iobroker-community-adapters/ioBroker.telegram

Web server does not respond with 404 when requesting an invalid URL (i.e. not POST, no token)

Closed this issue · 4 comments

agross commented

Describe the bug
I run the adapter in server mode and have Uptime Kuma monitor the adapter's HTTP endpoint by requesting the root URL, e. g. GET http://telegram.example.com

With 3.2.1 the web server will respond HTTP/404 with 404: Resource Not Found in the body.

With 3.3.0 the request will timeout in Uptime Kuma (the timeout is enforced by Uptime Kuma).

If you use curl with 3.3.0, then the request will never timeout. I consider this a security issue since you could bind unlimited resources by issuing requests to the root URL.

To Reproduce
Steps to reproduce the behavior:

  1. Install 3.3.0 or 3.3.1
  2. Configure the adapter to run in server mode
  3. curl the root URL

Expected behavior
404 as before

Versions:

  • Adapter version: 3.3.0
  • JS-Controller version: 5.0.19
  • Node version: 18
  • Operating system: docker
mcm1957 commented

@Apollon77
@foxriver76
@GermanBluefox

I guess this could be a sideeffect of the required change to @iobroker/webserver. Please check.

foxriver76 commented

Should be fixed now on master @mcm1957

agross commented

Confirmed. Thank you!

mcm1957 commented

fixed with 3.3.2

3.3.2 is available at npm and should be available at LATEST repository very soon.