Found during a security audit.
Where: my-plugin/routes.py:60-98, set_settings
Issue: No size/type limit on the POSTed JSON body or its values — _DEFAULTS keys aren't schema-validated, so a client can stuff arbitrarily large strings/nested structures into settings, or add unbounded extra keys, all merged and written to disk. No request body size cap either — await request.json() buffers an arbitrarily large POST body into memory before any validation.
Impact: Since this is the scaffold new plugins are cloned from, this pattern gets copy-pasted into every new plugin — worth fixing here specifically because of that multiplier, even though each individual instance is low-severity.
Suggested fix: Add a schema/type check on the settings body and a reasonable size cap (e.g. via a request size limit middleware or explicit length check) before persisting.
Found during a security audit.
Where:
my-plugin/routes.py:60-98,set_settingsIssue: No size/type limit on the POSTed JSON body or its values —
_DEFAULTSkeys aren't schema-validated, so a client can stuff arbitrarily large strings/nested structures into settings, or add unbounded extra keys, all merged and written to disk. No request body size cap either —await request.json()buffers an arbitrarily large POST body into memory before any validation.Impact: Since this is the scaffold new plugins are cloned from, this pattern gets copy-pasted into every new plugin — worth fixing here specifically because of that multiplier, even though each individual instance is low-severity.
Suggested fix: Add a schema/type check on the settings body and a reasonable size cap (e.g. via a request size limit middleware or explicit length check) before persisting.