Investigate Potential Prototype Pollution Risk in Server Deletion Endpoint

[ihasTaco]

In the current implementation of the server deletion endpoint (/delete-server), the delete operation is used with potentially user-provided guild_id and server_uuid values. Although these values are retrieved from req.body and are not directly user-controlled, there is a theoretical risk of prototype pollution if they were manipulated by an attacker.

Prototype pollution is a type of vulnerability where an attacker can modify the prototype of a JavaScript object, potentially causing unexpected behavior in the application.

Steps to Reproduce:

This is a theoretical vulnerability and does not have specific reproduction steps in the current implementation.

Expected Outcome:

The application should not allow prototype pollution via user-provided guild_id and server_uuid values.

Actual Outcome:

The current implementation does not present a clear risk of prototype pollution, but further investigation and potential mitigation measures are warranted.

Suggested Fix:

Add input validation to ensure that guild_id and server_uuid are in the expected format before they are used. For example, if these IDs should only contain alphanumeric characters, reject any values that contain other characters.

Relevant Code Snippet:

See delete-server endpoint

router.delete('/delete-server', async (req, res) => {
    const { guild_id, server_uuid } = req.body;

    // ...

    // Delete server_uuid
    if (serverInfoData[guild_id]) {
        delete serverInfoData[guild_id][server_uuid];
    }

    // ...
});

• https://github.com/ihasTaco/ServerQuery/security/code-scanning/36
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/35
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/34
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/33
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/32
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/31
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/30
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/29
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/28
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/27
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/26
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/25
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/24
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/23
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/22
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/21
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/20
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/19
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/18
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/17
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/16
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/15
• https://github.com/ihasTaco/ServerQuery/security/code-scanning/14