Implement account lockout after repeated failed login attempts to mitigate brute-force attacks on the login endpoint.

[zeropath-ai-dev]

Summary

• The Vulnerability Description:
  The login endpoint did not track failed login attempts, apply delays, or enforce account lockouts on repeated authentication failures, making it susceptible to brute-force attacks.

• This Fix:
  The patch introduces limits for failed login attempts, temporarily locks the account after five consecutive failed attempts, and requires a cool-down period (15 minutes) before access is permitted again.

• The Cause of the Issue:
  The original implementation only returned HTTP 401 for invalid credentials and lacked mechanisms to detect or mitigate repeated login failures by attackers.

• The Patch Implementation:
  New logic tracks each user's failed login attempts and last attempt time, erases attempt counts after a successful login or cool-down, and responds with HTTP 429 when the lockout threshold and lockout duration are met.

Vulnerability Details

• Vulnerability Class: Natural Language Rule Violation
• Severity: 9.2
• Affected File: data/static/codefixes/loginBenderChallenge_2_correct.ts
• Vulnerable Lines: 16-35

Code Snippets

diff --git a/data/static/codefixes/loginBenderChallenge_2_correct.ts b/data/static/codefixes/loginBenderChallenge_2_correct.ts
index cdc351bea..ff07b43be 100644
--- a/data/static/codefixes/loginBenderChallenge_2_correct.ts
+++ b/data/static/codefixes/loginBenderChallenge_2_correct.ts
@@ -1,6 +1,10 @@
 import {BasketModel} from "../../../models/basket";
 
 module.exports = function login () {
+  const MAX_FAILED_ATTEMPTS = 5
+  const LOCKOUT_TIME_MS = 15 * 60 * 1000
+  const failedLoginAttempts: Record<string, {count: number, lastAttempt: number}> = {}
+
   function afterLogin (user: { data: User, bid: number }, res: Response, next: NextFunction) {
     BasketModel.findOrCreate({ where: { UserId: user.data.id } })
       .then(([basket]: [BasketModel, boolean]) => {
@@ -14,6 +18,13 @@ module.exports = function login () {
   }
 
   return (req: Request, res: Response, next: NextFunction) => {
+    const email = req.body.email;
+    const attemptInfo = failedLoginAttempts[email];
+    if (attemptInfo && attemptInfo.count >= MAX_FAILED_ATTEMPTS && (Date.now() - attemptInfo.lastAttempt) < LOCKOUT_TIME_MS) {
+      return res.status(429).send(res.__('Too many login attempts. Please try again later.'));
+    } else if (attemptInfo && (Date.now() - attemptInfo.lastAttempt) >= LOCKOUT_TIME_MS) {
+      delete failedLoginAttempts[email];
+    }
     models.sequelize.query(`SELECT * FROM Users WHERE email = $mail AND password = $pass AND deletedAt IS NULL`,
       { bind: { mail: req.body.email, pass: security.hash(req.body.password) }, model: models.User, plain: true })
       .then((authenticatedUser) => {
@@ -29,11 +40,19 @@ module.exports = function login () {
             }
           })
         } else if (user.data?.id) {
+          delete failedLoginAttempts[email];
           afterLogin(user, res, next)
         } else {
-          res.status(401).send(res.__('Invalid email or password.'))
+          const email = req.body.email;
+          if (!failedLoginAttempts[email]) {
+            failedLoginAttempts[email] = { count: 1, lastAttempt: Date.now() };
+          } else {
+            failedLoginAttempts[email].count++;
+            failedLoginAttempts[email].lastAttempt = Date.now();
+          }
+          res.status(401).send(res.__('Invalid email or password.'));
         }
       }).catch((error: Error) => {
         next(error)
       })
-  }
\ No newline at end of file
+  }

How to Modify the Patch

You can modify this patch by using one of the two methods outlined below. We recommend using the @zeropath-ai-dev bot for updating the code. If you encounter any bugs or issues with the patch, please report them here.

Ask @zeropath-ai-dev!

To request modifications, please post a comment beginning with @zeropath-ai-dev and specify the changes required.

@zeropath-ai-dev will then implement the requested adjustments and commit them to the specified branch in this pull request. Our bot is capable of managing changes across multiple files and various development-related requests.

Manually Modify the Files

# Checkout created branch:
git checkout zvuln_fix_natural_language_rule_violation_1755147161552495

# if vscode is installed run (or use your favorite editor / IDE):
code data/static/codefixes/loginBenderChallenge_2_correct.ts

# Add, commit, and push changes:
git add -A
git commit -m "Update generated patch with x, y, and z changes."
git push zvuln_fix_natural_language_rule_violation_1755147161552495