dvorakmortonxd/freezmo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Security: model budget + concurrency caps, SSRF guards, spoof-proof limits

Browse source 
Audit pass with the threats that actually apply to a self-hosted, account-less
app: getting the Ollama key throttled or banned, and someone grinding the app
down. Per-route windows already existed; these are the missing layers.

- lib/model-guard.ts: every route that spends a model call now takes a slot —
  60 calls per window across all clients (RATE_LIMIT_MODEL_TOTAL), 3 in flight
  per IP, 6 in total — and the slot is released when the call finishes, on
  errors and on client disconnects. Over the concurrency cap answers 429
  kind=busy, not a punishment. Slots are taken after every cheap rejection so
  a malformed request cannot hold one (found by the new suite: early 400s
  were leaking slots).
- Images must be base64 data URLs (dataUrlSchema in lib/schemas): a plain URL
  in an images field made Ollama fetch an arbitrary address on our behalf.
- Push endpoints must be a real push service (PUSH_ALLOWED_HOSTS, defaulting
  to FCM/Mozilla/Apple/WNS): the server POSTs to whatever is stored.
- The rate-limit identity is the LAST x-forwarded-for hop. Reading the first
  let a client spoof its own IP and dodge every per-IP limit.
- Disk guards: reports.jsonl stops at REPORTS_MAX_BYTES (8 MB), reminder
  devices cap at PUSH_MAX_SUBSCRIPTIONS (50).
- Security headers: frame-ancestors 'none' + X-Frame-Options DENY, nosniff, a
  referrer policy and a Permissions-Policy without camera/mic/geo/payment.

New tests/security-test.mjs (13 checks, registered in run-all) proves each
guard against a slow stub Ollama with deliberately tiny limits. README:
security notes + rate-limit tables updated. Version 0.1.3, SW -> v51.
This commit is contained in:
Martin Dvořák 2026-10-12 20:40:57 +00:00
commit 8822baf4b7
21 changed files with 528 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

7
app/api/chat/extract/route.ts
View file

@ -5,6 +5,8 @@ import { authErrorMessage, authErrorKind, getServerConfig, resolveAuth } from "@
import { friendlyErrorMessage, OllamaError } from "@/lib/ollama";
import { rejectCrossOrigin, rejectOversizedBody, requestLocale } from "@/lib/http-guard";
import { clientKey, rateLimit, rateLimitResponse } from "@/lib/rate-limit";
import { acquireModelGate } from "@/lib/model-guard";
import { dataUrlSchema } from "@/lib/schemas";
import { translate } from "@/lib/i18n-dict";
export const runtime = "nodejs";
@ -16,7 +18,7 @@ const MAX_BODY_BYTES = 33554432;
const MAX_IMAGE_CHARS = 8_000_000;
const requestSchema = z.object({
images: z.array(z.string().min(32).max(MAX_IMAGE_CHARS)).max(16).optional(),
images: z.array(dataUrlSchema(MAX_IMAGE_CHARS)).max(16).optional(),
text: z.string().max(120_000).optional(),
});
@ -66,6 +68,8 @@ export async function POST(request: Request) {
return Response.json({ error: translate(locale, "server.needContent") }, { status: 400 });
}
const gate = acquireModelGate(request, config, locale);
if ("response" in gate) return gate.response;
const abort = new AbortController();
const timer = setTimeout(() => abort.abort(), config.timeoutMs);
try {
@ -97,6 +101,7 @@ export async function POST(request: Request) {
);
} finally {
clearTimeout(timer);
gate.gate.release();
}
}

8
app/api/chat/route.ts
View file

@ -4,6 +4,7 @@ import { authErrorMessage, authErrorKind, getServerConfig, resolveAuth, resolveM
import { friendlyErrorMessage, ollamaChatStream, OllamaError } from "@/lib/ollama";
import { rejectCrossOrigin, rejectOversizedBody, requestLocale } from "@/lib/http-guard";
import { clientKey, rateLimit, rateLimitResponse } from "@/lib/rate-limit";
import { acquireModelGate } from "@/lib/model-guard";
import { translate } from "@/lib/i18n-dict";
import { buildChatSystemPrompt } from "@/lib/prompts";
import { estimateTokens, trimHistory } from "@/lib/chat-trim";
@ -131,6 +132,11 @@ export async function POST(request: Request) {
})),
});
// Concurrency + the account-wide model budget (lib/model-guard), taken
// after every cheap rejection so a 400 can never leak a slot.
const gate = acquireModelGate(request, config, locale);
if ("response" in gate) return gate.response;
const encode = encoder();
const abort = new AbortController();
const globalTimer = setTimeout(() => abort.abort(), config.timeoutMs);
@ -170,6 +176,7 @@ export async function POST(request: Request) {
}
} finally {
clearTimeout(globalTimer);
gate.gate.release();
try {
controller.close();
} catch {
@ -179,6 +186,7 @@ export async function POST(request: Request) {
},
cancel() {
clearTimeout(globalTimer);
gate.gate.release();
abort.abort();
},
});

12
app/api/generate/route.ts
View file

@ -5,8 +5,9 @@ import { authErrorMessage, authErrorKind, getServerConfig, resolveAuth, resolveM
import { friendlyErrorMessage, OllamaError } from "@/lib/ollama";
import { rejectCrossOrigin, rejectOversizedBody, requestLocale } from "@/lib/http-guard";
import { clientKey, rateLimit, rateLimitResponse } from "@/lib/rate-limit";
import { acquireModelGate } from "@/lib/model-guard";
import { translate } from "@/lib/i18n-dict";
import { difficultySchema } from "@/lib/schemas";
import { dataUrlSchema, difficultySchema } from "@/lib/schemas";
import { uid } from "@/lib/utils";
import { xpForActivity } from "@/lib/xp";
@ -18,7 +19,7 @@ export const maxDuration = 300;
const MAX_IMAGE_CHARS = 8_000_000;
const requestSchema = z.object({
images: z.array(z.string().min(32).max(MAX_IMAGE_CHARS)).max(16).optional(),
images: z.array(dataUrlSchema(MAX_IMAGE_CHARS)).max(16).optional(),
text: z.string().max(120_000).optional(),
difficulty: difficultySchema.default("medium"),
count: z.number().int().min(4).max(18).optional(),
@ -101,6 +102,11 @@ export async function POST(request: Request) {
);
}
// Concurrency + the account-wide model budget (lib/model-guard). Taken
// only now, after every cheap rejection, so a 400 can never leak a slot.
const gate = acquireModelGate(request, config, locale);
if ("response" in gate) return gate.response;
const requestedCount = count ?? config.defaultActivityCount;
const encode = encoder();
const abort = new AbortController();
@ -201,6 +207,7 @@ export async function POST(request: Request) {
});
} finally {
clearTimeout(globalTimer);
gate.gate.release();
try {
controller.close();
} catch {
@ -210,6 +217,7 @@ export async function POST(request: Request) {
},
cancel() {
clearTimeout(globalTimer);
gate.gate.release();
abort.abort();
},
});

5
app/api/grade/route.ts
View file

@ -5,6 +5,7 @@ import { authErrorMessage, authErrorKind, getServerConfig, resolveAuth } from "@
import { friendlyErrorMessage, OllamaError } from "@/lib/ollama";
import { rejectCrossOrigin, rejectOversizedBody, requestLocale } from "@/lib/http-guard";
import { clientKey, rateLimit, rateLimitResponse } from "@/lib/rate-limit";
import { acquireModelGate } from "@/lib/model-guard";
import { translate } from "@/lib/i18n-dict";
export const runtime = "nodejs";
@ -54,6 +55,8 @@ export async function POST(request: Request) {
return Response.json({ error: translate(locale, "server.invalidGrade") }, { status: 400 });
}
const gate = acquireModelGate(request, config, locale);
if ("response" in gate) return gate.response;
try {
const result = await gradeShortAnswer({
model: config.textModel,
@ -72,5 +75,7 @@ export async function POST(request: Request) {
},
{ status: 502 },
);
} finally {
gate.gate.release();
}
}

5
app/api/homework/refine/route.ts
View file

@ -6,6 +6,7 @@ import { friendlyErrorMessage, OllamaError } from "@/lib/ollama";
import { rejectCrossOrigin, rejectOversizedBody, requestLocale } from "@/lib/http-guard";
import { translate } from "@/lib/i18n-dict";
import { clientKey, rateLimit, rateLimitResponse } from "@/lib/rate-limit";
import { acquireModelGate } from "@/lib/model-guard";
export const runtime = "nodejs";
export const dynamic = "force-dynamic";
@ -64,6 +65,8 @@ export async function POST(request: Request) {
);
}
const gate = acquireModelGate(request, config, locale);
if ("response" in gate) return gate.response;
try {
const text = await refineHomeworkText({
model: config.textModel,
@ -86,5 +89,7 @@ export async function POST(request: Request) {
},
{ status: 502 },
);
} finally {
gate.gate.release();
}
}

14
app/api/homework/route.ts
View file

@ -5,8 +5,9 @@ import { authErrorMessage, authErrorKind, getServerConfig, resolveAuth, resolveM
import { friendlyErrorMessage, OllamaError } from "@/lib/ollama";
import { rejectCrossOrigin, rejectOversizedBody, requestLocale } from "@/lib/http-guard";
import { clientKey, rateLimit, rateLimitResponse } from "@/lib/rate-limit";
import { acquireModelGate } from "@/lib/model-guard";
import { translate } from "@/lib/i18n-dict";
import { homeworkModeSchema, type HomeworkStep } from "@/lib/schemas";
import { dataUrlSchema, homeworkModeSchema, type HomeworkStep } from "@/lib/schemas";
import { uid } from "@/lib/utils";
export const runtime = "nodejs";
@ -20,12 +21,12 @@ const MAX_BODY_BYTES = 33554432;
const requestSchema = z.object({
mode: homeworkModeSchema,
images: z.array(z.string().min(32).max(MAX_IMAGE_CHARS)).max(16).optional(),
images: z.array(dataUrlSchema(MAX_IMAGE_CHARS)).max(16).optional(),
text: z.string().max(120_000).optional(),
/** Mode "check": the student's own attempt at the assignment. */
solution: z.string().max(120_000).optional(),
/** Mode "check": photos of the attempt (handwritten work, scanned pages). */
solutionImages: z.array(z.string().min(32).max(MAX_IMAGE_CHARS)).max(16).optional(),
solutionImages: z.array(dataUrlSchema(MAX_IMAGE_CHARS)).max(16).optional(),
/** Language of the assignment (usually detected by the vision step). */
language: z.string().max(60).optional(),
});
@ -95,6 +96,11 @@ export async function POST(request: Request) {
return Response.json({ error: translate(locale, "server.needSolution") }, { status: 400 });
}
// Concurrency + the account-wide model budget (lib/model-guard), taken
// after every cheap rejection so a 400 can never leak a slot.
const gate = acquireModelGate(request, config, locale);
if ("response" in gate) return gate.response;
const encode = encoder();
const abort = new AbortController();
// A single hard deadline for the whole pipeline (two sequential model calls).
@ -257,6 +263,7 @@ export async function POST(request: Request) {
});
} finally {
clearTimeout(globalTimer);
gate.gate.release();
try {
controller.close();
} catch {
@ -266,6 +273,7 @@ export async function POST(request: Request) {
},
cancel() {
clearTimeout(globalTimer);
gate.gate.release();
abort.abort();
},
});

33
app/api/push/route.ts
View file

@ -16,6 +16,23 @@ export const dynamic = "force-dynamic";
* is false — no half-configured UI ever shows.
*/
/**
* The server POSTs to the stored endpoint with VAPID headers, so it must be a
* real push service: an arbitrary URL here would be an SSRF primitive. The
* allowed hosts come from the config (PUSH_ALLOWED_HOSTS), defaulting to the
* real services.
*/
function isPushEndpoint(value: string, allowedHosts: string[]): boolean {
try {
const url = new URL(value);
if (url.protocol !== "https:") return false;
const host = url.hostname.toLowerCase();
return allowedHosts.some((entry) => (entry.startsWith(".") ? host.endsWith(entry) : host === entry));
} catch {
return false;
}
}
const subscriptionSchema = z.object({
endpoint: z.string().url().max(2000),
keys: z.object({
@ -96,9 +113,21 @@ export async function POST(request: Request) {
{ status: 400 },
);
}
if (!isPushEndpoint(parsed.data.endpoint, config.push.allowedHosts)) {
return Response.json(
{ error: translate(locale, "server.pushEndpoint"), kind: "bad_endpoint" },
{ status: 400 },
);
}
const count = await addSubscription(config.push.dir, parsed.data);
return Response.json({ ok: true, count }, { headers: { "Cache-Control": "no-store" } });
const count = await addSubscription(config.push.dir, parsed.data, config.push.maxSubscriptions);
if (!count.accepted) {
return Response.json(
{ error: translate(locale, "server.pushTooMany", { max: config.push.maxSubscriptions }), kind: "too_many" },
{ status: 429 },
);
}
return Response.json({ ok: true, count: count.count }, { headers: { "Cache-Control": "no-store" } });
}
export async function DELETE(request: Request) {

11
app/api/reports/route.ts
View file

@ -51,7 +51,16 @@ export async function POST(request: Request) {
const line = JSON.stringify({ ...parsed.data, receivedAt: new Date().toISOString() });
try {
await fs.mkdir(config.reports.dir, { recursive: true });
await fs.appendFile(path.join(config.reports.dir, "reports.jsonl"), `${line}\n`, "utf8");
const file = path.join(config.reports.dir, "reports.jsonl");
/* Disk guard: reports are a convenience for the operator, so once the
file passes the cap the app stops appending (the browser's own list is
still the source of truth for skipping). */
const size = await fs.stat(file).then((stats) => stats.size).catch(() => 0);
if (size >= config.reports.maxBytes) {
console.warn("[api/reports] reports.jsonl is at its size cap — not appending");
return Response.json({ ok: true });
}
await fs.appendFile(file, `${line}\n`, "utf8");
} catch {
return Response.json({ error: "could not store the report" }, { status: 500 });
}