Skip to content

πŸ›‘οΈ Sentinel: [MEDIUM] Add timeouts to all fetch requests to prevent DoS#93

Closed
schmug wants to merge 1 commit into
mainfrom
sentinel-add-fetch-timeouts-5442296514920212647
Closed

πŸ›‘οΈ Sentinel: [MEDIUM] Add timeouts to all fetch requests to prevent DoS#93
schmug wants to merge 1 commit into
mainfrom
sentinel-add-fetch-timeouts-5442296514920212647

Conversation

@schmug
Copy link
Copy Markdown
Owner

@schmug schmug commented May 5, 2026

🚨 Severity: MEDIUM
πŸ’‘ Vulnerability: Global fetch calls to /api/projects.json, /api/blog.json, and the external GitHub API lacked timeout configurations.
🎯 Impact: This exposes the application and build processes to Denial of Service (DoS) risks or hanging server processes if the external endpoints take excessively long to respond.
πŸ”§ Fix: Added signal: AbortSignal.timeout(10000) to all fetch requests across src/lib/github.ts, src/hooks/useProjects.ts, and src/components/os/apps/BlogApp.tsx. Documented learning in .jules/sentinel.md.
βœ… Verification: Ran pnpm lint, pnpm test, and pnpm build successfully to ensure the timeout additions don't break existing builds or data fetching logic.


PR created automatically by Jules for task 5442296514920212647 started by @schmug

Fixes a vulnerability where `fetch` requests without explicit timeouts could lead to resource exhaustion (Denial of Service) or hanging builds if the external endpoints or network were unresponsive. Applied `signal: AbortSignal.timeout(10000)` to all instances.

Co-authored-by: schmug <38227427+schmug@users.noreply.github.com>
@google-labs-jules
Copy link
Copy Markdown
Contributor

πŸ‘‹ Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a πŸ‘€ emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

@schmug
Copy link
Copy Markdown
Owner Author

schmug commented May 16, 2026

Superseded by #127 (merged to main), which consolidated the best of the duplicate Bolt/Sentinel/Palette scheduled-agent PRs into one reviewed change. Closing as duplicate.

@schmug schmug closed this May 16, 2026
@google-labs-jules
Copy link
Copy Markdown
Contributor

Superseded by #127 (merged to main), which consolidated the best of the duplicate Bolt/Sentinel/Palette scheduled-agent PRs into one reviewed change. Closing as duplicate.

Understood. Acknowledging that this work is superseded and closing as duplicate. I will stop work on this task.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant