bulltrackers-module 1.0.623 → 1.0.625
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -80,6 +80,10 @@ const latestUserCentricSnapshot = async (firestore, userId, collectionName, data
|
|
|
80
80
|
|
|
81
81
|
const pageCollection = async (firestore, dateStr, computationName, userId, lookbackDays = 7) => {
|
|
82
82
|
try {
|
|
83
|
+
// Sanitize user inputs
|
|
84
|
+
const sanitizedUserId = sanitizeCid(userId);
|
|
85
|
+
const sanitizedComputationName = sanitizeDocId(computationName);
|
|
86
|
+
|
|
83
87
|
const endDate = new Date(dateStr);
|
|
84
88
|
const startDate = new Date(endDate);
|
|
85
89
|
startDate.setDate(endDate.getDate() - lookbackDays);
|
|
@@ -88,7 +92,7 @@ const pageCollection = async (firestore, dateStr, computationName, userId, lookb
|
|
|
88
92
|
const dateKey = d.toISOString().split('T')[0];
|
|
89
93
|
const docRef = firestore.collection('unified_insights').doc(dateKey)
|
|
90
94
|
.collection('results').doc('popular-investor')
|
|
91
|
-
.collection('computations').doc(
|
|
95
|
+
.collection('computations').doc(sanitizedComputationName)
|
|
92
96
|
.collection('pages').doc(sanitizedUserId);
|
|
93
97
|
const docSnapshot = await docRef.get();
|
|
94
98
|
if (docSnapshot.exists) {
|
|
@@ -29,8 +29,10 @@ function createApiV2App(config, dependencies) {
|
|
|
29
29
|
const { logger } = dependencies;
|
|
30
30
|
|
|
31
31
|
// Trust proxy - Required when behind a load balancer/proxy (e.g., Google Cloud Functions)
|
|
32
|
+
// Trust only the first proxy (the load balancer) to prevent IP spoofing
|
|
32
33
|
// This allows express-rate-limit to correctly identify client IPs from X-Forwarded-For headers
|
|
33
|
-
|
|
34
|
+
// Setting to 1 means we trust only the first proxy, not all proxies (which would be insecure)
|
|
35
|
+
app.set('trust proxy', 1);
|
|
34
36
|
|
|
35
37
|
// CORS Configuration - Restrict to specific origins
|
|
36
38
|
app.use(cors({
|