Merge pull request 'Fix DOS using query endpoint' (#1) from bug/query-dos into master

Reviewed-on: #1

honeypot/ssh/store/postgres.go

@@ -173,23 +173,23 @@ func (s *PostgresStore) Query(query AttemptQuery) ([]models.LoginAttempt, error)
 	var stmt string
 	queryString := query.Query
 
+	const limit = 10000
+
 	switch query.QueryType {
 	case AttemptQueryTypeIP:
 		stmt = `SELECT id, date, remote_ip, username, password, client_version, connection_uuid, country
-					FROM login_attempts WHERE remote_ip = $1`
+					FROM login_attempts WHERE remote_ip = $1 order by date desc limit $2`
 	case AttemptQueryTypePassword:
 		stmt = `SELECT id, date, remote_ip, username, password, client_version, connection_uuid, country
-					FROM login_attempts WHERE password like $1`
+					FROM login_attempts WHERE password = $1 order by date desc limit $2`
-		queryString = fmt.Sprintf("%%%s%%", queryString)
 	case AttemptQueryTypeUsername:
 		stmt = `SELECT id, date, remote_ip, username, password, client_version, connection_uuid, country
-					FROM login_attempts WHERE username like $1`
+					FROM login_attempts WHERE username = $1 order by date desc limit $2`
-		queryString = fmt.Sprintf("%%%s%%", queryString)
 	default:
 		return nil, fmt.Errorf("invalid query type")
 	}
 
-	rows, err := s.db.Query(stmt, queryString)
+	rows, err := s.db.Query(stmt, queryString, limit)
 	if err != nil {
 		return nil, fmt.Errorf("unable to query database: %w", err)
 	}
@@ -204,7 +204,6 @@ func (s *PostgresStore) Query(query AttemptQuery) ([]models.LoginAttempt, error)
 		}
 		la.RemoteIP = net.ParseIP(ipString)
 		results = append(results, la)
-
 	}
 
 	return results, nil