WIP: Module Reloading Stratagies #3809
Conversation
…error in final update
|
✅ Deploy Preview for module-federation-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
| const vm = require('vm'); | ||
|
|
||
| // Webpack runtime code for in-memory HMR - only executed when webpack is available | ||
| function injectInMemoryHMRRuntime(__webpack_require__) { |
There was a problem hiding this comment.
copy over the runtime module from HMR plugin - the plugin (in node targets) is designed to read filesystem only to check for updates. I replace some of the methods to allow in-memory patches, so that i could fetch() the update from a KV store or database etc and not need to manually write to disk.
| /******/ | ||
| /******/ // no external install chunk | ||
| /******/ | ||
| /******/ function loadUpdateChunk(chunkId, updatedModulesList) { |
There was a problem hiding this comment.
node federation plugin already patches require.f.readFileVM but i never updated it to include the HMR stuff - in future this code could live in the node runtime plugin where other chunk loading stuff already exists.
| const event = { | ||
| id: `evt_${now}_${i}`, | ||
| type: EVENT_TYPES[Math.floor(Math.random() * EVENT_TYPES.length)], | ||
| userId: `user_${Math.floor(Math.random() * 100)}`, |
Check failure
Code scanning / CodeQL
Insecure randomness High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 2 months ago
To fix the issue, replace the use of Math.random() with a cryptographically secure random number generator. In Node.js, the crypto module provides a secure way to generate random values. Specifically, crypto.randomBytes can be used to generate random bytes, which can then be converted into a number or string as needed.
For the user ID generation, we can use crypto.randomBytes to generate a random number or string that is sufficiently unpredictable. This ensures that the user ID cannot be easily guessed or brute-forced.
| @@ -2,2 +2,3 @@ | ||
| const Logger = require('./utils/logger'); | ||
| const crypto = require('crypto'); | ||
| const DataManager = require('./utils/dataManager'); | ||
| @@ -141,3 +142,3 @@ | ||
| type: EVENT_TYPES[Math.floor(Math.random() * EVENT_TYPES.length)], | ||
| userId: `user_${Math.floor(Math.random() * 100)}`, | ||
| userId: `user_${crypto.randomBytes(4).toString('hex')}`, | ||
| sessionId: `session_${Math.floor(Math.random() * 20)}`, |
| id: `evt_${now}_${i}`, | ||
| type: EVENT_TYPES[Math.floor(Math.random() * EVENT_TYPES.length)], | ||
| userId: `user_${Math.floor(Math.random() * 100)}`, | ||
| sessionId: `session_${Math.floor(Math.random() * 20)}`, |
Check failure
Code scanning / CodeQL
Insecure randomness High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 2 months ago
To fix the issue, we need to replace the use of Math.random() with a cryptographically secure random number generator. In Node.js, the crypto module provides a secure method for generating random values. Specifically, we can use crypto.randomBytes to generate random bytes and convert them into a secure session ID.
The fix involves:
- Importing the
cryptomodule. - Replacing the insecure
Math.random()logic with a secure random value generated usingcrypto.randomBytes. - Ensuring the session ID remains in the same format as before (e.g., prefixed with
session_).
| @@ -3,2 +3,3 @@ | ||
| const DataManager = require('./utils/dataManager'); | ||
| const crypto = require('crypto'); | ||
| const Metrics = require('./utils/metrics'); | ||
| @@ -142,3 +143,3 @@ | ||
| userId: `user_${Math.floor(Math.random() * 100)}`, | ||
| sessionId: `session_${Math.floor(Math.random() * 20)}`, | ||
| sessionId: `session_${crypto.randomBytes(4).toString('hex')}`, | ||
| timestamp: new Date(now - Math.random() * 86400000).toISOString(), // Last 24 hours |
| app.get('/admin', (req, res) => { | ||
| res.sendFile(path.join(__dirname, 'public', 'admin.html')); | ||
| }); |
Check failure
Code scanning / CodeQL
Missing rate limiting High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 days ago
To address the issue, we will introduce rate limiting to the application using the express-rate-limit package. This package allows us to define a rate-limiting middleware that restricts the number of requests a client can make to the server within a specified time window. Specifically, we will:
- Install the
express-rate-limitpackage. - Configure a rate limiter with appropriate settings (e.g., a maximum of 100 requests per 15 minutes).
- Apply the rate limiter middleware to the
/adminroute to limit access to theadmin.htmlfile.
This fix ensures that the /admin route is protected against excessive requests, reducing the risk of a DoS attack.
| @@ -6,2 +6,3 @@ | ||
| const WebSocket = require('ws'); | ||
| const rateLimit = require('express-rate-limit'); | ||
|
|
||
| @@ -264,3 +265,7 @@ | ||
| // Serve admin interface | ||
| app.get('/admin', (req, res) => { | ||
| const adminLimiter = rateLimit({ | ||
| windowMs: 15 * 60 * 1000, // 15 minutes | ||
| max: 100, // Limit each IP to 100 requests per windowMs | ||
| }); | ||
| app.get('/admin', adminLimiter, (req, res) => { | ||
| res.sendFile(path.join(__dirname, 'public', 'admin.html')); |
| @@ -13,3 +13,4 @@ | ||
| "body-parser": "^1.20.2", | ||
| "ws": "^8.14.2" | ||
| "ws": "^8.14.2", | ||
| "express-rate-limit": "^8.0.1" | ||
| }, |
| Package | Version | Security advisories |
| express-rate-limit (npm) | 8.0.1 | None |
Co-authored-by: Claude <noreply@anthropic.com>
Description
Investigating better stratagies for hot reloading node servers when federated modules change.
Related Issue
Types of changes
Checklist