Hardening: cap the invite_user list size in UpdateQuestionInviteUser to bound notification fan-out
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
Research direction
Start at internal/schema/question_schema.go:206 and trace the validation for the invite_user array used by PUT /answer/api/v1/question/invite. Find the UI's existing invite limit, then verify how oversized requests are handled and add matching coverage if the repository has tests for this schema or endpoint. Done means the server enforces a maximum and prevents unbounded notification fan-out.
Written by the indexing model from the issue text.
Description
Background
PUT /answer/api/v1/question/invite accepts an uncapped invite_user array (internal/schema/question_schema.go:206), so a single request can trigger a large number of "invited you to answer" notifications.
I reported this privately to the ASF security team. They confirmed the endpoint's rank-gated, site-wide behaviour is by design (not a boundary crossing), but noted the missing maximum on invite_user reads as hardening. Filing here per that suggestion.
Suggested hardening
- Add a sane server-side maximum on
invite_user(e.g. matching the UI's limit) to bound the notification fan-out.
Happy to send a PR.
- Dominant language
- Go
- Stars
- 15.7k
- Forks
- 1.4k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 6
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from apache/answer
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Gravatar hash is computed from the un-lowercased email, so mixed-case accounts render an identicon Open
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Similar issues
-
textual definition
Difficulty 1/5 Under an hour Newbie friendliness 90/100
geneontology/go-ontology#32653 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 75/100
-
needs design
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Priority/High ready-for-agent Severity/Major Type/Bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100