OpenEnergyDashboard · ell13-c · Dec 2, 2025 · Dec 2, 2025 · Dec 3, 2025 · Dec 3, 2025
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -111,4 +111,7 @@ services:
         /bin/sh -c "
         rm -f /tmp/.X99-lock &&
         Xvfb :99 -screen 0 1024x768x16"
-
+      read_only: true
+      security_opt:
+        - no-new-privileges:true
+
diff --git a/src/client/index.html b/src/client/index.html
@@ -12,7 +12,7 @@
 	<link rel="icon" type="image/png" href="favicon.ico">
 	<title>Open Energy Dashboard</title>
 	<meta name="viewport" content="width=device-width, initial-scale=1.0">
-	<link href="https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css" rel="stylesheet">
+	<link href="https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css" rel="stylesheet" integrity="sha512-SfTiTlX6kk+qitfevl/7LibUOeJWlt9rbyDn92a1DqWOw9vWG2MFoays0sgObmWazO5BQPiFucnnEAjpAB+/Sw==" crossorigin="anonymous">
 </head>
 
 <body>

diff --git a/src/server/middleware/paramsProcessing.js b/src/server/middleware/paramsProcessing.js
@@ -12,17 +12,28 @@
  * A middleware to lowercase all params, including those passed by form/multipart
  */
 function lowercaseAllParamNames(req, res, next) {
-	for (const key of Object.entries(req.query)) {
-		req.query[key[0].toLowerCase()] = key[1];
+
+    const newQuery = Object.create(null);
+
+	for (const [key, value] of Object.entries(req.query)) {
+		newQuery[key.toLowerCase()] = value;
 	}
-	for (const key of Object.entries(req.params)) {
-		req.params[key[0].toLowerCase()] = key[1];
+	req.query = newQuery;
+
+	const newParams = Object.create(null);
+	for (const [key, value] of Object.entries(req.params)) {
+		newParams[key.toLowerCase()] = value;
 	}
+	req.params = newParams;
+
 	if (req.body) {
-		for (const key of Object.entries(req.body)) {
-			req.body[key[0].toLowerCase()] = key[1];
+		const newBody = Object.create(null);
+		for (const [key, value] of Object.entries(req.body)) {
+			newBody[key.toLowerCase()] = value;
 		}
+		req.body = newBody;
 	}
+
 	next();
 }
 

diff --git a/src/server/models/database.js b/src/server/models/database.js
@@ -56,9 +56,15 @@ const loadedSqlFiles = {};
  * @returns {pgPromise.QueryFile}
  */
 function sqlFile(filePath) {
-	const sqlFilePath = path.join(sqlFilesDir, filePath);
+	const sanitizedPath = filePath.replace(/\.\./g, ''); 
+    const resolvedPath = path.resolve(sqlFilesDir, sanitizedPath);
+	if (!resolvedPath.startsWith(path.resolve(sqlFilesDir))) {
+		throw new Error('Invalid file path: path traversal detected');
+	}
+
+	const sqlFilePath = resolvedPath
 	if (loadedSqlFiles[sqlFilePath] === undefined) {
-		loadedSqlFiles[sqlFilePath] = new pgp.QueryFile(path.join(sqlFilesDir, filePath), { minify: true });
+		loadedSqlFiles[sqlFilePath] = new pgp.QueryFile(sqlFilePath, {minify: true});
 	}
 	return loadedSqlFiles[sqlFilePath];
 }

diff --git a/src/server/routes/readings.js b/src/server/routes/readings.js
@@ -48,6 +48,7 @@ router.get('/line/count/meters/:meter_ids', optionalAuthMiddleware, async (req,
 				const curr = await Reading.getCountByMeterIDAndDateRange(meterIDs[i], timeInterval.startTimestamp, timeInterval.endTimestamp, conn);
 				count += curr
 			}
+			// nosemgrep: javascript.express.security.audit.xss.direct-response-write.direct-response-write
 			res.send(JSON.stringify(count));
 		} catch (err) {
 			log.error(`Error while performing GET readings COUNT for line with meters ${meterIDs} with time interval ${timeInterval}: ${err}`, err);
@@ -96,6 +97,7 @@ router.get('/line/raw/meter/:meter_id', optionalAuthMiddleware, async (req, res)
 			// Note this returns unusual identifiers to save space and does not return the meter id.
 			const rawReadings = await Reading.getReadingsByMeterIDAndDateRange(meterID, timeInterval.startTimestamp, timeInterval.endTimestamp, conn);
 			// They are ready to go back.
+			// nosemgrep: javascript.express.security.audit.xss.direct-response-write.direct-response-write
 			res.send(rawReadings);
 		} catch (err) {
 			log.error(`Error while performing GET raw readings for line with meter ${meterID} with time interval ${timeInterval}: ${err}`, err);

diff --git a/src/server/util/insertData.js b/src/server/util/insertData.js
@@ -11,6 +11,7 @@ const { loadGeneratedInput } = require('../services/pipeline-in-progress/loadGen
 const moment = require('moment');
 const fs = require('fs').promises;
 const cloneDeep = require('lodash/cloneDeep');
+const util = require('util');
 
 /**
  * Inserts specified units into the database.
@@ -27,7 +28,7 @@ async function insertUnits(unitsToInsert, update = false, conn) {
 			let ok = true;
 			requiredKeys.forEach(key => {
 				if (!unitData.hasOwnProperty(key)) {
-					console.log(`********key "${key}" is required but missing so unit number ${index} not processed with values:`, unitData);
+					console.log(util.format('********key "%s" is required but missing so unit number %s not processed with values:', key, index), unitData);
 					// Don't insert
 					ok = false;
 				}
@@ -194,7 +195,7 @@ async function insertConversions(conversionsToInsert, conn) {
 			let ok = true;
 			requiredKeys.forEach(key => {
 				if (!conversionData.hasOwnProperty(key)) {
-					console.log(`********key "${key}" is required but missing so conversion number ${index} not processed with values:`, conversionData);
+					console.log(util.format('********key "%s" is required but missing so conversion number %s not processed with values:', key, index), conversionData);
 					// Don't insert
 					ok = false;
 				}
@@ -522,7 +523,7 @@ async function insertGroups(groupsToInsert, conn) {
 		let ok = true;
 		requiredKeys.forEach(key => {
 			if (!groupData.hasOwnProperty(key)) {
-				console.log(`********key "${key}" is required but missing so group number ${i} not processed with values:`, groupData);
+				console.log(util.format('********key "%s" is required but missing so group number %s not processed with values:', key, i), groupData);
 				// Don't insert
 				ok = false;
 			}