sillsdev / sillsdev/serval

No pagination on list endpoints (DoS)

Open
#972 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C#
Stars
3
Forks
2
Avg merge
3d 1h
Merged PRs (30d)
3

Description

GetAllPretranslations and other GetAll* handlers under src/Serval/src/Serval.Translation/Features/Engines/ and src/Serval/src/Serval.WordAlignment/ materialize the entire result set into memory and JSON (potentially millions of pretranslation rows). A single request can drive memory pressure / OOM and long GC pauses.

Fix: Add server-enforced pagination (page-size cap, e.g. 1000) and stream results (IAsyncEnumerable) rather than buffering whole lists.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by auditing GetAllPretranslations and the other GetAll* handlers under src/Serval/src/Serval.Translation/Features/Engines/ and src/Serval/src/Serval.WordAlignment/. Confirm how each endpoint currently materializes results, then verify that every affected endpoint enforces a page-size cap and streams results without buffering the full collection.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
api, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.