Vulnerabilities fixes

package.json

@@ -1,6 +1,6 @@
 {
   "name": "shopify-live-preview-middleware",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Shopify Live Preview Middleware Service",
   "type": "module",
   "main": "src/index.ts",
@@ -23,14 +23,14 @@
   "dependencies": {
     "@contentstack/shopify-live-preview-sdk": "file:contentstack-shopify-live-preview-sdk-1.0.0.tgz",
     "@fastify/cors": "^8.3.0",
+    "@fastify/rate-limit": "^9.1.0",
     "@fastify/swagger": "^8.8.0",
     "@fastify/swagger-ui": "^3.0.0",
     "adm-zip": "^0.5.10",
     "axios": "^1.9.0",
     "dotenv": "^16.5.0",
     "fastify": "^4.21.0",
     "fastify-plugin": "^4.5.1",
-    "live-preview-shopify-utils": "file:live-preview-shopify-utils-1.0.0.tgz",
     "lodash": "^4.17.21",
     "pino-pretty": "^10.2.0"
   },

src/config.ts

@@ -8,6 +8,10 @@ interface Config {
     environment: string;
     apiKey: string;
     previewUrl?: string;
+    rateLimit?: {
+      max: number;
+      timeWindow: string;
+    };
   };
 }
 
@@ -21,5 +25,11 @@ export const config: Config = {
     environment: process.env.CONTENTSTACK_ENVIRONMENT || '',
     apiKey: process.env.CONTENTSTACK_API_KEY || '',
     previewUrl: process.env.CONTENTSTACK_PREVIEW_URL || 'https://rest-preview.contentstack.com',
+    rateLimit: {
+      // Set the maximum number of requests allowed per time window.
+      // Tries to read RATE_LIMIT_MAX from environment variables, falls back to 100 if not set or not a valid number.
+      max: parseInt(process.env.RATE_LIMIT_MAX || '100', 10) || 100,
+      timeWindow: process.env.RATE_LIMIT_TIME_WINDOW || '1 minute',
+    },
   },
 }; 

src/controllers/githubSyncController.ts

@@ -55,7 +55,7 @@ export const syncGithubRepoHandler = async (request: FastifyRequest<{ Body: Sync
     }
 
   } catch (error) {
-    request.log.error('Outer error in syncGithubRepoHandler:', error);
+    request.log.error('Outer error in syncGithubRepoHandler: %s', error instanceof Error ? error.message : String(error));
     reply.status(500);
     return {
       error: 'Failed to process sync request'

src/controllers/index.ts

@@ -48,17 +48,11 @@ const engine = livePreviewShopify.getLiquidEngine();
 export const getPreviewDataHandler = async (req: FastifyRequest<{ Body: PreviewDataRequestBody }>, res: FastifyReply) => {
     const { live_preview, ctUid, entryUid, locale, theme_variable } = req.body;
     const { liquid_path } = theme_variable;
-
-    console.log("🚀 ~ getPreviewDataHandler ~ live_preview:", live_preview)
-    console.log("🚀 ~ getPreviewDataHandler ~ ctUid:", ctUid)
-    console.log("🚀 ~ getPreviewDataHandler ~ entryUid:", entryUid)
-    console.log("🚀 ~ getPreviewDataHandler ~ theme_variable:", theme_variable)
 
     const entryData: { schema: FieldSchema, entry: Entry } = await livePreviewShopify.fetchData(ctUid, entryUid, live_preview, locale) as { schema: FieldSchema, entry: Entry };
-    console.log("🚀 ~ getPreviewDataHandler ~ entryData:", entryData)
     let shopifyData = { ...theme_variable?.payload };
 
-    const keyBasedCt = livePreviewShopify.createContentTypeKeyBased(entryData.schema);
+    const keyBasedCt = livePreviewShopify.createContentTypeKeyBased([entryData.schema]);
     const updatedEntry = entryData.entry;
 
     if (_.get(shopifyData, 'product.metafields.contentstack_products', null)) {
@@ -72,7 +66,9 @@ export const getPreviewDataHandler = async (req: FastifyRequest<{ Body: PreviewD
         const mappedShopifyData = await livePreviewShopify.getUpdatedMetaobject({ ...currentMetaobjects }, keyBasedCt, updatedEntry, { ctUid: ctUid, hash: live_preview });
         shopifyData.metaobjects = mappedShopifyData.currentMetaobjects;
     }
-
+    if(typeof liquid_path !== 'string') {
+        return res.status(400).send({ message: 'Invalid liquid path' });
+    }
     const liquidFilePath = liquid_path.replace(/\./g, "/");
     try {        
         const newRenderedData = await engine.renderFile(liquidFilePath, shopifyData);

src/controllers/viewsHealthController.ts

@@ -176,7 +176,7 @@ export const viewsHealthHandler = async (request: FastifyRequest, reply: Fastify
     return response;
 
   } catch (error) {
-    request.log.error('Error in viewsHealthHandler:', error);
+    request.log.error('Error in viewsHealthHandler: %s', error instanceof Error ? error.message : String(error));
 
     const response: ViewsHealthResponse = {
       status: 'error',

src/index.ts

@@ -1,5 +1,6 @@
 import { fastify, FastifyInstance } from 'fastify';
 import cors from '@fastify/cors';
+import rateLimit from '@fastify/rate-limit';
 import swagger from '@fastify/swagger';
 import swaggerUi from '@fastify/swagger-ui';
 import 'dotenv/config';
@@ -25,6 +26,17 @@ server.register(cors, {
   credentials: true,
 });
 
+// Register rate limiting to prevent resource exhaustion
+server.register(rateLimit, {
+  max: config.contentstack.rateLimit?.max || 100,           // Maximum 100 requests per window
+  timeWindow: config.contentstack.rateLimit?.timeWindow || '1 minute',
+  errorResponseBuilder: () => ({
+    statusCode: 429,
+    error: 'Too Many Requests',
+    message: 'Rate limit exceeded. Please try again later.',
+  }),
+});
+
 // Register Swagger
 server.register(swagger, {
   swagger: {