diff options
| author | grm <grm@eyesin.space> | 2026-09-18 13:50:35 +0300 |
|---|---|---|
| committer | grm <grm@eyesin.space> | 2026-09-18 13:50:42 +0300 |
| commit | c3026c34b042cc044cddfc5674d5f5ad69bb845d (patch) | |
| tree | 7111e8fc310b193c510110e813befb00695a7597 /internal/web/templates/admin/git@git.eyesin.space: | |
| parent | c47397ac1e2ceafafe2be3cdec86366dd396ed6f (diff) | |
| download | blogspace-c3026c34b042cc044cddfc5674d5f5ad69bb845d.tar.gz blogspace-c3026c34b042cc044cddfc5674d5f5ad69bb845d.tar.bz2 blogspace-c3026c34b042cc044cddfc5674d5f5ad69bb845d.zip | |
Security: Throttle search, cap its words and give the query a deadline
/search runs an unindexed regular-expression scan over every published
post, built from up to fifty ".*"-joined words, for anyone who asks —
the cheapest way for a bot to keep Postgres busy. Queries are now cut
at eight words (more never improve the answer), each address gets
thirty searches and then thirty a minute, and the statement is
cancelled after five seconds; a timeout reads as no results and is
logged, rather than a 500.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A
Diffstat (limited to 'internal/web/templates/admin/git@git.eyesin.space:')
0 files changed, 0 insertions, 0 deletions