feat: Implement atomic operations and rate limiting#2566
Open
khushal-winner wants to merge 6 commits intoOWASP:masterfrom
Open
feat: Implement atomic operations and rate limiting#2566khushal-winner wants to merge 6 commits intoOWASP:masterfrom
khushal-winner wants to merge 6 commits intoOWASP:masterfrom
Conversation
- Add atomic card play operations to prevent race conditions - Implement comprehensive rate limiting for API endpoints - Add rate limiting plug to API pipeline - Add comprehensive test coverage for rate limiting - Fix CAPEC-212 functionality misuse vulnerabilities Security improvements: prevents DoS attacks and race conditions
khushal-winner
requested review from
cw-owasp,
rewtd and
sydseter
as code owners
- Fix atomic operations to enforce one-card-per-round invariant in DB transaction - Fix error handling to propagate failures to HTTP responses instead of always returning 200 - Fix rate limiter plug to handle stateless API requests without sessions - Add synchronous clear_ip_sync function for reliable test setup - Fix API rate limiter tests to include x-forwarded-for headers and test actual rate limiting - Fix integration tests to wait for rate limit windows to expire and use synchronous clears - Improve test reliability by handling GenServer already_started cases Security improvements: ensures atomic invariants and proper error propagation
- Use Repo.transaction to enforce one-card-per-round invariant atomically - Fix rate limiter handle_call to preserve map structure properly - Fix rate limiter plug to use String.ends_with? for stricter path matching - Fix API rate limiter test loop range (1..9 instead of 1..10) - Fix integration test to use CopiWeb.Router.call for proper endpoint testing
- Unwrap transaction result to return flat tuple structure
- Anonymize IP addresses in rate limiter logs using SHA-256 hash
- Fix integration test Task.async block to handle %Plug.Conn{} properly
- Fix integration test assertions to count specific status codes (200/409/429)
- Fix time window test to convert seconds to milliseconds
- Fix API rate limiter tests to use dynamic limits from config
- Fix play_card to verify player exists before accessing dealt_cards - Remove localhost rate limiter bypass that could be spoofed via X-Forwarded-For - Only bypass rate limiting when actual connection IP is loopback - Fix integration test to use proper router calls instead of direct plug calls - Fix integration test to use short test windows instead of production durations - Add proper test config restoration to prevent test interference
sydseter
requested changes
Mar 12, 2026
Collaborator
sydseter
left a comment
sydseter
left a comment
There was a problem hiding this comment.
This may not work on fly, but I’ll try it out.
| @doc """ | ||
| Synchronously clears all rate limit data for a specific IP address (useful for testing). | ||
| """ | ||
| def clear_ip_sync(ip) do |
Contributor
Author
There was a problem hiding this comment.
Helps troubleshoot rate limit behavior in dev/test environments
Contributor
Author
|
@sydseter , fixed the changes |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes - #2559
Security improvements: prevents DoS attacks and race conditions