Repository navigation
fix(search): bound query length before pg-tsquery (ReDoS guard — sweep F6) - #7
Merged
Merged
Conversation
…p F6) pg-tsquery 8.4.2's word regex backtracks O(N^2), so an unbounded SearchDTO.query (tens of thousands of `&` then `>`) blocked Node's event loop for seconds BEFORE any DB call — a low-privileged, and via @public /search/share-search UNAUTHENTICATED, availability DoS. - Fork clamp at the TOP of PdpSearchService.searchPage, ahead of the `super.searchPage` delegation, so the ONE fork choke point covers both the authenticated /search path and the anonymous share path (which reaches the upstream tsquery via super) — rejects >1024-char queries with 400. - DTO @maxlength(MAX_SEARCH_QUERY_LENGTH=1024) on SearchDTO.query and SearchSuggestionDTO.query (SearchShareDTO inherits) — global ValidationPipe rejects at the edge for every search route. Documented as upstream seam #42. - Both bounds share the exported MAX_SEARCH_QUERY_LENGTH so they can't drift. - Tests: over-length rejection on authed + public paths, inclusive boundary, fast parse of a max-length backtracking run, and DTO @maxlength validation. Co-Authored-By: Claude Opus 4.8 <[email protected]>
PMQ9
force-pushed
the
fix/security-sweep-f6-search-redos
branch
from
September 2, 2026 18:35
d3071b7 to
643f1e2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Security sweep 2026-09-02 finding F6 (MEDIUM) — unbounded search query → pg-tsquery ReDoS.
[email protected]'s word regex backtracks O(N²), so an unboundedSearchDTO.query(tens of thousands of&then>) blocked Node's event loop for seconds before any DB call — a low-privileged, and via the@PublicPOST /search/share-searchroute unauthenticated, availability DoS.Fix (defense in depth)
PdpSearchService.searchPage, ahead of thesuper.searchPage(...)delegation, so the one fork-owned choke point covers both the authenticated/searchpath and the anonymous share path (which reaches the upstreamtsqueryviasuper). Rejects>1024-char queries with400.@MaxLength(MAX_SEARCH_QUERY_LENGTH=1024)onSearchDTO.queryandSearchSuggestionDTO.query(SearchShareDTOinherits) — the globalValidationPiperejects at the edge for every search route. Documented as upstream seam fix(auth): __Host- the Docmost session cookie to stop sibling-origin shadowing (cccvu/wiki-v2#310) #42 in the superproject'sUPSTREAM_MODIFICATIONS.md.MAX_SEARCH_QUERY_LENGTHso they can't drift.Tests
authz/search/pdp-search.service.spec.ts— over-length rejection on both the authenticated and unauthenticated public-share paths, inclusive boundary (length === 1024proceeds), a max-length backtracking run parses fast (no event-loop block), and@MaxLengthDTO validation for all three DTOs. All 24authz/searchtests pass.Paired with the superproject PR (F3/F4/F6). Boundary check + all fork search specs green.
🤖 Generated with Claude Code