robocanic commented on code in PR #1542: URL: https://github.com/apache/dubbo-admin/pull/1542#discussion_r3932347536
########## pkg/console/auth/service.go: ########## Review Comment: 每次匿名访问 provider 登录端点都会向这个无上限 map 写入随机 state，并且 Put 会遍历全部现存项。攻击者持续请求可同时造成十分钟窗口内的内存增长和 O(n²) CPU 开销；一轮请求结束后，过期项还会一直保留到下一次 Put。建议改用有容量上限的 TTL 缓存/定时清理，并增加每会话限制或速率限制。 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
