fix(security): auth + size cap + rate limit on OCR extract endpoints (#182)#229
Conversation
…dpoints (#182) /api/extract/pdf and /api/extract/image took no Request and no auth guard, ran multi-second Docling/tesseract OCR for any anonymous caller, with no size cap and no rate limit — an attacker could drive unbounded OCR load/cost. - Require an authenticated session via get_session_user_id (401). - Cap upload size at 20 MB via a bounded read (413), reusing the #220 size-bound pattern factored into a shared services/request_limits.py. - Per-user sliding-window rate limit (429), same limiter shape as the flashcard import service, now in the shared module. Tests: unauthenticated PDF/image -> 401; oversize -> 413; >threshold -> 429. All fail on pre-fix code (no auth/bounds/limiter). Follow-ups (noted, out of scope): flashcard_import_service has a duplicate limiter that can migrate to request_limits; main.py's HTTPException handler drops exc.headers, so 429 conveys retry in the detail string, not Retry-After.
|
Warning Review limit reached
More reviews will be available in 50 minutes and 18 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
frontend | ff1d670 | Commit Preview URL Branch Preview URL |
Jun 13 2026, 06:13 AM |
1 participant
Closes #182. P2.
Vulnerability
/api/extract/pdfand/api/extract/image(routes/extract.py) took noRequestand no auth guard, ran CPU-heavy Docling/tesseract OCR (up to 200 pages) for any anonymous caller, with no size cap and no rate limit. An attacker could drive unbounded OCR load/cost.Fix
get_session_user_id(request)on both routes.read_within_limit), reusing the fix(security): newsletter exception leak + careers upload bounds (#199) #220 (fix(security): newsletter exception leak + careers upload bounds (#199) #220/PR fix(security): newsletter exception leak + careers upload bounds (#199) #220) bound/validate pattern — factored into a sharedservices/request_limits.py.check_rate_limit, 10/60s), same shape as the flashcard limiter, now in the shared module.Tests —
tests/test_extract_auth_bounds.pyUnauthenticated PDF/image → 401; oversize → 413; over-threshold → 429. All fail on pre-fix code (no auth/bounds/limiter).
Follow-ups (noted, out of scope)
flashcard_import_service.check_rate_limitis a duplicate of the now-shared limiter and can migrate torequest_limits(would make it truly "shared" per the issue). Left untouched to avoid scope creep.main.py's globalHTTPExceptionhandler dropsexc.headers, so the 429 conveys the retry budget in thedetailstring rather than aRetry-Afterheader. Forwarding headers is a cross-cutting change worth its own PR.