Fix unauthenticated feeds memory exhaustion DoS. Closes #844#993
Conversation
|
@regulartim please have a look and let me know if any changes are required. |
regulartim
left a comment
There was a problem hiding this comment.
Hey @R1sh0bh-1 ! Two things:
- the tests don't actually test if the undocumented parameters are ignored, right?
- you wrote the allow list twice - I think you can safely use the more permissive allow list for both endpoints
|
Thanks for the review @regulartim! Both points addressed — I've improved the test assertions to pass feed_size=1 and verify the response still returns more than 1 result, directly proving the parameter is filtered out rather than just checking for a 200 OK. I've also extracted the documented parameters into a single module-level constant ALLOWED_UNAUTHENTICATED_QUERY_PARAMS and reused it across both |
regulartim
left a comment
There was a problem hiding this comment.
Looks good, thank you! :)
Description
This PR fixes a critical Memory Exhaustion Denial of Service (DoS) vulnerability in the unauthenticated
/api/feeds/endpoint, where an unboundedfeed_sizeparameter could be exploited to crash the application's worker processes due to out-of-memory (OOM) errors.As discussed by the maintainers, the basic
/api/feeds/endpoints have been secured by explicitly filteringrequest.query_paramsto only accept explicitly documented parameters (include_mass_scanners,include_tor_exit_nodes,feed_type,attack_type,ioc_type, andprioritize). All undocumented parameters, includingfeed_size, are now strictly ignored, enforcing the default size of 5000 and rendering the DoS attack vector completely obsolete.Advanced/authenticated endpoints are left unchanged to support large, valid research queries as intended.
Related issues
Closes #844
Type of change
Checklist
Please complete this checklist carefully. It helps guide your contribution and lets maintainers verify that all requirements are met.
Formalities
<feature name>. Closes #999develop.develop.Docs and tests
Ruff) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.