This PR is linked to Issue #1132

Sounds good. Will make a PR within the next 24 hours. Cheers.

For a newly created GitHub account , the 'Keep my email address private' check box under email in personal settings is checked by default. This causes the profile._json.email to return a null value and thus bypasses the existing user check for existing GitHub email in MongoDB. This causes a Server Error for mongoose duplicate key insertion but the good news is that you can still extract the user email from profile.email which is an array of objects [{value: example@example.com}]. And from what i have seen so far, this array always contains one email, which is the primary one for the users account.

Bumps axios from 0.21.0 to 0.21.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v0.21.1</h2> <h3>0.21.1 (December 21, 2020)</h3> <p>Fixes and Functionality:</p> <ul> <li>Hotfix: Prevent SSRF (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3410">#3410</a>)</li> <li>Protocol not parsed when setting proxy config from env vars (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3070">#3070</a>)</li> <li>Updating axios in types to be lower case (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2797">#2797</a>)</li> <li>Adding a type guard for <code>AxiosError</code> (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2949">#2949</a>)</li> </ul> <p>Internal and Tests:</p> <ul> <li>Remove the skipping of the <code>socket</code> http test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3364">#3364</a>)</li> <li>Use different socket for Win32 test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3375">#3375</a>)</li> </ul> <p>Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:</p> <ul> <li>Daniel Lopretto <a href="mailto:timemachine3030@users.noreply.github.com">timemachine3030@users.noreply.github.com</a></li> <li>Jason Kwok <a href="mailto:JasonHK@users.noreply.github.com">JasonHK@users.noreply.github.com</a></li> <li>Jay <a href="mailto:jasonsaayman@gmail.com">jasonsaayman@gmail.com</a></li> <li>Jonathan Foster <a href="mailto:jonathan@jonathanfoster.io">jonathan@jonathanfoster.io</a></li> <li>Remco Haszing <a href="mailto:remcohaszing@gmail.com">remcohaszing@gmail.com</a></li> <li>Xianming Zhong <a href="mailto:chinesedfan@qq.com">chinesedfan@qq.com</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v0.21.1/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h3>0.21.1 (December 21, 2020)</h3> <p>Fixes and Functionality:</p> <ul> <li>Hotfix: Prevent SSRF (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3410">#3410</a>)</li> <li>Protocol not parsed when setting proxy config from env vars (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3070">#3070</a>)</li> <li>Updating axios in types to be lower case (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2797">#2797</a>)</li> <li>Adding a type guard for <code>AxiosError</code> (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2949">#2949</a>)</li> </ul> <p>Internal and Tests:</p> <ul> <li>Remove the skipping of the <code>socket</code> http test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3364">#3364</a>)</li> <li>Use different socket for Win32 test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3375">#3375</a>)</li> </ul> <p>Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:</p> <ul> <li>Daniel Lopretto <a href="mailto:timemachine3030@users.noreply.github.com">timemachine3030@users.noreply.github.com</a></li> <li>Jason Kwok <a href="mailto:JasonHK@users.noreply.github.com">JasonHK@users.noreply.github.com</a></li> <li>Jay <a href="mailto:jasonsaayman@gmail.com">jasonsaayman@gmail.com</a></li> <li>Jonathan Foster <a href="mailto:jonathan@jonathanfoster.io">jonathan@jonathanfoster.io</a></li> <li>Remco Haszing <a href="mailto:remcohaszing@gmail.com">remcohaszing@gmail.com</a></li> <li>Xianming Zhong <a href="mailto:chinesedfan@qq.com">chinesedfan@qq.com</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/a64050a6cfbcc708a55a7dc8030d85b1c78cdf38"><code>a64050a</code></a> Releasing 0.21.1</li> <li><a href="https://github.com/axios/axios/commit/d57cd976f3cc0f1c5bb1f0681660e50004781db5"><code>d57cd97</code></a> Updating changelog for 0.21.1 release</li> <li><a href="https://github.com/axios/axios/commit/8b0f373df0574b7cb3c6b531b4092cd670dac6e3"><code>8b0f373</code></a> Use different socket for Win32 test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3375">#3375</a>)</li> <li><a href="https://github.com/axios/axios/commit/e426910be7c417bdbcde9c18cb184ead826fc0e1"><code>e426910</code></a> Protocol not parsed when setting proxy config from env vars (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3070">#3070</a>)</li> <li><a href="https://github.com/axios/axios/commit/c7329fefc890050edd51e40e469a154d0117fc55"><code>c7329fe</code></a> Hotfix: Prevent SSRF (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3410">#3410</a>)</li> <li><a href="https://github.com/axios/axios/commit/f472e5da5fe76c72db703d6a0f5190e4ad31e642"><code>f472e5d</code></a> Adding a type guard for <code>AxiosError</code> (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2949">#2949</a>)</li> <li><a href="https://github.com/axios/axios/commit/768825589fd0d36b64a66717ca6df2efd8fb7844"><code>7688255</code></a> Remove the skipping of the <code>socket</code> http test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3364">#3364</a>)</li> <li><a href="https://github.com/axios/axios/commit/820fe6e41a96f05fb4781673ce07486f1b37515d"><code>820fe6e</code></a> Updating axios in types to be lower case (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2797">#2797</a>)</li> <li>See full diff in <a href="https://github.com/axios/axios/compare/v0.21.0...v0.21.1">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Looks like axios is up-to-date now, so this is no longer needed.

https://huntr.dev/users/arjunshibu has fixed the Lack of Rate Limiting vulnerability 🔨. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

Q | A Version Affected | ALL Bug Fix | YES Original Pull Request | https://github.com/418sec/hackathon-starter/pull/1 Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/other/hackathon-starter/1/README.md

User Comments:

📊 Metadata *

hackathon-starter is a boilerplate for Node.js web applications. It lacks rate-limiting, which allows an attacker to brute-force login credentials and mass account creation

Bounty URL: https://www.huntr.dev/bounties/1-other-hackathon-starter

⚙️ Description *

Lack of rate-limiting in the login and signup page of hackathon-starter

💻 Technical Description *

This fix uses the express-rate-limit package, which is a rate-limiting middleware for express based servers. I've applied it to POST requests issuing to /login and /signup routes.

🐛 Proof of Concept (PoC) *

Login Brute-Force

1. Install the package by following these instructions or try the live demo https://hackathon-starter.walcony.com
2. Navigate to /login and send the POST request to Burp Intruder
3. Use Grep Match option and add string Found. Redirecting to <a href="/login">/login</a>
4. The succeeded payload will redirect to / instead of /login
   https://raw.githubusercontent.com/arjunshibu/files/main/hackathon-starter-poc/poc1.png
   https://raw.githubusercontent.com/arjunshibu/files/main/hackathon-starter-poc/poc2.png
   https://raw.githubusercontent.com/arjunshibu/files/main/hackathon-starter-poc/poc3.png

Mass Account Creation

1. Navigate to /signup and send the POST request to Burp Intruder
2. I used numbers as payloads
3. Use Grep Match option and add the string Found. Redirecting to <a href="/">/</a>
4. All succeeded payloads will redirect to / and to /signup if there is already a user
   https://raw.githubusercontent.com/arjunshibu/files/main/hackathon-starter-poc/poc4.png
   https://raw.githubusercontent.com/arjunshibu/files/main/hackathon-starter-poc/poc5.png

🔥 Proof of Fix (PoF) *

After fix any brute-forcing of login credentials and mass account creation is prevented by responding with 429 - Too Many Requests

👍 User Acceptance Testing (UAT)

• I've executed unit tests.
• After fix the functionality is unaffected.

Hi Yashar!

First of all – happy (late) 2021 and thanks for taking over the project!

Unfortunately I'm experiencing the same issue, even after changing tld to version 0.12.4.

My software versions:

$ python --version
Python 3.8.5
$  $ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 20.04.1 LTS
Release:        20.04
Codename:       focal
$ uname -a
$ uname -a
Linux hc2 5.4.83-odroidxu4 #20.11.3 SMP PREEMPT Fri Dec 11 21:34:15 CET 2020 armv7l armv7l armv7l GNU/Linux
$ pip3 list | grep tld
tld                        0.12.4

Hope that helps.

hooks/cloudflare/hook.py:65: DeprecationWarning: please use dns.resolver.resolve() instead dns_response = dns.resolver.query(name, 'TXT')

Bumps axios from 0.21.0 to 0.21.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v0.21.1</h2> <h3>0.21.1 (December 21, 2020)</h3> <p>Fixes and Functionality:</p> <ul> <li>Hotfix: Prevent SSRF (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3410">#3410</a>)</li> <li>Protocol not parsed when setting proxy config from env vars (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3070">#3070</a>)</li> <li>Updating axios in types to be lower case (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2797">#2797</a>)</li> <li>Adding a type guard for <code>AxiosError</code> (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2949">#2949</a>)</li> </ul> <p>Internal and Tests:</p> <ul> <li>Remove the skipping of the <code>socket</code> http test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3364">#3364</a>)</li> <li>Use different socket for Win32 test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3375">#3375</a>)</li> </ul> <p>Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:</p> <ul> <li>Daniel Lopretto <a href="mailto:timemachine3030@users.noreply.github.com">timemachine3030@users.noreply.github.com</a></li> <li>Jason Kwok <a href="mailto:JasonHK@users.noreply.github.com">JasonHK@users.noreply.github.com</a></li> <li>Jay <a href="mailto:jasonsaayman@gmail.com">jasonsaayman@gmail.com</a></li> <li>Jonathan Foster <a href="mailto:jonathan@jonathanfoster.io">jonathan@jonathanfoster.io</a></li> <li>Remco Haszing <a href="mailto:remcohaszing@gmail.com">remcohaszing@gmail.com</a></li> <li>Xianming Zhong <a href="mailto:chinesedfan@qq.com">chinesedfan@qq.com</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v0.21.1/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h3>0.21.1 (December 21, 2020)</h3> <p>Fixes and Functionality:</p> <ul> <li>Hotfix: Prevent SSRF (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3410">#3410</a>)</li> <li>Protocol not parsed when setting proxy config from env vars (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3070">#3070</a>)</li> <li>Updating axios in types to be lower case (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2797">#2797</a>)</li> <li>Adding a type guard for <code>AxiosError</code> (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2949">#2949</a>)</li> </ul> <p>Internal and Tests:</p> <ul> <li>Remove the skipping of the <code>socket</code> http test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3364">#3364</a>)</li> <li>Use different socket for Win32 test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3375">#3375</a>)</li> </ul> <p>Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:</p> <ul> <li>Daniel Lopretto <a href="mailto:timemachine3030@users.noreply.github.com">timemachine3030@users.noreply.github.com</a></li> <li>Jason Kwok <a href="mailto:JasonHK@users.noreply.github.com">JasonHK@users.noreply.github.com</a></li> <li>Jay <a href="mailto:jasonsaayman@gmail.com">jasonsaayman@gmail.com</a></li> <li>Jonathan Foster <a href="mailto:jonathan@jonathanfoster.io">jonathan@jonathanfoster.io</a></li> <li>Remco Haszing <a href="mailto:remcohaszing@gmail.com">remcohaszing@gmail.com</a></li> <li>Xianming Zhong <a href="mailto:chinesedfan@qq.com">chinesedfan@qq.com</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/a64050a6cfbcc708a55a7dc8030d85b1c78cdf38"><code>a64050a</code></a> Releasing 0.21.1</li> <li><a href="https://github.com/axios/axios/commit/d57cd976f3cc0f1c5bb1f0681660e50004781db5"><code>d57cd97</code></a> Updating changelog for 0.21.1 release</li> <li><a href="https://github.com/axios/axios/commit/8b0f373df0574b7cb3c6b531b4092cd670dac6e3"><code>8b0f373</code></a> Use different socket for Win32 test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3375">#3375</a>)</li> <li><a href="https://github.com/axios/axios/commit/e426910be7c417bdbcde9c18cb184ead826fc0e1"><code>e426910</code></a> Protocol not parsed when setting proxy config from env vars (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3070">#3070</a>)</li> <li><a href="https://github.com/axios/axios/commit/c7329fefc890050edd51e40e469a154d0117fc55"><code>c7329fe</code></a> Hotfix: Prevent SSRF (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3410">#3410</a>)</li> <li><a href="https://github.com/axios/axios/commit/f472e5da5fe76c72db703d6a0f5190e4ad31e642"><code>f472e5d</code></a> Adding a type guard for <code>AxiosError</code> (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2949">#2949</a>)</li> <li><a href="https://github.com/axios/axios/commit/768825589fd0d36b64a66717ca6df2efd8fb7844"><code>7688255</code></a> Remove the skipping of the <code>socket</code> http test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3364">#3364</a>)</li> <li><a href="https://github.com/axios/axios/commit/820fe6e41a96f05fb4781673ce07486f1b37515d"><code>820fe6e</code></a> Updating axios in types to be lower case (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2797">#2797</a>)</li> <li>See full diff in <a href="https://github.com/axios/axios/compare/v0.21.0...v0.21.1">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Hi all,

Please excuse me if I am asking a dumb question. I was quite familiar with nodeJS back in 2013-15, and am now starting a new project based off of the hackathon-starter. There are a lot of ways to do essentially the same thing in node, especially in regards to modules, so I am trying to decide on the best way to do things before moving forward.

In particular, I'm wondering on the best way to structure modules. From reading this article, among others, it seems like the newest convention for module import / export is:

myModule.js export function myFunction() { // myFunction Scope }

app.js import { myFunction } from 'myModule';

My concern is the age-old one: Do I decide to write code in the "newest" way or do I decide to write code the way it already exists in the codebase. With that in mind, are there any plans to refactor modules in this project or the way modules are used to conform to the ES6 manner?

Please be kind in your criticisms of me :)

I had to make hook.sh executable or dehydrated would fail on line 288. And nginx is not installed. Thanks for the hook/script !

Hi. I'll glad to add the 401 and 500 pages.

My mistake!! I actually just realized I didn't put names for each form field. My apologies :(

Hi there,

I am assuming this is an issue with me not understanding CSRF well enough, but I am having an issue with creating a new form within this framework. I implemented a basic form on a new page, made sure to include the hidden form field in my form, and when I finally post it the only data I get in my req.body is the csrf field. Below is my code and my output.

my-board.pug form(method="POST") input(type='hidden', name='_csrf', value=_csrf) .form-group label(for='challenge') Challenge input#challenge.form-control(type='text' placeholder='Type your challenge here' required) .form-group label(for='status') Challenge Status input#status.form-control(type='text' placeholder='Not complete' required) button.btn.btn-primary(type='submit') Submit

Controller exports.postChallenge = (req, res, next) => { console.log(req.body); }

Route in app.js app.post('/my-board', adminController.postChallenge);

Entire output from the controller { _csrf: 'TcgTgzBVCdJ3sxFFMvRwsfaHoi1Ib9squxSs0=' }

Can you help me understand what I'm doing wrong?

#1121 404 page is completed

by no means pretty