marcel/familienarchiv
1
0
Fork 0
Code Issues 107 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(security): cap PersonController size param at 50 to prevent resource exhaustion

Browse Source 
Addresses @Nora review: ?sort=documentCount&size=999999 could trigger a
full-table query and large serialization. Cap enforced at controller boundary.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Marcel
2026-05-07 22:18:04 +02:00
parent bd8a20fee0
commit d932f24694
2 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
backend/src/main/java/org/raddatz/familienarchiv/person/PersonController.java
View File

@@ -40,7 +40,8 @@ public class PersonController {
@RequestParam(required = false, defaultValue = "0") int size, @RequestParam(required = false, defaultValue = "0") int size,
@RequestParam(required = false) String sort) { @RequestParam(required = false) String sort) {
if ("documentCount".equals(sort) && size > 0 && q == null) { if ("documentCount".equals(sort) && size > 0 && q == null) {
return ResponseEntity.ok(personService.findTopByDocumentCount(size)); int safeSize = Math.min(size, 50);
return ResponseEntity.ok(personService.findTopByDocumentCount(safeSize));
} }
return ResponseEntity.ok(personService.findAll(q)); return ResponseEntity.ok(personService.findAll(q));
} }

12
backend/src/test/java/org/raddatz/familienarchiv/person/PersonControllerTest.java
View File

@@ -92,6 +92,18 @@ class PersonControllerTest {
.andExpect(jsonPath("$[0].firstName").value("Käthe")); .andExpect(jsonPath("$[0].firstName").value("Käthe"));
} }
@Test
@WithMockUser(authorities = "READ_ALL")
void getPersons_capsTopByDocumentCount_atFifty() throws Exception {
ArgumentCaptor<Integer> sizeCaptor = ArgumentCaptor.forClass(Integer.class);
when(personService.findTopByDocumentCount(sizeCaptor.capture())).thenReturn(Collections.emptyList());
mockMvc.perform(get("/api/persons").param("sort", "documentCount").param("size", "999"))
.andExpect(status().isOk());
assertThat(sizeCaptor.getValue()).isEqualTo(50);
}
private PersonSummaryDTO mockPersonSummary(String firstName, String lastName) { private PersonSummaryDTO mockPersonSummary(String firstName, String lastName) {
return new PersonSummaryDTO() { return new PersonSummaryDTO() {
public java.util.UUID getId() { return UUID.randomUUID(); } public java.util.UUID getId() { return UUID.randomUUID(); }