discourse/lib/bookmark_query.rb
Alan Guo Xiang Tan bfc3132bb2
SECURITY: Impose a upper bound on limit params in various controllers
What is the problem here?

In multiple controllers, we are accepting a `limit` params but do not
impose any upper bound on the values being accepted. Without an upper
bound, we may be allowing arbituary users from generating DB queries
which may end up exhausing the resources on the server.

What is the fix here?

A new `fetch_limit_from_params` helper method is introduced in
`ApplicationController` that can be used by controller actions to safely
get the limit from the params as a default limit and maximum limit has
to be set. When an invalid limit params is encountered, the server will
respond with the 400 response code.
2023-07-28 12:53:46 +01:00

92 lines
3.1 KiB
Ruby

# frozen_string_literal: true
##
# Allows us to query Bookmark records for lists. Used mainly
# in the user/activity/bookmarks page.
class BookmarkQuery
def self.on_preload(&blk)
(@preload ||= Set.new) << blk
end
def self.preload(bookmarks, object)
preload_polymorphic_associations(bookmarks, object.guardian)
@preload.each { |preload| preload.call(bookmarks, object) } if @preload
end
# These polymorphic associations are loaded to make the UserBookmarkListSerializer's
# life easier, which conditionally chooses the bookmark serializer to use based
# on the type, and we want the associations all loaded ahead of time to make
# sure we are not doing N+1s.
def self.preload_polymorphic_associations(bookmarks, guardian)
Bookmark.registered_bookmarkables.each do |registered_bookmarkable|
registered_bookmarkable.perform_preload(bookmarks, guardian)
end
end
attr_reader :guardian, :count
def initialize(user:, guardian: nil, search_term: nil, page: nil, per_page: nil)
@user = user
@search_term = search_term
@guardian = guardian || Guardian.new(@user)
@page = page ? page.to_i : 0
@per_page = per_page ? per_page.to_i : 20
@count = 0
end
def list_all(&blk)
ts_query = @search_term.present? ? Search.ts_query(term: @search_term) : nil
search_term_wildcard = @search_term.present? ? "%#{@search_term}%" : nil
queries =
Bookmark
.registered_bookmarkables
.map do |bookmarkable|
interim_results = bookmarkable.perform_list_query(@user, @guardian)
# this could occur if there is some security reason that the user cannot
# access the bookmarkables that they have bookmarked, e.g. if they had 1 bookmark
# on a topic and that topic was moved into a private category
next if interim_results.blank?
if @search_term.present?
interim_results =
bookmarkable.perform_search_query(interim_results, search_term_wildcard, ts_query)
end
# this is purely to make the query easy to read and debug, otherwise it's
# all mashed up into a massive ball in MiniProfiler :)
"---- #{bookmarkable.model.to_s} bookmarkable ---\n\n #{interim_results.to_sql}"
end
.compact
# same for interim results being blank, the user might have been locked out
# from all their various bookmarks, in which case they will see nothing and
# no further pagination/ordering/etc is required
return [] if queries.empty?
union_sql = queries.join("\n\nUNION\n\n")
results = Bookmark.select("bookmarks.*").from("(\n\n#{union_sql}\n\n) as bookmarks")
results =
results.order(
"(CASE WHEN bookmarks.pinned THEN 0 ELSE 1 END),
bookmarks.reminder_at ASC,
bookmarks.updated_at DESC",
)
@count = results.count
results = results.offset(@page * @per_page) if @page.positive?
if updated_results = blk&.call(results)
results = updated_results
end
results = results.limit(@per_page).to_a
BookmarkQuery.preload(results, self)
results
end
end