You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:34:07 UTC

[I] Documented Rate Limits Missing on Multiple API Endpoints (tooling-trusted-releases)

asf-tooling opened a new issue, #969:
URL: https://github.com/apache/tooling-trusted-releases/issues/969

   **ASVS Level(s):** [L1]
   
   **Description:**
   
   ### Summary
   Security documentation explicitly states that sensitive endpoints have 10 requests per hour rate limits. However, multiple endpoints are documented with this limit but lack the `@rate_limiter.rate_limit` decorator in their implementation: `/api/key/delete`, `/api/distribute/record_from_workflow`, `/api/distribute/task/status`. This creates false confidence in the security posture. Authenticated users can call these endpoints up to 500 times per hour (API-wide limit) instead of the documented 10 times per hour.
   
   ### Details
   **Affected Files and Lines:**
   - `atr/api/__init__.py:~390-420` - key_delete without rate limit
   - `atr/api/__init__.py:~270` - distribution_record_from_workflow without rate limit
   - `atr/api/__init__.py:~540` - update_distribution_task_status without rate limit
   - `security/ASVS/audit_guidance/authentication-security.md` - Documentation with rate limits
   
   The documentation promises 10 requests/hour but the implementation allows 500 requests/hour, creating a 50x gap between documented and actual behavior.
   
   ### Recommended Remediation
   Add `@rate_limiter.rate_limit(10, datetime.timedelta(hours=1))` decorator to all three endpoints:
   
   ```python
   @rate_limiter.rate_limit(10, datetime.timedelta(hours=1))
   async def key_delete(...):
       ...
   
   @rate_limiter.rate_limit(10, datetime.timedelta(hours=1))
   async def distribution_record_from_workflow(...):
       ...
   
   @rate_limiter.rate_limit(10, datetime.timedelta(hours=1))
   async def update_distribution_task_status(...):
       ...
   ```
   
   ### Acceptance Criteria
   - [ ] Rate limit decorator added to key_delete
   - [ ] Rate limit decorator added to distribution_record_from_workflow
   - [ ] Rate limit decorator added to update_distribution_task_status
   - [ ] Implementation matches documentation
   - [ ] Integration test verifies enforcement
   - [ ] Unit test verifying the fix
   
   ### References
   - Source reports: L1:6.1.1.md, L1:6.3.1.md
   - Related findings: FINDING-124
   - ASVS sections: 6.1.1, 6.3.1
   
   ### Priority
   High
   
   ---


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org

Re: [I] Documented Rate Limits Missing on Multiple API Endpoints (tooling-trusted-releases)

Posted by "alitheg (via GitHub)" <gi...@apache.org>.
alitheg commented on issue #969:
URL: https://github.com/apache/tooling-trusted-releases/issues/969#issuecomment-4163799934

   Closed by 1d6046c0 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org

Re: [I] Documented Rate Limits Missing on Multiple API Endpoints (tooling-trusted-releases)

Posted by "alitheg (via GitHub)" <gi...@apache.org>.
alitheg closed issue #969: Documented Rate Limits Missing on Multiple API Endpoints
URL: https://github.com/apache/tooling-trusted-releases/issues/969


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org