fix(proxy): Add image proxy rate limit

Signed-off-by: Christoph Wurst <[email protected]>
nextcloud · Aug 9, 2023 · 89507cf · 89507cf
1 parent 3b19f12
commit 89507cf
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/lib/Controller/ProxyController.php b/lib/Controller/ProxyController.php
@@ -29,6 +29,7 @@
 use Exception;
 use OCA\Mail\Http\ProxyDownloadResponse;
 use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http\Attribute\UserRateLimit;
 use OCP\AppFramework\Http\TemplateResponse;
 use OCP\Http\Client\IClientService;
 use OCP\IRequest;
@@ -93,6 +94,7 @@ public function redirect(string $src): TemplateResponse {
 	/**
 	 * @NoAdminRequired
 	 * @NoCSRFRequired
+	 * @UserRateThrottle(limit=50, period=60)
 	 *
 	 * @param string $src
 	 *
@@ -102,6 +104,7 @@ public function redirect(string $src): TemplateResponse {
 	 *
 	 * @return ProxyDownloadResponse
 	 */
+	#[UserRateLimit(limit: 50, period: 60)]
 	public function proxy(string $src): ProxyDownloadResponse {
 		// close the session to allow parallel downloads
 		$this->session->close();

diff --git a/psalm.xml b/psalm.xml
@@ -19,6 +19,11 @@
 		<directory name="lib/Vendor" />
     </extraFiles>
 	<issueHandlers>
+		<UndefinedAttributeClass>
+			<errorLevel type="info">
+				<referencedClass name="OCP\AppFramework\Http\Attribute\UserRateLimit" />
+			</errorLevel>
+		</UndefinedAttributeClass>
 		<UndefinedClass>
 			<errorLevel type="suppress">
 				<referencedClass name="Doctrine\DBAL\Platforms\MySQLPlatform" />