Devlog 16
I just boosted the security of the tool quite a bit, now with rate limiting, aggressive schema validation, and payload size limits. The issue before was that you could spam stuff no problem, but now there is a ton of resistance, and very strict limits. I still have more plans to make it even more secure as well. I also setup meta tags so now supposedly when you send a link depending on the platform, it will show this image and a description as well.
An example of some of the new aggressive schema validation is:
class QuestionChanges(StrictModel):
title: Str | None = None
type: (
Literal["ln", "sn", "cb", "a", "img", "n", "mc", "sc", "r", "st"]
| None
) = None
opt: dict[Annotated[str, StringConstraints(pattern=r"^[0-9]$")], Annotated[str, Field(max_length=50)]] | None = Field(default=None, max_length=10)
minmax: Annotated[list[Annotated[int, Field(ge=-99999, le=99999)]], Field(min_length=2, max_length=2)] | None = None
stars: Annotated[int, Field(ge=0, le=10)] | None = None
I setup two different rate limiting systems, these include ones for the websocket, where each individual message type can get its own rate limit (some things should be easily called 500 times in a minute, while others should NOT be called more than 10)
@ws_limit(maxCalls=500, window=60)
async def handleUpdateTeamQuestion(
@ws_limit(maxCalls=8, window=60)
async def handleCompCodeChange(
Window being time in seconds, maxCalls being the max calls in that window.
This still needs more testing to make sure edge cases that are actually possible to do using the UI are not blocked by this security, but most regular use seems to not be affected.