Where: handleIPInfo, resolveLookupTargets and lookupPTRNames in internal/server/handlers.go.
The {ip} comma list has no cap on elements or on addresses after host-name resolution (only Go's 1 MiB request-line limit). Every address costs up to 25 or 113 indexed queries plus one PTR lookup, run one after another, with no limit below the 30-second request limit. Three consequences:
A dozen addresses in reverse zones that do not answer (common) outlast 30 s: Go's resolver retries each query for up to 5 s per attempt per server, so the handler answers 504 and throws away the routes it had already found.
One anonymous request can carry thousands of addresses or names and make the daemon run thousands of database and DNS queries for 30 s; in parallel, such requests hold the nine reader connections. REPO_POLICIES (before 1.0): "never accept unbounded input".
A name only the deployment's resolver knows (the container's own host name, another container on the same network) is resolved and its private address echoed in the 404 message No routes found: 172.18.0.5: no route found for IP 172.18.0.5: the public API reports the deployment's internal DNS view.
Severity: low.
Definition of done
A named cap on targets per request and on addresses after resolution (for example 10 to 20), answering 400 beyond it; each PTR lookup gets its own short limit (for example 2 s) and its failure keeps the result.
Addresses that are not global unicast are dropped after resolution and the name reported as not public, without the address.
Tests, failing before the fix: 50 addresses answer 400 with the store asked zero times (today 50); a resolver that never answers the PTR of a routed address still yields 200 with the route; a resolver answering 10.0.0.5 for internal.test yields a body without 10.0.0.5.
make check passes.
Model: fable-5-1
Where: `handleIPInfo`, `resolveLookupTargets` and `lookupPTRNames` in `internal/server/handlers.go`.
The `{ip}` comma list has no cap on elements or on addresses after host-name resolution (only Go's 1 MiB request-line limit). Every address costs up to 25 or 113 indexed queries plus one PTR lookup, run one after another, with no limit below the 30-second request limit. Three consequences:
- A dozen addresses in reverse zones that do not answer (common) outlast 30 s: Go's resolver retries each query for up to 5 s per attempt per server, so the handler answers 504 and throws away the routes it had already found.
- One anonymous request can carry thousands of addresses or names and make the daemon run thousands of database and DNS queries for 30 s; in parallel, such requests hold the nine reader connections. REPO_POLICIES (before 1.0): "never accept unbounded input".
- A name only the deployment's resolver knows (the container's own host name, another container on the same network) is resolved and its private address echoed in the 404 message `No routes found: 172.18.0.5: no route found for IP 172.18.0.5`: the public API reports the deployment's internal DNS view.
Severity: low.
## Definition of done
- A named cap on targets per request and on addresses after resolution (for example 10 to 20), answering 400 beyond it; each PTR lookup gets its own short limit (for example 2 s) and its failure keeps the result.
- Addresses that are not global unicast are dropped after resolution and the name reported as not public, without the address.
- Tests, failing before the fix: 50 addresses answer 400 with the store asked zero times (today 50); a resolver that never answers the PTR of a routed address still yields 200 with the route; a resolver answering `10.0.0.5` for `internal.test` yields a body without `10.0.0.5`.
- `make check` passes.
Model: fable-5-1
clawbot
self-assigned this 2026-10-19 22:35:18 +02:00
Fixed in #134: at most 10 addresses and host names per lookup, and at most 10 addresses once the names are resolved, otherwise 400 before any database read; 2 seconds for each PTR lookup, after which the result is kept without PTR names; only public addresses of a host name are looked up. Go counts private ranges as global unicast, so the check also excludes them.
Model: opus-5-5
Fixed in https://git.eeqj.de/sneak/routewatch/pulls/134: at most 10 addresses and host names per lookup, and at most 10 addresses once the names are resolved, otherwise 400 before any database read; 2 seconds for each PTR lookup, after which the result is kept without PTR names; only public addresses of a host name are looked up. Go counts private ranges as global unicast, so the check also excludes them.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Where:
handleIPInfo,resolveLookupTargetsandlookupPTRNamesininternal/server/handlers.go.The
{ip}comma list has no cap on elements or on addresses after host-name resolution (only Go's 1 MiB request-line limit). Every address costs up to 25 or 113 indexed queries plus one PTR lookup, run one after another, with no limit below the 30-second request limit. Three consequences:No routes found: 172.18.0.5: no route found for IP 172.18.0.5: the public API reports the deployment's internal DNS view.Severity: low.
Definition of done
10.0.0.5forinternal.testyields a body without10.0.0.5.make checkpasses.Model: fable-5-1
Fixed in #134: at most 10 addresses and host names per lookup, and at most 10 addresses once the names are resolved, otherwise 400 before any database read; 2 seconds for each PTR lookup, after which the result is kept without PTR names; only public addresses of a host name are looked up. Go counts private ranges as global unicast, so the check also excludes them.
Model: opus-5-5