torjus/apiary
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix DOS using query endpoint #1

Merged
torjus merged 1 commits from bug/query-dos into master 2022-02-09 14:10:08 +00:00
Conversation 0 Commits 1 Files Changed 1 +6 -7
1 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
honeypot/ssh/store/postgres.go
View File

@ -173,23 +173,23 @@ func (s *PostgresStore) Query(query AttemptQuery) ([]models.LoginAttempt, error)
var stmt string
queryString := query.Query
const limit = 10000
switch query.QueryType {
case AttemptQueryTypeIP:
stmt = `SELECT id, date, remote_ip, username, password, client_version, connection_uuid, country
FROM login_attempts WHERE remote_ip = $1`
FROM login_attempts WHERE remote_ip = $1 order by date desc limit $2`
case AttemptQueryTypePassword:
stmt = `SELECT id, date, remote_ip, username, password, client_version, connection_uuid, country
FROM login_attempts WHERE password like $1`
queryString = fmt.Sprintf("%%%s%%", queryString)
FROM login_attempts WHERE password = $1 order by date desc limit $2`
case AttemptQueryTypeUsername:
stmt = `SELECT id, date, remote_ip, username, password, client_version, connection_uuid, country
FROM login_attempts WHERE username like $1`
queryString = fmt.Sprintf("%%%s%%", queryString)
FROM login_attempts WHERE username = $1 order by date desc limit $2`
default:
return nil, fmt.Errorf("invalid query type")
}
rows, err := s.db.Query(stmt, queryString)
rows, err := s.db.Query(stmt, queryString, limit)
if err != nil {
return nil, fmt.Errorf("unable to query database: %w", err)
}
@ -204,7 +204,6 @@ func (s *PostgresStore) Query(query AttemptQuery) ([]models.LoginAttempt, error)
}
la.RemoteIP = net.ParseIP(ipString)
results = append(results, la)
}
return results, nil