[IMPROVE] Add rate limiter to UiKit endpoints

app/apps/server/communication/uikit.js

@@ -1,8 +1,11 @@
 import express from 'express';
+import rateLimit from 'express-rate-limit';
+import { Meteor } from 'meteor/meteor';
 import { WebApp } from 'meteor/webapp';
 import { UIKitIncomingInteractionType } from '@rocket.chat/apps-engine/definition/uikit';
 
 import { Users } from '../../../models/server';
+import { settings } from '../../../settings/server';
 
 const apiServer = express();
 
@@ -13,11 +16,22 @@ WebApp.connectHandlers.use(apiServer);
 // eslint-disable-next-line new-cap
 const router = express.Router();
 
-const unauthorized = (res) =>
-	res.status(401).send({
-		status: 'error',
-		message: 'You must be logged in to do this.',
+const unauthorized = (res) => res.status(401).send({
+	status: 'error',
+	message: 'You must be logged in to do this.',
+});
+
+Meteor.startup(() => {
+	// use specific rate limit of 600 (which is 60 times the default limits) requests per minute (around 10/second)
+	const apiLimiter = rateLimit({
+		windowMs: settings.get('API_Enable_Rate_Limiter_Limit_Time_Default'),
+		max: settings.get('API_Enable_Rate_Limiter_Limit_Calls_Default') * 60,
+		skip: () =>
+			settings.get('API_Enable_Rate_Limiter') !== true
+			|| (process.env.NODE_ENV === 'development' && settings.get('API_Enable_Rate_Limiter_Dev') !== true),
 	});
+	router.use(apiLimiter);
+});
 
 router.use((req, res, next) => {
 	const {

app/bigbluebutton/server/bigbluebutton-api.js

@@ -1,7 +1,7 @@
 /* eslint-disable */
 import crypto from 'crypto';
 
-var BigBlueButtonApi, filterCustomParameters, include, noChecksumMethods, root,
+var BigBlueButtonApi, filterCustomParameters, include, noChecksumMethods,
 	__indexOf = [].indexOf || function (item) { for (var i = 0, l = this.length; i < l; i++) { if (i in this && this[i] === item) return i; } return -1; };
 
 BigBlueButtonApi = (function () {

app/emoji-emojione/lib/generateEmojiIndex.mjs

@@ -2,10 +2,9 @@
 
 // node --experimental-modules generateEmojiIndex.mjs
 import fs from 'fs';
-import https from 'https';
 import nsg from 'node-sprite-generator';
 import _ from 'underscore';
-import gm from 'gm';
+import gm from 'gm'; // lgtm[js/unused-local-variable]
 
 const assetFolder = '../../../node_modules/emojione-assets';
 const emojiJsonFile = `${ assetFolder }/emoji.json`;