🐛 fix changes too large#97
Merged
Merged
Conversation
executeCreateBookmark 按全局唯一的 sr_user_bookmark.uuid 查到既有行后, 直接按 uuid update,未校验 user_id 归属。攻击者提交 op=PUT、 id=<受害者 uuid> 即可改写他人书签的 bookmark_id/deleted_at/archive_status。 补齐归属校验:UUID 存在但不属于当前用户时抛 ShareActionNotAllowedError; update 的 where 同时锁定 user_id 作为双保险。与同文件 update/delete/comment 路径已有的归属校验保持一致。
getPartialBookmarkChanges 查 append-only 变更日志且无上限,单用户变更过多时 15 天窗内全量返回会使 JSON 序列化超出 V8 buffer 上限,抛 RangeError: Invalid array buffer length(聚合 4 样本/27 次,与重试堆叠吻合)。 客户端(浏览器扩展)单向推进同步游标(只拉 created_at > previous_sync), 且假定响应为倒序(内部 logs.reverse 后按时间正序应用),出错仅重试不降级。 据此改为【前向分页】,响应结构与客户端零改动: - 查询取游标之后最旧的一批 (ASC) 最多 5000 条 - previous_sync 取本批最新一条:被截断时为'中间点',客户端下次从此继续 往后拉,逐批追平不丢数据;未截断时即为最新,已追平 - 响应按倒序返回以兼容客户端 logs.reverse - createBookmarkChangeLog 写入端截断超长 target_url (>2048) all_changes 因 JOIN sr_user_bookmark 天然每书签一行,无需处理。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.