fix security warnings in RegEx code

Taraman17 · Oct 24, 2023 · f58cf5e · f58cf5e
1 parent 5d9af4c
commit f58cf5e
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/README.MD b/README.MD
@@ -1,4 +1,7 @@
 # CS2 Server Control with a Nodejs-powered web-API (LINUX only)
+this API is used to start/stop/update a CS2 linux dedicated server and control it via rcon.
+The backend accepts RESTful api calls authenticated either via steamID or a configurable user with hppt authentication for stateless API calls.
+A full featured example webinterface is provided to get a quick start on the application.
 
 ## Disclaimer
 The use of this software is at your own risk.

diff --git a/modules/logreceive.js b/modules/logreceive.js
@@ -84,21 +84,21 @@ router.post('/log', (req, res) => {
                 if (cfg.script('matchEnd') != '') {
                     exec(cfg.script('matchEnd'));
                 }
-            } else if (/\".+<\d+><\[U:\d:\d+\]>/.test(line)) {
+            } else if (/\".{1,32}<\d{1,3}><\[\w:\d:\d{1,10}\]>/.test(line)) {
                 // Player join or teamchange.
                 // 10/12/2023 - 16:06:38: "[Klosser] Taraman<2><[U:1:12610374]><>" entered the game
                 // 10/12/2023 - 18:57:47: "[Klosser] Taraman<2><[U:1:12610374]>" switched from team <Unassigned> to <CT>
                 // 10/12/2023 - 18:59:25: "[Klosser] Taraman<2><[U:1:12610374]>" switched from team <TERRORIST> to <Spectator>
                 // 10/16/2023 - 16:31:59.699 - "[Klosser] Taraman<2><[U:1:12610374]><CT>" disconnected (reason "NETWORK_DISCONNECT_DISCONNECT_BY_USER")
-                let rex = /\"(.+)<\d+><\[(U:\d+:\d+)\]></g;
+                let rex = /\"(.{1,32})<\d{1,3}><\[(\w:\d:\d{1,10})\]></g;
                 let matches = rex.exec(line);
                 if (line.indexOf('entered the game') != -1) {
                     serverInfo.addPlayer({ 'name': matches[1], 'steamID': matches[2] });
                 } else if (line.search(/disconnected \(reason/) != -1) {
                     logger.debug(line);
                     serverInfo.removePlayer(matches[2]);
                 } else if (line.indexOf('switched from team') != -1) {
-                    rex = /<\[(U:\d+:\d+)\]>.*switched from team <\S+> to <(\S+)>/g;
+                    rex = /<\[(\w:\d:\d{1,10})\]>\" switched from team <\S{1,10}> to <(\S{1,10})>/g;
                     matches = rex.exec(line);
                     serverInfo.assignPlayer(matches[1], matches[2]);
                 }