From 836c8bc6c0510f709aa5a4525e4c1a1daecc5cd8 Mon Sep 17 00:00:00 2001 From: =?utf8?q?J=C3=A9r=C3=B4me=20Benoit?= Date: Wed, 11 Feb 2026 16:44:05 +0100 Subject: [PATCH] feat(ui-server): add numberOfStations upper bound validation - Add validation check for numberOfStations parameter (max 100) - Import isValidNumberOfStations and DEFAULT_MAX_STATIONS from UIServerSecurity - Returns error message when numberOfStations exceeds limit - Addresses VULN-12: numberOfStations resource exhaustion --- .../ui-server/ui-services/AbstractUIService.ts | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/charging-station/ui-server/ui-services/AbstractUIService.ts b/src/charging-station/ui-server/ui-services/AbstractUIService.ts index 4bfbb1ba..4273e5df 100644 --- a/src/charging-station/ui-server/ui-services/AbstractUIService.ts +++ b/src/charging-station/ui-server/ui-services/AbstractUIService.ts @@ -23,6 +23,7 @@ import { import { Configuration, isAsyncFunction, isNotEmptyArray, logger } from '../../../utils/index.js' import { Bootstrap } from '../../Bootstrap.js' import { UIServiceWorkerBroadcastChannel } from '../../broadcast-channel/UIServiceWorkerBroadcastChannel.js' +import { DEFAULT_MAX_STATIONS, isValidNumberOfStations } from '../UIServerSecurity.js' const moduleName = 'AbstractUIService' @@ -229,6 +230,12 @@ export abstract class AbstractUIService { status: ResponseStatus.FAILURE, } satisfies ResponsePayload } + if (!isValidNumberOfStations(numberOfStations, DEFAULT_MAX_STATIONS)) { + return { + errorMessage: `Number of stations must be between 1 and ${String(DEFAULT_MAX_STATIONS)}`, + status: ResponseStatus.FAILURE, + } satisfies ResponsePayload + } if (!this.uiServer.hasChargingStationTemplates(template)) { return { errorMessage: `Template '${template}' not found`, -- 2.53.0