fix for reported vulnerability in restore process - CVE still being issued

Author: CyferShepard

backend/routes/backup.js

@@ -16,17 +16,30 @@ const { sendUpdate } = require("../ws");
 const router = express.Router();
 const TaskManager = require("../classes/task-manager-singleton");
 const TaskScheduler = require("../classes/task-scheduler-singleton");
+const { tables } = require("../global/backup_tables");
 
 // Database connection parameters
 const postgresUser = process.env.POSTGRES_USER;
 const postgresPassword = process.env.POSTGRES_PASSWORD;
 const postgresIp = process.env.POSTGRES_IP;
 const postgresPort = process.env.POSTGRES_PORT;
 const postgresDatabase = process.env.POSTGRES_DB || "jfstat";
-const postgresSslRejectUnauthorized = process.env.POSTGRES_SSL_REJECT_UNAUTHORIZED === undefined ? true : process.env.POSTGRES_SSL_REJECT_UNAUTHORIZED === "true";
+const postgresSslRejectUnauthorized =
+  process.env.POSTGRES_SSL_REJECT_UNAUTHORIZED === undefined ? true : process.env.POSTGRES_SSL_REJECT_UNAUTHORIZED === "true";
 
 const backupfolder = "backup-data";
 
+// table mappers
+const jf_libraries = require("../models/jf_libraries");
+const jf_library_items = require("../models/jf_library_items");
+const jf_library_seasons = require("../models/jf_library_seasons");
+const jf_library_episodes = require("../models/jf_library_episodes");
+const jf_users = require("../models/jf_users");
+const jf_playback_activity = require("../models/jf_playback_activity");
+const jf_playback_reporting_plugin_data = require("../models/jf_playback_reporting_plugin_data");
+const jf_item_info = require("../models/jf_item_info");
+//
+const db = require("../db");
 // Restore function
 
 function readFile(path) {
@@ -63,16 +76,49 @@ function getBirthtimeFallback(fileStats, fileName) {
   // 2digits('-' or ':')2digits('-' or ':')2digits
   const regexp = /(\d{4})-(\d{2})-(\d{2})[ _T](\d{2})[-:](\d{2})[-:](\d{2})/;
   const matches = fileName.match(regexp);
-  if (!matches)
-    return null;
+  if (!matches) return null;
 
   // Verify that each regex match is a valid number
-  for (var i=1; i<7; i++) {
-    if (Number.isNaN(Number(matches[i])))
+  for (var i = 1; i < 7; i++) {
+    if (Number.isNaN(Number(matches[i]))) return null;
+  }
+
+  return new Date(matches[1], matches[2] - 1, matches[3], matches[4], matches[5], matches[6]);
+}
+
+function getTableColumns(tableName) {
+  switch (tableName) {
+    case "jf_libraries":
+      return jf_libraries.jf_libraries_columns;
+    case "jf_library_items":
+      return jf_library_items.jf_library_items_columns;
+    case "jf_library_seasons":
+      return jf_library_seasons.jf_library_seasons_columns;
+    case "jf_library_episodes":
+      return jf_library_episodes.jf_library_episodes_columns;
+    case "jf_users":
+      return jf_users.jf_users_columns;
+    case "jf_playback_activity":
+      return jf_playback_activity.columnsPlayback;
+    case "jf_playback_reporting_plugin_data":
+      return jf_playback_reporting_plugin_data.columnsPlaybackReporting;
+    case "jf_item_info":
+      return jf_item_info.jf_item_info_columns;
+    default:
       return null;
   }
+}
 
-  return new Date(matches[1], matches[2]-1, matches[3], matches[4], matches[5], matches[6]);
+//fixes Bulk insert error: error: column "Genres" is of type jsonb but expression is of type text[]
+function formatData(data) {
+  if (!Array.isArray(data)) return data;
+  return data.map((row) => {
+    const formatted = {};
+    for (const [key, value] of Object.entries(row)) {
+      formatted[key] = Array.isArray(value) ? JSON.stringify(value) : value;
+    }
+    return formatted;
+  });
 }
 
 async function restore(file, refLog) {
@@ -81,17 +127,6 @@ async function restore(file, refLog) {
     color: "yellow",
     Message: "Restoring from Backup: " + file,
   });
-  const pool = new Pool({
-    user: postgresUser,
-    password: postgresPassword,
-    host: postgresIp,
-    port: postgresPort,
-    database: postgresDatabase,
-    ...(process.env.POSTGRES_SSL_ENABLED === "true"
-      ? { ssl: { rejectUnauthorized: postgresSslRejectUnauthorized } }
-      : {}),
-  });
-
   const backupPath = file;
 
   let jsonData;
@@ -102,7 +137,6 @@ async function restore(file, refLog) {
   } catch (err) {
     refLog.logData.push({
       color: "red",
-      key: tableName,
       Message: `Failed to read backup file`,
     });
     Logging.updateLog(refLog.uuid, refLog.logData, taskstate.FAILED);
@@ -114,38 +148,60 @@ async function restore(file, refLog) {
     console.log("No Data");
     return;
   }
+  const allowList = tables.map((table) => table.value);
 
+  // Perform bulk, parameterized inserts per table to improve performance
   for (let table of jsonData) {
     const data = Object.values(table)[0];
     const tableName = Object.keys(table)[0];
+
+    if (!allowList.includes(tableName)) {
+      refLog.logData.push({
+        color: "red",
+        Message: `Table ${tableName} is not allowed to be restored`,
+      });
+      continue;
+    }
+
+    const tableColumns = getTableColumns(tableName);
+    if (!tableColumns) {
+      refLog.logData.push({
+        color: "red",
+        Message: `No columns found for table ${tableName}`,
+      });
+      continue;
+    }
+
     refLog.logData.push({
       color: "dodgerblue",
       key: tableName,
       Message: `Restoring ${tableName}`,
     });
-    for (let index in data) {
-      const keysWithQuotes = Object.keys(data[index]).map((key) => `"${key}"`);
-      const keyString = keysWithQuotes.join(", ");
-
-      const valuesWithQuotes = Object.values(data[index]).map((col) => {
-        if (col === null) {
-          return "NULL";
-        } else if (typeof col === "string") {
-          return `'${col.replace(/'/g, "''")}'`;
-        } else if (typeof col === "object") {
-          return `'${JSON.stringify(col).replace(/'/g, "''")}'`;
-        } else {
-          return `'${col}'`;
-        }
-      });
 
-      const valueString = valuesWithQuotes.join(", ");
+    if (data.length == 0) {
+      refLog.logData.push({
+        color: "yellow",
+        key: tableName,
+        Message: `No data to restore for ${tableName}`,
+      });
+      continue;
+    }
+    let result = await db.insertBulk(tableName, formatData(data), tableColumns);
 
-      const query = `INSERT INTO ${tableName} (${keyString}) VALUES(${valueString})  ON CONFLICT DO NOTHING`;
-      const { rows } = await pool.query(query);
+    if (result.Result === "SUCCESS") {
+      refLog.logData.push({
+        color: "lawngreen",
+        key: tableName,
+        Message: `Restored ${data.length} rows to ${tableName}`,
+      });
+    } else {
+      refLog.logData.push({
+        color: "red",
+        key: tableName,
+        Message: `Failed to restore ${tableName}: ${result.message}`,
+      });
     }
   }
-  await pool.end();
   refLog.logData.push({ color: "lawngreen", Message: "Restore Complete" });
 }
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "jfstat",
-  "version": "1.1.11",
+  "version": "1.1.12",
   "private": true,
   "main": "src/index.jsx",
   "scripts": {