Koko210/immich-folio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

🛡️ Fix global DoS vulnerability in rate limiter (FIFO eviction)

Browse Source 
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
This commit is contained in:
Ralksta
2026-04-01 12:45:46 +02:00
committed by GitHub
parent bf72a88d6c
commit b8833b4e60
2 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/__tests__/rate-limit.test.ts
View File

@@ -59,9 +59,9 @@ describe('checkRateLimit', () => {
});
it('does not crash when store is at capacity and still accepts new IPs', () => {
// Fill the store beyond MAX_STORE_ENTRIES (1 000 in test env or 10 000 in prod)
// Fill the store beyond MAX_STORE_ENTRIES (10_000 in prod)
// by hammering with unique IPs; evictIfFull must silently evict stale entries.
const uniqueIps = Array.from({ length: 200 }, (_, i) => `evict-test-ip-${i}-${Date.now()}`);
const uniqueIps = Array.from({ length: 10005 }, (_, i) => `evict-test-ip-${i}-${Date.now()}`);
for (const ip of uniqueIps) {
checkRateLimit(ip, 5);
}

8
lib/rate-limit.ts
View File

@@ -63,8 +63,12 @@ export function checkRateLimit(
// New window or expired
if (!entry || now > entry.expiresAt) {
if (store.size >= MAX_STORE_ENTRIES) {
// Store is completely full with active IPs -> block to prevent memory exhaustion & rate limit bypass
return { success: false, remaining: 0, resetAt: now + windowMs };
// Store is full. Evict the oldest entry (FIFO) to prevent a global DoS
// where an attacker fills the store with spoofed IPs, locking out legitimate users.
const oldestKey = store.keys().next().value;
if (oldestKey !== undefined) {
store.delete(oldestKey);
}
}
const resetAt = now + windowMs;
store.set(key, { count: 1, expiresAt: resetAt });