EspressoSystems / hotshot-query-service

Generic query service for HotShot applications
https://espressosystems.github.io/hotshot-query-service/
GNU General Public License v3.0
5 stars 1 forks source link

Limit size of ranges in range queries #740

Closed jbearer closed 1 week ago

jbearer commented 1 week ago

Fixes a vulnerability where a client can request an arbitrarily large range of objects, forcing the server to make a very expensive SQL query and load a large amount of data into memory. We now put a hard limit on availability range queries and the header timestamp window query.