🛡️ Sentinel: [MEDIUM] Fix missing input length limits (DoS risk) - #10
🛡️ Sentinel: [MEDIUM] Fix missing input length limits (DoS risk)#10sunalan2025 wants to merge 1 commit into
Conversation
Co-authored-by: sunalan2025 <255776802+sunalan2025@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
There was a problem hiding this comment.
Pull request overview
Adds client-side hard limits to reduce the risk of browser memory exhaustion (DoS) during image upload and ZIP slice export in Picsew Web.
Changes:
- Enforces upload limits (max 50 images, max 50MB per image) with user alerts in
ImageUploader. - Adds a hard cap on ZIP slice generation (max 500 slices) to prevent extreme slice loops and crashes.
- Documents the DoS-prevention learning in
.jules/sentinel.md.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
src/components/ImageUploader.tsx |
Adds file-count and per-file size limits for image uploads. |
src/App.tsx |
Adds a maximum slice-count guard in ZIP export to prevent excessive memory use. |
.jules/sentinel.md |
Documents the DoS-prevention rationale and guidance. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| // SECURITY: Limit number of files to prevent DoS | ||
| let filesToProcess = files; | ||
| if (images.length + filesToProcess.length > 50) { | ||
| alert('最多只能添加 50 张图片 (Maximum 50 images allowed)'); | ||
| filesToProcess = filesToProcess.slice(0, Math.max(0, 50 - images.length)); | ||
| } | ||
|
|
||
| // SECURITY: Limit file size to prevent memory exhaustion (50MB) | ||
| const MAX_FILE_SIZE = 50 * 1024 * 1024; | ||
| const validFiles = filesToProcess.filter(f => { | ||
| if (!f.type.startsWith('image/')) return false; | ||
| if (f.size > MAX_FILE_SIZE) { | ||
| alert(`图片 ${f.name} 过大，最大允许 50MB (Image too large, max 50MB)`); | ||
| return false; | ||
| } | ||
| return true; | ||
| }); |
🚨 Severity: MEDIUM
💡 Vulnerability: Missing input limits on client-side image uploads and canvas slice generation could lead to memory exhaustion and browser crashes (Denial of Service).
🎯 Impact: A user uploading too many files, files that are excessively large, or choosing an extremely small slice height could cause the application to allocate massive amounts of memory, freezing or crashing the browser.
🔧 Fix: Added a 50 file limit, 50MB file size limit for uploads in
src/components/ImageUploader.tsx. Added a 500 slice hard cap to the ZIP generation function insrc/App.tsx. Added alerts to inform the user of the limits.✅ Verification: Verified via
pnpm lintandpnpm build. No regressions introduced.PR created automatically by Jules for task 13853534976734043118 started by @sunalan2025