Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

add configurable maximums to the number of events requested by /sync and /messages #2220

Closed
ara4n opened this issue May 12, 2017 · 3 comments
Closed

add configurable maximums to the number of events requested by /sync and /messages #2220

ara4n opened this issue May 12, 2017 · 3 comments

Comments

@ara4n
Copy link
Member

ara4n commented May 12, 2017

atm we have MAX_LIMIT of 1000 when paginating, but no upper cap on /sync at all, as far as i can see
psaavedra added a commit to psaavedra/synapse that referenced this issue May 13, 2017
@psaavedra
Configurable maximum number of events requested by /sync and /messages (
9da4316 
matrix-org#2220)

Set the limit on the returned events in the timeline in the get and sync
operations. The default value is -1, means no upper limit.

For example, using `filter_timeline_limit: 5000`:

POST /_matrix/client/r0/user/user:id/filter
{
room: {
    timeline: {
      limit: 1000000000000000000
    }
}
}

GET /_matrix/client/r0/user/user:id/filter/filter:id

{
room: {
    timeline: {
      limit: 5000
    }
}
}

The server cuts down the room.timeline.limit.
@psaavedra psaavedra mentioned this issue May 13, 2017
Merged
@psaavedra
Copy link
Contributor

psaavedra commented May 13, 2017 •
edited
Loading

Some tests done during this Saturday confirmed me a new attact vector for Matrix using the /sync (API). The vulnerability is on Matrix don't set an upper limit for the max number of events to request for a requested room, this allow the attacker generates huge SQL queries in the server which can degradate the service and lead a DDoS.

@psaavedra
Copy link
Contributor

All test passed on #2221.

@psaavedra
Copy link
Contributor

Merged #2221

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@psaavedra @ara4n @erikjohnston