Skip to content

Conversation

@aliu39
Copy link
Member

@aliu39 aliu39 commented Oct 18, 2024

The save_userreport function allows some flexibility for duplicated requests by updating an existing report with the same project + event id, instead of failing. This is as long as that report was saved in the last 5min.

We enforce this 5min time limit to prevent what the comments call "replay attacks" -- repeatedly spamming the API with reports on the same event. But atm the code updates date_added, so this 5min check is basically useless. date_added is always the time of the last request, so we could be spammed indefinitely.

@aliu39 aliu39 requested a review from a team as a code owner October 18, 2024 22:35
@aliu39 aliu39 requested a review from a team October 18, 2024 22:35
@github-actions github-actions bot added the Scope: Backend Automatically applied to PRs that change backend components label Oct 18, 2024
@aliu39 aliu39 enabled auto-merge (squash) October 18, 2024 22:39
@aliu39 aliu39 merged commit 615a24b into master Oct 18, 2024
50 checks passed
@aliu39 aliu39 deleted the aliu/ur-replay-attack-fix branch October 18, 2024 23:10
jan-auer added a commit that referenced this pull request Oct 21, 2024
* master: (288 commits)
  feat(metrics): Register MRI for spans/count_per_root_project (#78992)
  feat(dynamic-sampling): Settings for sample rate (#79341)
  Revert "feat(sentry-sdk): Enable HTTP2 transport" (#79391)
  fix(feedback): keep oldest date_added for duplicate user reports (#79387)
  chore(issue-stream): Remove tooltip for Unhandled (#79385)
  chore(autofix): Show banner if gen AI consent is given, even if no feature flag (#79362)
  chore(autofix+copilot) Allow autofix without FF if gen AI consent given (#79361)
  Fixes VULN-50 by enforcing option (#79384)
  perf(issues): improve adjacent_events query (#79365)
  feat(issues): Add anchor links back to issue sections (#79333)
  fix(issue-views): Make tab bar take up entire row (#79383)
  chore(issues): Add additional metrics for ownership matching (#79302)
  feat(insights): create screen rendering module (#79192)
  fix(issues): Avoid streamline issue layout rerenders (#79327)
  ref(performance): Add missing types to performance widgets (#79301)
  chore(issue-views): Add translation wrapper to aria label (#79320)
  chore(issue-stream): Reduce font size of title and message (#79378)
  feat(insights): update headers and breadcrumbs on frontend domain view (#78945)
  feat(insights): add view trends button to ai overview (#78611)
  ref(rr6): Remove unused param (#79379)
  ...
@github-actions github-actions bot locked and limited conversation to collaborators Nov 3, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Scope: Backend Automatically applied to PRs that change backend components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants