feat(ui-server): add numberOfStations upper bound validation

- Add validation check for numberOfStations parameter (max 100)
- Import isValidNumberOfStations and DEFAULT_MAX_STATIONS from UIServerSecurity
- Returns error message when numberOfStations exceeds limit
- Addresses VULN-12: numberOfStations resource exhaustion

diff --git a/src/charging-station/ui-server/ui-services/AbstractUIService.ts b/src/charging-station/ui-server/ui-services/AbstractUIService.ts
index 4bfbb1ba999de166173a6bd5b15ea8ee5efccc61..4273e5dfc7a733273f5efd7272ccbba2c129e24f 100644 (file)
--- a/src/charging-station/ui-server/ui-services/AbstractUIService.ts
+++ b/src/charging-station/ui-server/ui-services/AbstractUIService.ts
@@ -23,6 +23,7 @@ import {
 import { Configuration, isAsyncFunction, isNotEmptyArray, logger } from '../../../utils/index.js'
 import { Bootstrap } from '../../Bootstrap.js'
 import { UIServiceWorkerBroadcastChannel } from '../../broadcast-channel/UIServiceWorkerBroadcastChannel.js'
+import { DEFAULT_MAX_STATIONS, isValidNumberOfStations } from '../UIServerSecurity.js'
 
 const moduleName = 'AbstractUIService'
 
@@ -229,6 +230,12 @@ export abstract class AbstractUIService {
         status: ResponseStatus.FAILURE,
       } satisfies ResponsePayload
     }
+    if (!isValidNumberOfStations(numberOfStations, DEFAULT_MAX_STATIONS)) {
+      return {
+        errorMessage: `Number of stations must be between 1 and ${String(DEFAULT_MAX_STATIONS)}`,
+        status: ResponseStatus.FAILURE,
+      } satisfies ResponsePayload
+    }
     if (!this.uiServer.hasChargingStationTemplates(template)) {
       return {
         errorMessage: `Template '${template}' not found`,