UTXOnly / nostpy-relay

A nostr relay backed by a postgresql database, run with docker-compose
The Unlicense
17 stars 6 forks source link

[BUG] unbounded query limit #40

Closed UTXOnly closed 8 months ago

UTXOnly commented 9 months ago

The problem

Query limit is determined by the {'limit': '...'} filter, which defaults to a value of 100 if no limit filter exists. There is nothing preventing the query limit from being larger than 100 if say {'limit': '5000}` was sent as a filter

Example of a problem query:

2024-02-18 21:56:54,586 - DEBUG - SQL query constructed: SELECT * FROM events WHERE kind = ANY(ARRAY [1, 7, 9735]) AND created_at > 1708293279 AND pubkey = ANY(ARRAY ['b97b26c3ec44390727b5800598a9de42b222ae7b5402abcf13d2ae8f386e4e0c', 'd576043ce19fa2cb684de60ffb8fe529e420a1411b96b6788f11cb0442252eea']) AND  EXISTS ( SELECT 1 FROM jsonb_array_elements(tags) as elem WHERE elem::text LIKE '%search%') ORDER BY created_at LIMIT 300 ;

Possible solution

sanitize_event_keys needs to be updated to include a limit to the limit using .min() method