Security Considerations

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• package.json
• utils/index.js
• utils/tests/utils.test.js
• server.js
• add-post.html
• scripts/collect-discussions.js
• scripts/collect-issues.js
• index.html

This document outlines the security measures and considerations within the nodejs-news-feeder project. The system's primary function is to aggregate news from various sources, including GitHub and manual entries, and publish them as an RSS feed and a static website. Security focuses on dependency management, data sanitization to prevent injection attacks, secure handling of credentials, and safe rendering of content on the frontend.

The architecture relies on automated scripts to fetch data, a manual entry system for custom posts, and a build process that generates static output files (feed.xml, index.html). Key security touchpoints include managing third-party packages, cleaning all incoming content before it is published, and securing the local server used for manual post submissions.

Automated Security Scanning

The project integrates automated tools to maintain code quality and security.

• Dependency Management: The project uses Dependabot for automated dependency updates, which helps mitigate vulnerabilities in third-party packages. This is indicated by the presence of a Dependabot workflow badge in the README.md.
  Sources: README.md:1
• Static Analysis: A GitHub Action is configured to run Semgrep and Pixee for static code analysis, helping to identify and fix potential security issues in the codebase.
  Sources: README.md:2

Data Sanitization and Content Cleaning

To prevent Cross-Site Scripting (XSS) and other injection attacks, the project implements several content cleaning and sanitization functions. These are primarily located in utils/index.js and are applied before content is inserted into the final feed.xml.

Sanitization Functions

The core sanitization logic is handled by a set of utility functions.

Function	Description
escapeXmlCharacters	Escapes special XML characters (&, <, >, ", ') to prevent malformed XML and entity injection.
stripHtmlTags	Removes all HTML tags from a string to ensure only plain text is rendered where intended.
escapeHtmlTags	Converts HTML tag brackets (<, >) into their corresponding entities (&lt;, &gt;) to display tags as text.
cleancontent	Orchestrates cleaning by removing blacklisted keywords read from blacklist.txt.
composeFeedItem	A wrapper function that applies cleancontent to the title and description of a feed item before generation.

Sources: utils/index.js:20-112, utils/tests/utils.test.js:6-121

The following diagram illustrates the flow of raw content through the sanitization process before being added to the RSS feed.

Blacklist-based Filtering

The cleancontent function reads a list of keywords from a blacklist.txt file and removes all occurrences of these keywords from the input text. This provides a mechanism to filter out undesirable or malicious strings.

// utils/index.js:80-97
export function cleancontent(text, options = {}) {
  let validtext=text
  const keys=getkeys()
  //console.log(keys)
  for(const key of keys){
    
    while (validtext.includes(key)){
      //console.log(validtext.includes(key))  
      validtext=validtext.replace(key,"")
    }
  }

  return validtext
  // Merge and validate configuration options

}

Sources: utils/index.js:80-97

API and Server Security

A local Express server is used to facilitate the manual addition of news posts. This server exposes API endpoints that handle reading from and writing to a manual-posts.json file.

Sources: server.js

Endpoints

Method	Path	Description
GET	/	Serves the add-post.html page for submitting new posts.
GET	/api/posts	Reads and returns all posts from manual-posts.json.
POST	/api/posts	Receives a new post, adds a timestamp and ID, and appends it to manual-posts.json. The request body is parsed as JSON. No explicit sanitization occurs at this endpoint.

Sources: server.js:10-44

Manual Post Submission Flow

The sequence diagram below shows how a user submits a new post through the web interface. Notably, the data from the form is sent directly to the server, which writes it to a JSON file. The content is only sanitized later during the rss:build step when composeFeedItem is called.

Authentication and Secrets Management

The scripts responsible for collecting data from the GitHub API require authentication.

• API Token Usage: The data collection scripts (collect-discussions.js, collect-issues.js, collect-releases.js) use a GitHub token passed via an environment variable, process.env.GITHUB_TOKEN. This is a standard security practice that avoids hardcoding secrets in the source code.

  // scripts/collect-discussions.js:22-24
  headers: {
    authorization: `token ${process.env.GITHUB_TOKEN}`
  }
  

  Sources: scripts/collect-discussions.js:22-24, scripts/collect-issues.js:12-15, scripts/collect-releases.js:15-18

Frontend Security

The generated index.html page, which displays the news feed, includes a specific security measure to protect users.

• Tabnabbing Protection: External links in the news items are rendered with target="_blank" and rel="noopener". The noopener attribute prevents the newly opened page from having access to the original page's window object, thus mitigating potential phishing attacks known as tabnabbing.

  <!-- index.html:220 -->
  <a href="https//www.europol.europa.eu/media-press/newsroom/news/end-of-game-for-cybercrime-infrastructure-1025-servers-taken-down" target="_blank" rel="noopener">...</a>
  

  Sources: index.html

In summary, the project's security posture relies on automated scanning, a multi-layered data sanitization strategy, proper secrets management, and frontend best practices. The primary risk area is the ingestion of un-sanitized data into manual-posts.json, though this risk is mitigated by the subsequent build process that cleans the content before publication.