Limit number of items read from community outbox #84

nutomic · 2020-08-13T12:32:12Z

nutomic commented

2020-08-13 12:32:12 +00:00

Without this, a hostile instance could send an outbox with 1000 or more items, and completely overload any Lemmy instance that tries to follow it.

I believe this is the only place where we fetch items in a loop, so this should be a fix for limit number of additional fetches for each activtypub object or activity in #647. But maybe we should still add some kind of counter to be sure.

Without this, a hostile instance could send an outbox with 1000 or more items, and completely overload any Lemmy instance that tries to follow it. I believe this is the only place where we fetch items in a loop, so this should be a fix for `limit number of additional fetches for each activtypub object or activity` in [#647](https://github.com/LemmyNet/lemmy/issues/647). But maybe we should still add some kind of counter to be sure.

nutomic reviewed 2020-08-13 12:32:28 +00:00

server/lemmy_utils/src/lib.rs

						
				@ -161,3 +161,3 @@

				// Can't do a regex here, reverse lookarounds not supported

				pub fn is_valid_preferred_username(preferred_username: &str) -> bool {

				  !preferred_username.starts_with("@")

				  !preferred_username.starts_with('@')