Security changes whitelisting

config/default.yaml

@@ -21,6 +21,7 @@ influxdb:
   # Acceptable version are: '0.8' and '0.9'
   version: '0.9'
 
+onlyAcceptWhitelistedKeys: false
 
 modules:
   # The modules just get require'd in, so they don't have to be in the Bucky project.
@@ -36,3 +37,23 @@ modules:
     # - ./modules/statsd
     # - ./modules/openTSDB
     # - ./modules/influxdb
+
+  whitelistedKeys:
+  # The example below are timing metrics that Bucky includes by default. You will need to whitelist these if you use the default configuration of Bucky and enable whitelisting by setting useWhitelistedKeys to true
+    - file.page.navigationStart
+    - file.page.unloadEventStart
+    - file.page.unloadEventEnd
+    - file.page.fetchStart
+    - file.page.domainLookupStart
+    - file.page.domainLookupEnd
+    - file.page.connectStart
+    - file.page.connectEnd
+    - file.page.requestStart
+    - file.page.responseStart
+    - file.page.responseEnd
+    - file.page.domLoading
+    - file.page.domInteractive
+    - file.page.domContentLoadedEventStart
+    - file.page.toJSON
+    # - time.to.click.dont.click.button
+    # - dont.click.button.clicks

modules/collectors.coffee

@@ -3,10 +3,16 @@ _ = require 'underscore'
 
 load = require "../lib/load"
 modules = require("config").modules
+onlyAcceptWhitelistedKeys = require("config").onlyAcceptWhitelistedKeys
 
 module.exports = ({app, logger, config}, next) ->
   collectorHandler = (collectors) ->
     return (req, res) ->
+      if onlyAcceptWhitelistedKeys
+        if not _.every(_.keys(req.body), (v) -> _.contains(modules.whitelistedKeys, v))
+          console.log ("The key set you are trying to send is not whitelisted")
+          res.send(406, '')
+          return
       res.send(204, '')
 
       for coll in collectors
@@ -37,4 +43,4 @@ module.exports = ({app, logger, config}, next) ->
     for path, hls of handlers
       collector[path] = collectorHandler(hls)
 
-    next collector
+    next collector

server.coffee

@@ -62,7 +62,7 @@ loadApp = (logger, loadedConfig) ->
   moduleGroups = {}
   loadModuleGroup = (group) ->
     moduleGroups[group] = {}
-
+    
     if MODULES[group]
       _.map MODULES[group], (name) ->
         logger.log "Loading #{ group } Module", name