Repository navigation
fix(opds): add request bounds and Argon2 concurrency limits - #154
Draft
phildenhoff wants to merge 1 commit into
Draft
phildenhoff wants to merge 1 commit into
phildenhoff wants to merge 1 commit into
Conversation
phildenhoff
added this pull request to stack #156
September 18, 2026 00:24
This was referenced Sep 18, 2026
phildenhoff
changed the title
This was referenced Sep 18, 2026
libcalibre Test Coverage ReportOverall coverage: 83.86% Coverage breakdown available in the artifacts. |
phildenhoff
force-pushed
the
opds-10-hardening
branch
from
September 18, 2026 03:16
bd3c587 to
4ebc067
Compare
libcalibre Test Coverage ReportOverall coverage: 83.86% Coverage breakdown available in the artifacts. |
libcalibre Test Coverage ReportOverall coverage: 83.86% Coverage breakdown available in the artifacts. |
phildenhoff
force-pushed
the
opds-10-hardening
branch
from
September 18, 2026 17:11
4ebc067 to
d8e1bcf
Compare
libcalibre Test Coverage ReportOverall coverage: 84.01% Coverage breakdown available in the artifacts. |
libcalibre Test Coverage ReportOverall coverage: 84.01% Coverage breakdown available in the artifacts. |
phildenhoff
force-pushed
the
opds-10-hardening
branch
from
September 18, 2026 18:26
d8e1bcf to
4367973
Compare
libcalibre Test Coverage ReportOverall coverage: 84.01% Coverage breakdown available in the artifacts. |
libcalibre Test Coverage ReportOverall coverage: 84.01% Coverage breakdown available in the artifacts. |
phildenhoff
force-pushed
the
opds-10-hardening
branch
from
September 18, 2026 22:05
4367973 to
f58bfe2
Compare
libcalibre Test Coverage ReportOverall coverage: 84.01% Coverage breakdown available in the artifacts. |
libcalibre Test Coverage ReportOverall coverage: 84.01% Coverage breakdown available in the artifacts. |
fix(opds): cap Argon2 concurrency and request pressure Merge-blocking hardening from the v1 review: - Limit concurrent password verifications to 3 permits; excess requests get 503 with Retry-After without hashing or caching the header - Bound catalog feeds with a 30s timeout, 16KiB request-body limit, and a shared 64-request permit pool; asset downloads stay untimed - Reject link-local explicit listener addresses in the headless server and assert advertised URLs are IPv4-first without link-local entries - Note in the Sharing pane that generated passwords are shown once and travel unencrypted
phildenhoff
force-pushed
the
opds-10-hardening
branch
from
September 19, 2026 06:50
f58bfe2 to
03f2fc1
Compare
libcalibre Test Coverage ReportOverall coverage: 84.01% Coverage breakdown available in the artifacts. |
libcalibre Test Coverage ReportOverall coverage: 84.01% Coverage breakdown available in the artifacts. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The v1 server had no limits. Every Basic-auth attempt ran a fresh Argon2 hash, requests had no size or time bounds, and nothing capped concurrent work — one busy or hostile client could pin the CPU or pile up connections indefinitely.
What changed
Retry-Afterinstead of stacking up.Retry-Afterwithout hashing — covered by a test that drains the permits and asserts no hash runs and no result is cached...%2f,%2e%2e%2f…must not escape the book directory), and bind failures mapPermissionDeniedto its own error code instead of a generic unexpected.Honest note: all of these guards engage after headers arrive, so slowloris-style slow-header connections are a known, deferred gap.
Validation: the stack tip runs 62 citadel-opds tests + 348 workspace tests, all green.
Stack: #146 → #147 → #148 → #149 → #150 → #151 → #152 → #153 → #154 (this) → #155