fixed some vulns

- fixed issue with config-safe-states

index.js

@@ -1,14 +1,14 @@
 const express = require("express");
 const fs = require("fs");
 const bodyParser = require("body-parser");
-const ws = require('ws');
+const ws = require("ws");
 const helper = require("./helpers.js");
-const loggy = require("./logging")
+const loggy = require("./logging");
 const Eta = require("eta");
-const _ = require("underscore")
+const _ = require("underscore");
-const path = require("path")
+const path = require("path");
 
-loggy.init(true)
+loggy.init(true);
 
 loggy.log("Preparing server", "info", "Server");
 const app = express();
@@ -27,25 +27,26 @@ app.use(
 
 // Allowed urls for requests to /assets/
 const allowsURLs = [
-  'bootstrap-icons/font/bootstrap-icons.css',
+  "bootstrap-icons/font/bootstrap-icons.css",
-  'js-cookie/dist/js.cookie.min.js',
+  "js-cookie/dist/js.cookie.min.js",
-  'bootstrap/dist/css/bootstrap.min.css',
+  "bootstrap/dist/css/bootstrap.min.css",
-  'mdbootstrap/css/style.css',
+  "mdbootstrap/css/style.css",
-  'bootstrap/dist/js/bootstrap.bundle.min.js',
+  "bootstrap/dist/js/bootstrap.bundle.min.js",
-  'jquery/dist/jquery.min.js',
+  "jquery/dist/jquery.min.js",
-  'darkreader/darkreader.js',
+  "darkreader/darkreader.js",
-  'bootstrap-duration-picker/dist/bootstrap-duration-picker.css',
+  "bootstrap-duration-picker/dist/bootstrap-duration-picker.css",
-  'flatpickr/dist/flatpickr.min.css',
+  "flatpickr/dist/flatpickr.min.css",
-  'bootstrap-duration-picker/dist/bootstrap-duration-picker-debug.js',
+  "bootstrap-duration-picker/dist/bootstrap-duration-picker-debug.js",
-  'flatpickr/dist/flatpickr.js',
+  "flatpickr/dist/flatpickr.js",
-  'bootstrap-icons/font/fonts/bootstrap-icons.woff2',
+  "bootstrap-icons/font/fonts/bootstrap-icons.woff2",
-  'bootstrap/dist/css/bootstrap.min.css.map',
+  "bootstrap/dist/css/bootstrap.min.css.map",
-  'less/dist/less.min.js',
+  "less/dist/less.min.js",
-  'less/dist/less.min.js.map',
+  "less/dist/less.min.js.map",
-  'mdbootstrap/js/mdb.min.js'
+  "mdbootstrap/js/mdb.min.js",
 ];
 
-let loadedData = {}
+let loadedData = {};
+let dataToBeWritten = {}
 
 loggy.log("Loading config", "info", "Config");
 if (fs.existsSync("data-persistence.json")) {
@@ -68,20 +69,27 @@ currentState = {
   showMessage: false,
   messageAppearTime: 0,
   showProgressbar: true,
-  colorSegments: { 40000: "yellow", 20000: "#FFAE00", 5000: "#ff0000", "START": "green" },
+  colorSegments: {
+    40000: "yellow",
+    20000: "#FFAE00",
+    5000: "#ff0000",
+    START: "green",
+  },
   textColors: {},
   srvTime: 0,
   enableColoredText: true,
   debug: false,
   enableOverrun: true,
-  sessionToken: Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15),
+  sessionToken:
+    Math.random().toString(36).substring(2, 15) +
+    Math.random().toString(36).substring(2, 15),
 };
 
 let configObject = {
   language: "en_uk",
-  port: 3000
+  port: 3000,
-}
+};
-if(!fs.existsSync("config.json")) {
+if (!fs.existsSync("config.json")) {
   fs.writeFileSync("config.json", "{}");
 }
 const tempJsonText = JSON.parse(fs.readFileSync("config.json", "utf8"));
@@ -89,9 +97,9 @@ configObject = _.extend(configObject, tempJsonText);
 fs.writeFileSync("config.json", JSON.stringify(configObject));
 
 currentState = Object.assign({}, currentState, loadedData);
-currentState.textColors = currentState.colorSegments
+currentState.textColors = currentState.colorSegments;
 
-loggy.log("Searching for languages", "info", "Language")
+loggy.log("Searching for languages", "info", "Language");
 const languagesRaw = fs.readdirSync("./lang");
 const languages = [];
 for (let i = 0; i < languagesRaw.length; i++) {
@@ -99,19 +107,19 @@ for (let i = 0; i < languagesRaw.length; i++) {
     languages.push(languagesRaw[i].replace(".json", ""));
   }
 }
-loggy.log("Found " + languages.length + " languages", "info", "Language")
+loggy.log("Found " + languages.length + " languages", "info", "Language");
 
-
+loggy.log("Reading language file", "info", "Language");
-
+let languageProfile = JSON.parse(
-loggy.log("Reading language file", "info", "Language")
+  fs.readFileSync("lang/" + configObject.language + ".json", "utf8")
-let languageProfile = JSON.parse(fs.readFileSync("lang/" + configObject.language + ".json", "utf8"));
+);
 
 loggy.log("Preparing websocket", "info", "Websocket");
 const wsServer = new ws.Server({ noServer: true });
-wsServer.on('connection', socket => {
+wsServer.on("connection", (socket) => {
-  socket.on('message', function incoming(data) {
+  socket.on("message", function incoming(data) {
     if (data.toString() == "new client") {
-      updatedData()
+      updatedData();
     }
   });
 });
@@ -127,7 +135,7 @@ wsServer.broadcast = function broadcast(data) {
 let updatey = undefined;
 
 function updatedData() {
-  currentState.srvTime = new Date().getTime()
+  currentState.srvTime = new Date().getTime();
   wsServer.broadcast(JSON.stringify(currentState));
   clearTimeout(updatey);
   setTimeout(updatedData, 5000);
@@ -141,18 +149,20 @@ app.get("/", function (req, res) {
       Eta.render(data, {
         lang: languageProfile,
         additional: {
-          languages: languages
+          languages: languages,
-        }
+        },
-      }));
+      })
+    );
   } catch (e) {
     loggy.log("Error rendering template", "error", "Server");
     const dataN = fs.readFileSync("templates/brokenTranslation.html", "utf8");
     res.send(
       Eta.render(dataN, {
         additional: {
-          languages: languages
+          languages: languages,
-        }
+        },
-      }));
+      })
+    );
   }
 });
 
@@ -164,10 +174,10 @@ app.get("/timer", function (req, res) {
 app.get("/timer-old", function (req, res) {
   const data = fs.readFileSync("templates/timerPage.html", "utf8");
   res.send(data);
-      });
+});
 
 app.get("/api/v1/data", function (req, res) {
-  currentState.srvTime = new Date().getTime()
+  currentState.srvTime = new Date().getTime();
   res.json(currentState);
 });
 
@@ -188,178 +198,181 @@ app.get("/api/v1/system", function (req, res) {
     nodeEnv: process.env,
     nodeConfig: process.config,
     nodeTitle: process.title,
-    systemVersion: tempPkgObj.version
+    systemVersion: tempPkgObj.version,
-  }
+  };
   res.json(systemData);
 });
 
-
 app.get("/api/v1/set/mode", function (req, res) {
   currentState.mode = req.query.mode;
-  updatedData()
+  updatedData();
   res.json({ status: "ok" });
 });
 
 app.get("/api/v1/set/layout/showMillis", function (req, res) {
-  const resy = helper.wrapBooleanConverter(req.query.show, res)
+  const resy = helper.wrapBooleanConverter(req.query.show, res);
   if (resy != undefined) {
     currentState.showMilliSeconds = resy;
-    if (req.query.persist === 'true') {
+    if (req.query.persist === "true") {
-      dataToBeWritten.showMilliSeconds = currentState.showMilliSeconds
+      dataToBeWritten.showMilliSeconds = currentState.showMilliSeconds;
     }
     res.json({ status: "ok" });
   }
-  updatedData()
+  updatedData();
-
 });
 
 app.get("/api/v1/set/timerGoal", function (req, res) {
   currentState.countdownGoal = new Date(parseInt(req.query.time)).getTime(); // ToDO error handling
   res.json({ status: "ok" });
-  updatedData()
+  updatedData();
 });
 
 app.get("/api/v1/set/addMillisToTimer", function (req, res) {
   currentState.timeAmountInital = req.query.time;
-  currentState.countdownGoal = new Date().getTime() + parseInt(req.query.time)
+  currentState.countdownGoal = new Date().getTime() + parseInt(req.query.time);
   currentState.pauseMoment = new Date().getTime();
   res.json({ status: "ok" });
-  updatedData()
+  updatedData();
 });
 
 app.get("/api/v1/set/relativAddMillisToTimer", function (req, res) {
-  currentState.timeAmountInital = req.query.time;
+	
-  currentState.countdownGoal = currentState.countdownGoal + parseInt(req.query.time)
+	currentState.timeAmountInital = parseInt(req.query.time) + parseInt(currentState.timeAmountInital);
-  currentState.pauseMoment = new Date().getTime();
+	currentState.countdownGoal = currentState.countdownGoal + parseInt(req.query.time);
+	// currentState.pauseMoment = new Date().getTime();
+	
 	res.json({ status: "ok" });
-  updatedData()
+	updatedData();
 });
 
 app.get("/api/v1/ctrl/timer/pause", function (req, res) {
   currentState.timerRunState = false;
   currentState.pauseMoment = new Date().getTime();
   res.json({ status: "ok" });
-  updatedData()
+  updatedData();
 });
 
 app.get("/api/v1/ctrl/timer/play", function (req, res) {
-
   if (currentState.timerRunState == false) {
-    currentState.timerRunState = true
+    currentState.timerRunState = true;
-    currentState.countdownGoal += new Date().getTime() - currentState.pauseMoment;
+    currentState.countdownGoal +=
+      new Date().getTime() - currentState.pauseMoment;
   }
   res.json({ status: "ok" });
-  updatedData()
+  updatedData();
 });
 
 app.get("/api/v1/ctrl/timer/restart", function (req, res) {
-  currentState.countdownGoal = new Date().getTime() + parseInt(currentState.timeAmountInital)
+  currentState.countdownGoal =
+    new Date().getTime() + parseInt(currentState.timeAmountInital);
   res.json({ status: "ok" });
-  updatedData()
+  updatedData();
 });
 
 app.get("/api/v1/set/layout/showTime", function (req, res) {
-  const resy = helper.wrapBooleanConverter(req.query.show, res)
+  const resy = helper.wrapBooleanConverter(req.query.show, res);
   if (resy != undefined) {
     currentState.showTimeOnCountdown = resy;
-    if (req.query.persist === 'true') {
+    if (req.query.persist === "true") {
-      dataToBeWritten.showTimeOnCountdown = currentState.showTimeOnCountdown
+      dataToBeWritten.showTimeOnCountdown = currentState.showTimeOnCountdown;
     }
     res.json({ status: "ok" });
   }
-  updatedData()
+  updatedData();
 });
 
 app.get("/api/v1/set/enableOverrun", function (req, res) {
-	const resy = helper.wrapBooleanConverter(req.query.enable, res)
+  const resy = helper.wrapBooleanConverter(req.query.enable, res);
   if (resy != undefined) {
     currentState.enableOverrun = resy;
-	  if (req.query.persist === 'true') {
+    if (req.query.persist === "true") {
-	    dataToBeWritten.enableOverrun = currentState.enableOverrun
+      dataToBeWritten.enableOverrun = currentState.enableOverrun;
     }
     res.json({ status: "ok" });
   }
-	updatedData()
+  updatedData();
-      });
+});
 
 app.get("/api/v1/set/progressbar/show", function (req, res) {
-  currentState.showProgressbar = (req.query.show === 'true');
+  currentState.showProgressbar = req.query.show === "true";
-  if (req.query.persist === 'true') {
+  if (req.query.persist === "true") {
-    dataToBeWritten.showProgressbar = currentState.showProgressbar
+    dataToBeWritten.showProgressbar = currentState.showProgressbar;
   }
   res.json({ status: "ok" });
-  updatedData()
+  updatedData();
 });
 
 app.get("/api/v1/set/progressbar/colors", function (req, res) {
   try {
-    let data = req.query.colors
+    let data = req.query.colors;
     if (req.query.isBase64 === "true") {
-      data = atob(data)
+	let buff = new Buffer(data, 'base64');
+	data = buff.toString('ascii');
     }
     currentState.colorSegments = JSON.parse(data);
-    if (req.query.persist === 'true') {
+    if (req.query.persist === "true") {
-      dataToBeWritten.colorSegments = currentState.colorSegments
+      dataToBeWritten.colorSegments = currentState.colorSegments;
     }
     res.json({ status: "ok" });
   } catch (error) {
     res.json({ status: "error", message: error });
-    console.error(error)
+    console.error(error);
   }
-  updatedData()
+  updatedData();
 });
 
 app.get("/api/v1/set/text/colors", function (req, res) {
   try {
     if (req.query.copy === "true") {
-      currentState.textColors = currentState.colorSegments
+      currentState.textColors = currentState.colorSegments;
       res.json({ status: "ok" });
     } else {
-      let data = req.query.colors
+      let data = req.query.colors;
       if (req.query.isBase64 === "true") {
-        data = atob(data)
+        let buff = new Buffer(data, 'base64');
+	let data = buff.toString('ascii');
       }
-      console.debug(data)
+      console.debug(data);
       currentState.textColors = JSON.parse(data);
-      if (req.query.persist === 'true') {
+      if (req.query.persist === "true") {
-        dataToBeWritten.textColors = currentState.textColors
+        dataToBeWritten.textColors = currentState.textColors;
       }
     }
     res.json({ status: "ok" });
   } catch (error) {
     res.json({ status: "error", message: error });
-    console.error(error)
+    console.error(error);
   }
-  updatedData()
+  updatedData();
 });
 
 app.get("/api/v1/set/text/enableColoring", function (req, res) {
-  currentState.enableColoredText = (req.query.enable === 'true');
+  currentState.enableColoredText = req.query.enable === "true";
-  if (req.query.persist === 'true') {
+  if (req.query.persist === "true") {
-    dataToBeWritten.enableColoredText = currentState.enableColoredText
+    dataToBeWritten.enableColoredText = currentState.enableColoredText;
   }
   res.json({ status: "ok" });
-  updatedData()
+  updatedData();
 });
 
 app.get("/api/v1/ctrl/message/show", function (req, res) {
-  currentState.message = req.query.msg
+  currentState.message = req.query.msg;
-  currentState.showMessage = true
+  currentState.showMessage = true;
-  currentState.messageAppearTime = new Date().getTime()
+  currentState.messageAppearTime = new Date().getTime();
   res.json({ status: "ok" });
-  updatedData()
+  updatedData();
 });
 
 app.get("/api/v1/debug", function (req, res) {
-  currentState.debug = (req.query.enable === 'true');
+  currentState.debug = req.query.enable === "true";
   res.json({ status: "ok" });
-  updatedData()
+  updatedData();
 });
 
 app.get("/api/v1/ctrl/message/hide", function (req, res) {
-  currentState.showMessage = false
+  currentState.showMessage = false;
   res.json({ status: "ok" });
-  updatedData()
+  updatedData();
 });
 
 app.get("/api/v1/storage/commit", function (req, res) {
@@ -370,10 +383,9 @@ app.get("/api/v1/storage/commit", function (req, res) {
   } catch (error) {
     res.json({ status: "error", reason: error });
   }
-  updatedData()
+  updatedData();
 });
 
-
 app.get("/api/v1/storage/delete", function (req, res) {
   if (req.query.delete === "true") {
     if (fs.existsSync("data-persistence.json")) {
@@ -382,91 +394,113 @@ app.get("/api/v1/storage/delete", function (req, res) {
     } else {
       res.json({ status: "error", reason: "No persistence data was found" });
     }
-
   } else {
-
+  }
-  } res.json({ status: "error", reason: "Missing delete argument" });
+  res.json({ status: "error", reason: "Missing delete argument" });
-  updatedData()
+  updatedData();
 });
 
 // UI Routes
 // Returns an object containg all available languages
-app.get("/api/ui/v1/lang/list", function handleLangList(req, res){
+app.get("/api/ui/v1/lang/list", function handleLangList(req, res) {
   const tempRespObject = {
     status: "ok",
-    languages: languages
+    languages: languages,
-  }
+  };
   res.json(tempRespObject);
-})
+});
 
 app.get("/api/ui/v1/lang/set", function (req, res) {
-  if(req.query.lang == undefined || req.query.lang == ""){
+  if (req.query.lang == undefined || req.query.lang == "") {
     res.json({ status: "error", reason: "Missing language" });
     return;
   }
   const testLang = req.query.lang;
-  loggy.log("Reloading language file", "info", "Language")
+  loggy.log("Reloading language file", "info", "Language");
-  if(!fs.existsSync("lang/" + testLang + ".json")){
+  if (!fs.existsSync("lang/" + testLang + ".json")) {
-    loggy.log("Language reload failed, file does not exist", "error", "Language")
+    loggy.log(
-    res.status(500).json({ status: "error", reason: "Language file not found" });
+      "Language reload failed, file does not exist",
-    return
+      "error",
+      "Language"
+    );
+    res
+      .status(500)
+      .json({ status: "error", reason: "Language file not found" });
+    return;
   }
   const tempLang = fs.readFileSync("lang/" + testLang + ".json", "utf8");
   const tempLangObj = helper.tryToParseJson(tempLang);
-  if(!tempLangObj){
+  if (!tempLangObj) {
-    loggy.log("Language reload failed, file is not valid", "error", "Language")
+    loggy.log("Language reload failed, file is not valid", "error", "Language");
-    res.status(500).json({ status: "error", reason: "Language file is not valid" });
+    res
-    return
+      .status(500)
+      .json({ status: "error", reason: "Language file is not valid" });
+    return;
   }
-  if(tempLangObj._metadata == undefined){
+  if (tempLangObj._metadata == undefined) {
-    loggy.log("Language reload failed, file is not valid, metadata missing", "error", "Language")
+    loggy.log(
-    res.status(500).json({ status: "error", reason: "Language file is not valid" });
+      "Language reload failed, file is not valid, metadata missing",
-    return
+      "error",
+      "Language"
+    );
+    res
+      .status(500)
+      .json({ status: "error", reason: "Language file is not valid" });
+    return;
   }
-  loggy.log("Language reloaded, loaded " + tempLangObj._metadata.lang + "@" + tempLangObj._metadata.version, "info", "Language")
+  loggy.log(
+    "Language reloaded, loaded " +
+      tempLangObj._metadata.lang +
+      "@" +
+      tempLangObj._metadata.version,
+    "info",
+    "Language"
+  );
   configObject.language = req.query.lang;
   languageProfile = tempLangObj;
   res.status(200).json({ status: "ok" });
   fs.writeFileSync("config.json", JSON.stringify(configObject));
 });
 
-
 app.use("/assets/*", function handleModuleFiles(req, res) {
-  if(allowsURLs.indexOf(req.params[0]) > -1){
+  if (allowsURLs.indexOf(req.params[0]) > -1) {
     res.sendFile(path.join(__dirname, "node_modules", req.params[0]));
   } else {
-    loggy.log("Attempt to access restricted asset file " + req.params[0], "error", "Security")
+    loggy.log(
-    res.status(403).json({ status: "error", reason: "Access to restricted asset file denied" });
+      "Attempt to access restricted asset file " + req.params[0],
+      "error",
+      "Security"
+    );
+    res.status(403).json({
+      status: "error",
+      reason: "Access to restricted asset file denied",
+    });
   }
   // console.log(recordedURLs)
-})
+});
 
 app.use(function (req, res, next) {
   res.status(404);
   loggy.log("Server responded with 404 error", "warn", "Server", true);
 
   // respond with html page
-  if (req.accepts('html')) {
+  if (req.accepts("html")) {
     const data = fs.readFileSync("templates/errorPages/404.html", "utf8");
-    res.status(404)
+    res.status(404);
     res.send(data);
     return;
   }
 
   // respond with json
-  if (req.accepts('json')) {
+  if (req.accepts("json")) {
-    res.json({ error: 'Not found' });
+    res.json({ error: "Not found" });
     return;
   }
 
   // default to plain-text. send()
-  res.type('txt').send('Not found');
+  res.type("txt").send("Not found");
 });
 
-
-
-
-
 /*app.use(function(err, req, res, next) {
   console.error(err.stack);
   if(String(err.stack).includes("TypeError: Cannot read properties of undefined")) {
@@ -478,30 +512,41 @@ app.use(function (req, res, next) {
  
 });*/
 
-
-
 loggy.log("Starting server", "info", "Server");
 
 const port = configObject.port;
 
-process.on('SIGINT', function () {
+process.on("SIGINT", function () {
-  loggy.log("Caught interrupt signal and shutting down gracefully", "info", "Shutdown");
+  loggy.log(
+    "Caught interrupt signal and shutting down gracefully",
+    "info",
+    "Shutdown"
+  );
   server.close(); // Make the express server stop
-  loggy.log("Goodbye! 👋", "magic", "Shutdown", true)
+  loggy.log("Goodbye! 👋", "magic", "Shutdown", true);
   loggy.close(); // Close and write log
   process.exit(); // Quit the application
 });
 
 const server = app.listen(port);
-server.on('upgrade', (request, socket, head) => {
+server.on("upgrade", (request, socket, head) => {
-  wsServer.handleUpgrade(request, socket, head, socket => {
+  wsServer.handleUpgrade(request, socket, head, (socket) => {
-    wsServer.emit('connection', socket, request);
+    wsServer.emit("connection", socket, request);
   });
 });
 
-
 loggy.log("=======================", "info", "", true);
 loggy.log("Server running on port " + port, "magic", "", true);
-loggy.log("Visit http://localhost:" + port + "/timer for the timer view", "magic", "", true);
+loggy.log(
-loggy.log("Visit http://localhost:" + port + " for the admin view", "magic", "", true);
+  "Visit http://localhost:" + port + "/timer for the timer view",
+  "magic",
+  "",
+  true
+);
+loggy.log(
+  "Visit http://localhost:" + port + " for the admin view",
+  "magic",
+  "",
+  true
+);
 loggy.log("=======================", "info", "", true);

package.json

@@ -10,26 +10,26 @@
 	"author": "TheGreydiamond",
 	"license": "LGPL-3.0",
 	"dependencies": {
-		"body-parser": "^1.20.1",
+		"body-parser": "^1.20.2",
-		"bootstrap": "^5.2.2",
+		"bootstrap": "^5.3.1",
 		"bootstrap-duration-picker": "^2.1.3",
-		"bootstrap-icons": "^1.10.1",
+		"bootstrap-icons": "^1.10.5",
 		"colors": "^1.4.0",
 		"darkreader": "^4.9.58",
-		"eta": "^1.12.3",
+		"eta": "^1.14.2",
-		"express": "^4.18.2",
+		"express": "^4.19.2",
 		"flatpickr": "^4.6.13",
-		"jquery": "^3.6.1",
+		"jquery": "^3.7.0",
 		"js-cookie": "^3.0.1",
 		"less": "^4.1.3",
 		"mdbootstrap": "^4.20.0",
 		"open": "^8.4.0",
 		"underscore": "^1.13.6",
-		"ws": "^8.11.0"
+		"ws": "^8.18.0"
 	},
 	"devDependencies": {
-		"electron": "^21.2.3",
+		"electron": "^25.9.8",
-		"electron-builder": "^23.6.0"
+		"electron-builder": "^24.6.3"
 	},
 	"build": {
 		"extraMetadata": {