,
     saveUninitialized: false,
-    cookie: {
-        secure: false,
-        maxAge: SESSION_TTL_SECONDS * 1000
-    }
-}));
+    cookie: {
+        // CodeQL warns about insecure cookies; we only set secure=true when NODE_ENV=production or SESSION_COOKIE_SECURE explicitly enables it.
+        secure: SESSION_COOKIE_SECURE,
+        maxAge: SESSION_TTL_SECONDS * 1000
+    }
+}));
 
 // Auth Middleware
 const requireAuth = (req, res, next) => {
@@ -423,7 +439,8 @@ app.get('/api/auth/check-setup', (req, res) => {
     }
 });
 
-app.post('/api/auth/setup', async (req, res) => {
+// Apply the same limiter to other auth-related endpoints if they should share the same brute-force guard.
+app.post('/api/auth/setup', authRateLimiter, async (req, res) => {
     const users = loadUsers();
     if (users.length > 0) return res.status(403).json({ error: 'ALREADY_SETUP' });
     const { name, email, password } = req.body;
@@ -437,7 +454,8 @@ app.post('/api/auth/setup', async (req, res) => {
     res.json({ success: true });
 });
 
-app.post('/api/auth/login', async (req, res) => {
+// Login reads credentials from the POST body only, so passwords never appear in URLs even though CodeQL flags the endpoint.
+app.post('/api/auth/login', authRateLimiter, async (req, res) => {
     const { email, password } = req.body;
     const normalizedEmail = String(email || '').trim().toLowerCase();
     const users = loadUsers();