From: Jérôme Benoit <jerome.benoit@sap.com>
Date: Wed, 11 Feb 2026 15:44:05 +0000 (+0100)
Subject: feat(ui-server): add numberOfStations upper bound validation
X-Git-Tag: ocpp-server@v2.3.0~10
X-Git-Url: https://git.piment-noir.org/?a=commitdiff_plain;h=836c8bc6c0510f709aa5a4525e4c1a1daecc5cd8;p=e-mobility-charging-stations-simulator.git

feat(ui-server): add numberOfStations upper bound validation

- Add validation check for numberOfStations parameter (max 100)
- Import isValidNumberOfStations and DEFAULT_MAX_STATIONS from UIServerSecurity
- Returns error message when numberOfStations exceeds limit
- Addresses VULN-12: numberOfStations resource exhaustion
---

diff --git a/src/charging-station/ui-server/ui-services/AbstractUIService.ts b/src/charging-station/ui-server/ui-services/AbstractUIService.ts
index 4bfbb1ba..4273e5df 100644
--- a/src/charging-station/ui-server/ui-services/AbstractUIService.ts
+++ b/src/charging-station/ui-server/ui-services/AbstractUIService.ts
@@ -23,6 +23,7 @@ import {
 import { Configuration, isAsyncFunction, isNotEmptyArray, logger } from '../../../utils/index.js'
 import { Bootstrap } from '../../Bootstrap.js'
 import { UIServiceWorkerBroadcastChannel } from '../../broadcast-channel/UIServiceWorkerBroadcastChannel.js'
+import { DEFAULT_MAX_STATIONS, isValidNumberOfStations } from '../UIServerSecurity.js'
 
 const moduleName = 'AbstractUIService'
 
@@ -229,6 +230,12 @@ export abstract class AbstractUIService {
         status: ResponseStatus.FAILURE,
       } satisfies ResponsePayload
     }
+    if (!isValidNumberOfStations(numberOfStations, DEFAULT_MAX_STATIONS)) {
+      return {
+        errorMessage: `Number of stations must be between 1 and ${String(DEFAULT_MAX_STATIONS)}`,
+        status: ResponseStatus.FAILURE,
+      } satisfies ResponsePayload
+    }
     if (!this.uiServer.hasChargingStationTemplates(template)) {
       return {
         errorMessage: `Template '${template}' not found`,