mirror of
https://github.com/penpot/penpot.git
synced 2026-08-06 12:58:55 +00:00
4f7bb94bb1
Prevent email bombing attacks on the send-user-feedback endpoint by limiting the error-report field to 1MiB and adding climit rate limits: by-profile (1 permit, queue 3) and global (4 permits), configured in climit.edn. Make the schema public so it can be exercised by tests, and add schema validation tests covering the new size limit. AI-assisted-by: qwen3.7-plus
49 lines
1.0 KiB
Clojure
49 lines
1.0 KiB
Clojure
;; Example climit.edn file
|
|
;; Required: permits
|
|
;; Optional: queue, ommited means Integer/MAX_VALUE
|
|
;; Optional: timeout, ommited means no timeout
|
|
;; Note: queue and timeout are excluding
|
|
{:update-file/global {:permits 20}
|
|
:update-file/by-profile
|
|
{:permits 1 :queue 5}
|
|
|
|
:process-font/global {:permits 4}
|
|
:process-font/by-profile {:permits 1}
|
|
|
|
:process-image/global {:permits 8}
|
|
:process-image/by-profile {:permits 1}
|
|
|
|
:auth/global {:permits 8}
|
|
|
|
:root/global
|
|
{:permits 40}
|
|
|
|
:root/by-profile
|
|
{:permits 10 :queue 30 :timeout 30000}
|
|
|
|
:file-thumbnail-ops/global
|
|
{:permits 20}
|
|
:file-thumbnail-ops/by-profile
|
|
{:permits 2}
|
|
|
|
:submit-audit-events/by-profile
|
|
{:permits 1 :queue 3}
|
|
|
|
:restore-file-snapshot/global
|
|
{:permits 3}
|
|
|
|
:restore-file-snapshot/by-profile
|
|
{:permits 1 :queue 2 :timeout 60000}
|
|
|
|
:create-file-snapshot/global
|
|
{:permits 3}
|
|
|
|
:create-file-snapshot/by-profile
|
|
{:permits 1 :queue 2 :timeout 60000}
|
|
|
|
:send-user-feedback/global
|
|
{:permits 4}
|
|
|
|
:send-user-feedback/by-profile
|
|
{:permits 1 :queue 3}}
|