fix: add resource limit in index.js (CWE-770)

[anupamme]

The GET /cve endpoint lacks rate limiting controls while the GET /cve/:id endpoint at line 12 has mw.rateLimiter applied. This inconsistency allows authenticated users with Secretariat or Bulk Download privileges to send unlimited requests to the bulk retrieval endpoint, exhausting database connections and server resources. The affected code is src/controller/cve.controller/index.js:192. This change is the fix I would apply.

Reference: CWE-770

What changed

• src/controller/cve.controller/index.js

Verification

No automated check could be run against this repository, so this change is unverified beyond review. Please treat it as a suggestion.

Regression test

The security boundary is maintained under adversarial input

Test

const request = require('supertest');
const express = require('express');
const router = require('../../../src/controller/cve.controller/index.js');

describe("GET /cve endpoint enforces rate limiting controls", () => {
  const app = express();
  app.use(express.json());
  app.use('/', router);

  const testCases = [
    { name: 'rapid requests', count: 100 },
    { name: 'boundary count', count: 10 },
    { name: 'valid single request', count: 1 }
  ];

  for (const { name, count } of testCases) {
    it(`handles ${name} without resource exhaustion`, async function () {
      this.timeout(5000);
      const requests = [];
      for (let i = 0; i < count; i++) {
        requests.push(
          request(app)
            .get('/cve')
            .set('Accept', 'application/json')
        );
      }
      const responses = await Promise.all(requests);
      const rateLimited = responses.some(r => r.status === 429);
      const hasRateLimitHeader = responses.some(r => 
        r.headers['x-ratelimit-limit'] || r.headers['retry-after']
      );
      if (count > 50) {
        if (!rateLimited && !hasRateLimitHeader) {
          throw new Error('Rate limiting must be enforced on bulk retrieval endpoint');
        }
      }
    });
  }
});

---

Automated security fix by OrbisAI Security

[david-rocca]

thank you for your contribution, however we handle our rate limiting through other factors.

Cheers.