updated npm modules for server

anms-core/anms/shared/config.py

@@ -154,7 +154,7 @@ class BaseConfig(AbstractConfig):
     OPENSEARCH_HOST = 'opensearch'
     OPENSEARCH_PORT = 9200
     OPENSEARCH_AUTH_USERNAME = 'admin'
-    OPENSEARCH_AUTH_PASSWORD = 'admin'
+    OPENSEARCH_AUTH_PASSWORD = os.environ.get('OPENSEARCH_INITIAL_ADMIN_PASSWORD')
     # OPENSEARCH_CA_CERTS = '/full/path/to/root-ca.pem' Provide a CA bundle if you use intermediate CAs with root CA.
     # Optional client certificates if you don't want to use HTTP basic authentication.
     # OPENSEARCH_CLIENT_CERT_PATH = '/full/path/to/client.pem'

anms-ui/server/clients/redisClient.js

@@ -37,19 +37,21 @@
     if (!config.redis.enabled) {
       return BPromise.reject(new Error('Redis not Enabled'));
     }
-
-    BPromise.promisifyAll(redis);
+    if (!URL.canParse(config.redis.parsedUri)) {
+      return BPromise.reject(new Error('Redis URL is invalid'));
+    }
 
     return new BPromise(function (resolve, reject) {
 
-      const redisClient = redis.createClient(config.redis.parsedUri, config.redis.opts);
+      const redisClient = redis.createClient({url: config.redis.parsedUri});
 
       redisClient.on('ready', onReady);
       redisClient.on('connect', onConnect);
       redisClient.on('reconnecting', onReconnecting);
       redisClient.on('warning', onWarning);
       redisClient.on('error', onError);
       redisClient.on('end', onEnd);
+      redisClient.connect().catch(onError);
 
       function onReady() {
         logger.info('Redis Ready');
@@ -84,4 +86,3 @@
   }
 
 })();
-

anms-ui/server/components/core.js

@@ -20,8 +20,6 @@
  * subcontract 1658085.
  */
 
-const { ReplyError } = require('redis');
-
 (function () {
   'use strict';
 
@@ -42,4 +40,4 @@ const { ReplyError } = require('redis');
       return next(Boom.badGateway('Error talking to CORE', err));
     }
   }
-})();
+})();

anms-ui/server/core/express.js

@@ -47,7 +47,7 @@
   const errorHandler = require('errorhandler');
   const cookieParser = require('cookie-parser');
   const methodOverride = require('method-override');
-  const RedisStore = require('connect-redis')(session);
+  const { RedisStore } = require('connect-redis');
   const expressEnforcesSSL = require('express-enforces-ssl');
 
   const routes = require('./routes');
@@ -63,6 +63,14 @@
     app.disable('x-powered-by');
     app.use(helmet({
       hsts: false,
+      // The Angular production build uses an inline onload handler to switch
+      // the deferred stylesheet from media="print" to media="all".
+      contentSecurityPolicy: {
+        directives: {
+          ...helmet.contentSecurityPolicy.getDefaultDirectives(),
+          'script-src-attr': ["'unsafe-inline'"]
+        }
+      },
       frameguard: {
         action: 'sameorigin' // Set X-Frame: sameorigin to prevent click jacking site-framing by anyone
       },
@@ -131,20 +139,13 @@
     app.use(cookieParser(config.auth.sessionSecret)); // not needed since express-session 1.5
 
     // Configure Session Management
-    const sessionStore = new RedisStore({
-      client: (() => {
-        if (!config.redis.enabled) {
-          return {};
-        }
-        let rClient = redis.createClient(config.redis.parsedUri, config.redis.opts);
-        rClient.unref(); // allows the program to exit once no more commands are pending...
-        rClient.on('error', logger.error);
-        return rClient;
-      })(),
+    const redisClient = createRedisClient();
+    const sessionStore = redisClient ? new RedisStore({
+      client: redisClient,
       prefix: config.redis.sessionPrefix,
       ttl: 86400000
-    });
-    const finalSessionStore = config.redis.enabled ? sessionStore : new session.MemoryStore();
+    }) : null;
+    const finalSessionStore = redisClient ? sessionStore : new session.MemoryStore();
 
     app.use(session({
       store: finalSessionStore,
@@ -193,7 +194,10 @@
     }
 
     // Init Api Routes (Don't Cache This Ever?)
-    app.use(config.uris.apiBase, helmet.noCache(), routes.api);
+    app.use(config.uris.apiBase, function (req, res, next) {
+      res.set('Cache-Control', 'no-store');
+      next();
+    }, routes.api);
 
     // Init Web Routes
     app.use(config.uris.webBase, routes.web);
@@ -243,4 +247,15 @@
 
   };
 
+  function createRedisClient() {
+    if (!config.redis.enabled || !URL.canParse(config.redis.parsedUri)) {
+      logger.warn('Redis is enabled but its configured URL is invalid; using the in-memory session store.');
+      return null;
+    }
+    const client = redis.createClient({url: config.redis.parsedUri});
+    client.on('error', logger.error);
+    client.connect().catch(logger.error);
+    return client;
+  }
+
 })();

anms-ui/server/core/routes.js

@@ -26,7 +26,7 @@
   const path = require('path');
   const redis = require('redis');
   const rateLimit = require('express-rate-limit');
-  const RedisLimiterStore = require('rate-limit-redis');
+  const { RedisStore } = require('rate-limit-redis');
 
   const config = require('../shared/config');
   const logger = require('../shared/logger');
@@ -39,21 +39,18 @@
     max: config.auth.requestLimit, // # max requests per time-window
     skip: enableRateLimiter ? _.constant(false) : _.constant(true)
   };
-  if (enableRateLimiter) {
-    rateLimiterOptions.store = new RedisLimiterStore({
-      expiry: (config.auth.requestLimitWindow / 1000),
-      resetExpiryOnChange: false,
+  if (enableRateLimiter && URL.canParse(config.redis.parsedUri)) {
+    const rClient = redis.createClient({url: config.redis.parsedUri});
+    rClient.on('error', logger.error);
+    rClient.connect().catch(logger.error);
+    rateLimiterOptions.store = new RedisStore({
       prefix: config.redis.limiterPrefix,
-      client: (() => {
-        if (!config.redis.enabled) {
-          return {};
-        }
-        let rClient = redis.createClient(config.redis.parsedUri, config.redis.opts);
-        rClient.unref(); // allows the program to exit once no more commands are pending...
-        rClient.on('error', logger.error);
-        return rClient;
-      })()
+      sendCommand: function (...args) {
+        return rClient.sendCommand(args);
+      }
     });
+  } else if (enableRateLimiter) {
+    logger.warn('Redis is enabled but its configured URL is invalid; using the in-memory rate-limit store.');
   }
   const userLimiter = rateLimit(rateLimiterOptions);
 
@@ -148,7 +145,7 @@
       router.post('/report/entries/table/:obj_agent_id', reports.getReportEntriesByAgent);
 
       //------------- Unknown API Routes -------------//
-      router.all('/*', function (req, res, next) {
+      router.all('/{*path}', function (req, res, next) {
         next({code: 404, message: 'Resource not found.'});
       });
 
@@ -172,11 +169,11 @@
       router.get(indexPageMatches, pageHandlers.preMainPageHandler, pageHandlers.mainPageHandler);
 
       //------------- HTML5 Matcher -------------//
-      router.get('/*', pageHandlers.preMainPageHandler, pageHandlers.mainPageHandler);
+      router.get('/{*path}', pageHandlers.preMainPageHandler, pageHandlers.mainPageHandler);
 
       //------------- Routes -------------//
 
-      router.all('/*', userLimiter, function (req, res) {
+      router.all('/{*path}', userLimiter, function (req, res) {
         res.status(404);
         res.type('html').sendFile(config.client.error);
       });