From a539bc06f1f16e81b71cf25873bffb671711bc1b Mon Sep 17 00:00:00 2001 From: anupamme Date: Mon, 7 Sep 2026 19:21:24 +0000 Subject: [PATCH] fix: fix security issue in app.py The application exposes 74+ API endpoints without implementing preventive rate limiting middleware --- app.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/app.py b/app.py index 54a5eb2c2..0d31d1fa6 100644 --- a/app.py +++ b/app.py @@ -49,6 +49,19 @@ bottle.TEMPLATE_PATH.append('/static/bookreader') bottle.TEMPLATE_PATH.append('/static/bookreader/BookReader') + +@app.hook('before_request') +def enforce_quota(): + """ + Preventively reject over-quota/blacklisted requests to API endpoints + before they are processed, instead of only recording usage afterward. + """ + if bottle.request.path.startswith("/api/"): + quota_status = model.log_quota.check_quota(bottle.request) + if quota_status.get("status"): + bottle.abort(429, quota_status.get( + "error_message", "Rate limit exceeded.")) + # Debug timing to improve speed time_labels = [] time_nums = []