ipfs / pinning-services-api-spec

Standalone, vendor-agnostic Pinning Service API for IPFS ecosystem
https://ipfs.github.io/pinning-services-api-spec/
Creative Commons Zero v1.0 Universal
100 stars 27 forks source link

Limit size of param and request/response arrays #20

Closed lidel closed 4 years ago

lidel commented 4 years ago

This PR

Docs preview for this PR: https://bafybeid6e52x5oyeeefa27r3yszp7r64j6i4tekznjkoqvc4tw3qh3sxry.ipfs.dweb.link/


@obo20 this change adds hard limit to all arrays (params and in /pins request/response):

maxItems: 1000

Let us know if this is ok or should be adjusted (we'd like to keep the same limit everywhere, for simplicity)

jacobheun commented 4 years ago

This looks good for results, however, I don't think https://github.com/ipfs/pinning-services-api-spec/issues/15#issuecomment-656742892 was addressed. IIUC this is requesting to also limit the number of cids in the query param. Right now there's nothing explicitly stating I can't just pass in 10k cids. I'll only get 1k max results back.

We should limit what we allow there for performance and possible server query param length collision issues.

lidel commented 4 years ago

@jacobheun I believe maxItems in the definition of cid array parameter guards us against the scenario described in https://github.com/ipfs/pinning-services-api-spec/issues/15#issuecomment-656742892:

https://github.com/ipfs/pinning-services-api-spec/blob/2cacfb1ffdd461d4412d780fe6497cdb2805087e/ipfs-pinning-service.yaml#L313-L324

GET /pins?cid=.. with more than 1000 CIDs will be rejected.

If I misread your comment, let me know!