fix(security): newsletter exception leak + careers upload bounds (#199)#220
Conversation
…pload (#199) newsletter.subscribe echoed the raw DB/PostgREST exception text back to the client (str(e)), leaking internal detail. Log the error server-side and return a generic 500 instead. careers.apply read the whole resume into memory with no size or content-type bound and inserted unvalidated fields — an unauthenticated, unbounded upload + write sink. Cap resume size at 5 MB (bounded read, 413), restrict to PDF/DOC/ DOCX (415), and validate the text fields (422), mirroring storage_service's avatar validation. Tests fail on pre-fix code: raw exception text echoed; oversize/wrong-type uploads and invalid email accepted with 200.
|
Warning Review limit reached
More reviews will be available in 57 minutes and 17 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
frontend | 5bd3cbe | Commit Preview URL Branch Preview URL |
Jun 13 2026, 03:42 AM |
…dpoints (#182) /api/extract/pdf and /api/extract/image took no Request and no auth guard, ran multi-second Docling/tesseract OCR for any anonymous caller, with no size cap and no rate limit — an attacker could drive unbounded OCR load/cost. - Require an authenticated session via get_session_user_id (401). - Cap upload size at 20 MB via a bounded read (413), reusing the #220 size-bound pattern factored into a shared services/request_limits.py. - Per-user sliding-window rate limit (429), same limiter shape as the flashcard import service, now in the shared module. Tests: unauthenticated PDF/image -> 401; oversize -> 413; >threshold -> 429. All fail on pre-fix code (no auth/bounds/limiter). Follow-ups (noted, out of scope): flashcard_import_service has a duplicate limiter that can migrate to request_limits; main.py's HTTPException handler drops exc.headers, so 429 conveys retry in the detail string, not Retry-After.
1 participant
Closes #199.
Problems
newsletter.subscribeleaked internal detail —raise HTTPException(500, detail=str(e))echoed the raw DB/PostgREST exception text (host/table/driver) straight to the client, bypassing the sanitized 500 handler.careers.applywas an unbounded, untyped upload sink — public endpoint that read the whole resume into memory withfile.file.read(), no size cap, no content-type check, and insertedfull_name/email/linkedin_urlunvalidated.Fixes
str(e); log server-side and return a generic 500._validate_resumeenforces a 5 MB cap via a bounded read (read(MAX+1)→ 413 before the file is fully buffered) and restricts to PDF/DOC/DOCX (415); the text fields are stripped + validated (422 incl. an email-shape check). Mirrors the existingstorage_serviceavatar validation (415/413).Tests (vuln-closing) —
tests/test_newsletter_careers_bounds.pyAll four negative assertions fail on pre-fix code (raw text echoed; oversize/wrong-type/bad-email accepted with 200).
Scope / notes
Two route files + one test. Rate-limiting (mentioned in the issue's suggested fix) is out of scope — there's no rate-limiter infra in the repo yet; the acceptance criteria (size/type cap + basic input validation) are fully met. File-disjoint from the other security PRs.