clockworklabs / clockworklabs/SpacetimeDB
client reducer call args missmatch log spam
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 25.2k
- Forks
- 1.1k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 46
Description
during some testing i found that the server logs each time a client sends a bad reducer call with a log like this
this is one client calling it every 100ms with bad parameters.
- one log would be enough per client
- it should disconnect the client as the client is clearly broken or someone is trying to make a custom client and got the parameters wrong.
right now this is a DOS attack point as it fills the logs and as reducers aren't rate limited, it can spam the logs with a call every microsecond or faster. (1000+ bad requests per second but theoretically 10k+ bad requests per second).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the server path that handles invalid reducer calls and emits the shown log. Verify the behavior for repeated bad calls from one client, then add coverage showing that logging is limited and the offending client is disconnected without allowing continued log or request flooding.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- backend, observability, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100