search

marylinh / owasp-esapi-java

Automatically exported from code.google.com/p/owasp-esapi-java
Other
0 stars 0 forks source link

RequestRateThrottleFilter may not work as expected with hits=1 or hits=2 #317

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago 
As stated in my comment 
(https://code.google.com/p/owasp-esapi-java/source/browse/trunk/src/main/java/or
g/owasp/esapi/filters/RequestRateThrottleFilter.java?spec=svn1940&r=1940#86), 
RequestRateThrottleFilter may not work as expected when configured with hits=1 
or hits=2.

I would like to suggest another implementation (see the attached patch).

Thanks,
Eric.

Original issue reported on code.google.com by eric.cit...@gmail.com on 1 Jan 2014 at 6:11

Attachments:

GoogleCodeExporter commented 9 years ago 
I think that there's an implicit assumption that 'hits' would never be 
configured to be set to one as that would mean that no request could be made at 
all within any time period, but you have a valid point for when 'hits' is 2.

I've not yet scrutinized your patch in any depth, but this is also the first 
time that I've really took anything more than a very superficial look at 
RequestRateThrottleFilter. That said, your patch is more in line with how I 
would have written this. I will take a look at it when I get a bit more time. 
Thanks.

Original comment by kevin.w.wall@gmail.com on 2 Jan 2014 at 5:25

GoogleCodeExporter commented 9 years ago 
Thank you for your reply.

IMHO, hits=1 is a valid value. The way I understand it is that "you can do no 
more than 1 request in any period of 2 seconds". In other words: you just made 
a request, fine! now wait for 2 seconds before making another one.

Original comment by eric.cit...@gmail.com on 3 Jan 2014 at 2:56

GoogleCodeExporter commented 9 years ago 
Eric,
Would you like this work to be considered for the ESAPI hackathon contest? If 
so, please email me ASAP. Thanks.
-kevin wall <kevin.w.wall@gmail.com>

Original comment by kevin.w.wall@gmail.com on 23 Jan 2014 at 6:45

GoogleCodeExporter commented 9 years ago 
See related issue # 141.

Original comment by kevin.w.wall@gmail.com on 18 Sep 2014 at 8:49

GoogleCodeExporter commented 9 years ago 
Disregard previous comment. Won't fix 141.

Original comment by kevin.w.wall@gmail.com on 18 Sep 2014 at 8:51