Skip to content

Commit

Permalink
Merge pull request #40288 from nextcloud/feat/appframework/rate-limiter
Browse files Browse the repository at this point in the history
feat(appframework): Expose programmatic rate limiter
  • Loading branch information
nickvergessen authored Sep 21, 2023
2 parents b11ca34 + e477bb7 commit 3b6a9cd
Show file tree
Hide file tree
Showing 8 changed files with 123 additions and 2 deletions.
2 changes: 2 additions & 0 deletions lib/composer/composer/autoload_classmap.php
Original file line number Diff line number Diff line change
Expand Up @@ -588,6 +588,8 @@
'OCP\\Security\\IRemoteHostValidator' => $baseDir . '/lib/public/Security/IRemoteHostValidator.php',
'OCP\\Security\\ISecureRandom' => $baseDir . '/lib/public/Security/ISecureRandom.php',
'OCP\\Security\\ITrustedDomainHelper' => $baseDir . '/lib/public/Security/ITrustedDomainHelper.php',
'OCP\\Security\\RateLimiting\\ILimiter' => $baseDir . '/lib/public/Security/RateLimiting/ILimiter.php',
'OCP\\Security\\RateLimiting\\IRateLimitExceededException' => $baseDir . '/lib/public/Security/RateLimiting/IRateLimitExceededException.php',
'OCP\\Security\\VerificationToken\\IVerificationToken' => $baseDir . '/lib/public/Security/VerificationToken/IVerificationToken.php',
'OCP\\Security\\VerificationToken\\InvalidTokenException' => $baseDir . '/lib/public/Security/VerificationToken/InvalidTokenException.php',
'OCP\\Server' => $baseDir . '/lib/public/Server.php',
Expand Down
2 changes: 2 additions & 0 deletions lib/composer/composer/autoload_static.php
Original file line number Diff line number Diff line change
Expand Up @@ -621,6 +621,8 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2
'OCP\\Security\\IRemoteHostValidator' => __DIR__ . '/../../..' . '/lib/public/Security/IRemoteHostValidator.php',
'OCP\\Security\\ISecureRandom' => __DIR__ . '/../../..' . '/lib/public/Security/ISecureRandom.php',
'OCP\\Security\\ITrustedDomainHelper' => __DIR__ . '/../../..' . '/lib/public/Security/ITrustedDomainHelper.php',
'OCP\\Security\\RateLimiting\\ILimiter' => __DIR__ . '/../../..' . '/lib/public/Security/RateLimiting/ILimiter.php',
'OCP\\Security\\RateLimiting\\IRateLimitExceededException' => __DIR__ . '/../../..' . '/lib/public/Security/RateLimiting/IRateLimitExceededException.php',
'OCP\\Security\\VerificationToken\\IVerificationToken' => __DIR__ . '/../../..' . '/lib/public/Security/VerificationToken/IVerificationToken.php',
'OCP\\Security\\VerificationToken\\InvalidTokenException' => __DIR__ . '/../../..' . '/lib/public/Security/VerificationToken/InvalidTokenException.php',
'OCP\\Server' => __DIR__ . '/../../..' . '/lib/public/Server.php',
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,7 @@
<?php

declare(strict_types=1);

/**
* @copyright Copyright (c) 2016, ownCloud, Inc.
*
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,9 @@

use OC\AppFramework\Middleware\Security\Exceptions\SecurityException;
use OCP\AppFramework\Http;
use OCP\Security\RateLimiting\IRateLimitExceededException;

class RateLimitExceededException extends SecurityException {
class RateLimitExceededException extends SecurityException implements IRateLimitExceededException {
public function __construct() {
parent::__construct('Rate limit exceeded', Http::STATUS_TOO_MANY_REQUESTS);
}
Expand Down
3 changes: 2 additions & 1 deletion lib/private/Security/RateLimiting/Limiter.php
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,9 @@
use OC\Security\RateLimiting\Backend\IBackend;
use OC\Security\RateLimiting\Exception\RateLimitExceededException;
use OCP\IUser;
use OCP\Security\RateLimiting\ILimiter;

class Limiter {
class Limiter implements ILimiter {
public function __construct(
private IBackend $backend,
) {
Expand Down
4 changes: 4 additions & 0 deletions lib/private/Server.php
Original file line number Diff line number Diff line change
Expand Up @@ -143,6 +143,7 @@
use OC\Security\CSRF\CsrfTokenManager;
use OC\Security\CSRF\TokenStorage\SessionStorage;
use OC\Security\Hasher;
use OC\Security\RateLimiting\Limiter;
use OC\Security\SecureRandom;
use OC\Security\TrustedDomainHelper;
use OC\Security\VerificationToken\VerificationToken;
Expand Down Expand Up @@ -241,6 +242,7 @@
use OCP\Security\IHasher;
use OCP\Security\ISecureRandom;
use OCP\Security\ITrustedDomainHelper;
use OCP\Security\RateLimiting\ILimiter;
use OCP\Security\VerificationToken\IVerificationToken;
use OCP\Share\IShareHelper;
use OCP\SpeechToText\ISpeechToTextManager;
Expand Down Expand Up @@ -1419,6 +1421,8 @@ public function __construct($webRoot, \OC\Config $config) {

$this->registerAlias(\OCP\TextProcessing\IManager::class, \OC\TextProcessing\Manager::class);

$this->registerAlias(ILimiter::class, Limiter::class);

$this->connectDispatcher();
}

Expand Down
72 changes: 72 additions & 0 deletions lib/public/Security/RateLimiting/ILimiter.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,72 @@
<?php

declare(strict_types=1);

/*
* @copyright 2023 Christoph Wurst <christoph@winzerhof-wurst.at>
*
* @author 2023 Christoph Wurst <christoph@winzerhof-wurst.at>
*
* @license GNU AGPL version 3 or any later version
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/

namespace OCP\Security\RateLimiting;

use OCP\AppFramework\Http\Attribute\AnonRateLimit;
use OCP\AppFramework\Http\Attribute\UserRateLimit;
use OCP\IUser;

/**
* Programmatic rate limiter for web requests that are not handled by an app framework controller
*
* @see AnonRateLimit
* @see UserRateLimit
*
* @since 28.0.0
*/
interface ILimiter {
/**
* Registers attempt for an anonymous request
*
* @param string $identifier
* @param int $anonLimit
* @param int $anonPeriod in seconds
* @param string $ip
* @throws IRateLimitExceededException if limits are reached, which should cause a HTTP 429 response
* @since 28.0.0
*
*/
public function registerAnonRequest(string $identifier,
int $anonLimit,
int $anonPeriod,
string $ip): void;

/**
* Registers attempt for an authenticated request
*
* @param string $identifier
* @param int $userLimit
* @param int $userPeriod in seconds
* @param IUser $user the acting user
* @throws IRateLimitExceededException if limits are reached, which should cause a HTTP 429 response
* @since 28.0.0
*
*/
public function registerUserRequest(string $identifier,
int $userLimit,
int $userPeriod,
IUser $user): void;
}
36 changes: 36 additions & 0 deletions lib/public/Security/RateLimiting/IRateLimitExceededException.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
<?php

declare(strict_types=1);

/*
* @copyright 2023 Christoph Wurst <christoph@winzerhof-wurst.at>
*
* @author 2023 Christoph Wurst <christoph@winzerhof-wurst.at>
*
* @license GNU AGPL version 3 or any later version
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/

namespace OCP\Security\RateLimiting;

use Throwable;

/**
* Thrown if the (anonymous) user has exceeded a rate limit
*
* @since 28.0.0
*/
interface IRateLimitExceededException extends Throwable {
}

0 comments on commit 3b6a9cd

Please sign in to comment.