Security fixes pass #2

src/functions/server/bunext-req-handler.ts

@@ -8,6 +8,10 @@ import handleBunextPublicAssets from "./handle-bunext-public-assets";
 import checkExcludedPatterns from "../../utils/check-excluded-patterns";
 import { AppData } from "../../data/app-data";
 import fullRebuild from "./full-rebuild";
+
+const HMR_RETRY_COOLDOWN_MS = 5000;
+let lastHmrRetryTime = 0;
+
 type Params = {
     req: Request;
     server: Bun.Server<any>;
@@ -45,6 +49,11 @@ export default async function bunextRequestHandler({
         }
 
         if (is_dev && url.pathname == AppData["BunextHMRRetryRoute"]) {
+            const now = Date.now();
+            if (now - lastHmrRetryTime < HMR_RETRY_COOLDOWN_MS) {
+                return new Response("Too Many Requests", { status: 429 });
+            }
+            lastHmrRetryTime = now;
             await fullRebuild({ msg: `HMR Retry Rebuild ...` });
             return new Response("Modules Rebuilt");
         }
@@ -76,8 +85,12 @@ export default async function bunextRequestHandler({
 
         return response;
     } catch (error: any) {
-        return new Response(`Server Error: ${error.message}`, {
-            status: 500,
-        });
+        if (is_dev) {
+            return new Response(`Server Error: ${error.message}`, {
+                status: 500,
+            });
+        }
+        console.error(`Server Error: ${error.message}`, error);
+        return new Response("Internal Server Error", { status: 500 });
     }
 }