Skip to content

Conversation

@benesjan
Copy link
Contributor

@benesjan benesjan commented Dec 19, 2025

In this PR I drop pagination from getLogsByTags endpoint because pagination here doesn't really make sense because we get more logs per tag only if there are multiple devices sending logs from a given sender to a recipient.

This is the final of 3 PRs in which I clean up the getLogsByTags endpoint:

  1. First PR - including block timestamp in return value,
  2. This is the second PR - I type the tag arg of the function to be SiloedTag,
  3. in the last PR I will drop pagination from this endpoint.

Potential DoS vector

Log tag is unconstrained and hence can be arbitrarily chosen by the sender. This introduces a potential DoS vector because the node currently loads all the logs into memory and returns them. Hence it could be feasible to re-use the same tag thousands of time and then spam a node by request for this tag.

I think the solution here is to simply define the maximum number of logs a node is willing to store per tag in the db. Given that there is no legitimate use case for log reuse I think making it even as low as 5 would be fine.

Note that this PR didn't introduce this DoS vector because even though I dropped the pagination here it didn't seem to be enforced before (if limitPerTag arg was undefined we just returned it all). For this reason I think we can merge it and tackle the issue in a followup PR.

@benesjan benesjan force-pushed the 12-19-refactor_dropping_pagination_from_getlogsbytags branch 2 times, most recently from 7d71804 to 822c8e6 Compare December 19, 2025 22:01
@benesjan benesjan changed the title refactor: dropping pagination from getLogsByTags refactor!: dropping pagination from getLogsByTags Dec 19, 2025
@benesjan benesjan force-pushed the 12-19-refactor_dropping_pagination_from_getlogsbytags branch from 822c8e6 to 88998e0 Compare December 19, 2025 22:31
@benesjan benesjan added the ci-no-fail-fast Sets NO_FAIL_FAST in the CI so the run is not aborted on the first failure label Dec 19, 2025
@benesjan benesjan marked this pull request as ready for review December 19, 2025 22:33
@spalladino
Copy link
Contributor

Note that this PR didn't introduce this DoS vector because even though I dropped the pagination here it didn't seem to be enforced before (if limitPerTag arg was undefined we just returned it all). For this reason I think we can merge it and tackle the issue in a followup PR.

Heads up that's not correct. The limit was enforced at the schema level (maybe not the wisest decision in retrospective, since it's unclear from the code), where we'd default the limitPerTag to the max value if not set. Still, I'm fine if you want to just remove it, as long as you add some guardrails in a future PR.

@benesjan benesjan changed the base branch from 12-19-refactor_typing_tag_arg_in_getlogsbytags to graphite-base/19161 December 22, 2025 19:24
@benesjan benesjan force-pushed the 12-19-refactor_dropping_pagination_from_getlogsbytags branch from 88998e0 to 99f51a4 Compare December 23, 2025 16:36
@benesjan benesjan marked this pull request as draft December 23, 2025 16:50
@benesjan benesjan force-pushed the graphite-base/19161 branch from 7f81d21 to 859acfe Compare December 23, 2025 16:54
@benesjan benesjan force-pushed the 12-19-refactor_dropping_pagination_from_getlogsbytags branch from 99f51a4 to 24a22a4 Compare December 23, 2025 16:54
@benesjan benesjan changed the base branch from graphite-base/19161 to 12-19-refactor_typing_tag_arg_in_getlogsbytags December 23, 2025 16:54
@benesjan benesjan force-pushed the 12-19-refactor_dropping_pagination_from_getlogsbytags branch from 24a22a4 to 0994846 Compare December 23, 2025 16:55
@benesjan benesjan force-pushed the 12-19-refactor_typing_tag_arg_in_getlogsbytags branch from 859acfe to f88fa5c Compare December 23, 2025 16:55
@AztecBot AztecBot force-pushed the 12-19-refactor_typing_tag_arg_in_getlogsbytags branch from f88fa5c to e8de31f Compare December 23, 2025 17:15
Base automatically changed from 12-19-refactor_typing_tag_arg_in_getlogsbytags to next December 23, 2025 17:49
@benesjan benesjan force-pushed the 12-19-refactor_dropping_pagination_from_getlogsbytags branch from 0994846 to 1497662 Compare December 23, 2025 17:52
@benesjan benesjan marked this pull request as ready for review December 23, 2025 17:52
@benesjan benesjan added ci-squash-and-merge and removed ci-no-fail-fast Sets NO_FAIL_FAST in the CI so the run is not aborted on the first failure labels Dec 23, 2025
@benesjan benesjan enabled auto-merge December 23, 2025 17:53
In this PR I drop pagination from `getLogsByTags` endpoint because pagination here doesn't really make sense because we get more logs per tag only if there are multiple devices sending logs from a given sender to a recipient.

This is the final of 3 PRs in which I clean up the `getLogsByTags` endpoint:
1. First PR - including block timestamp in return value,
2. This is the second PR - I type the tag arg of the function to be `SiloedTag`,
3. in the last PR I will drop pagination from this endpoint.

# Potential DoS vector

Log tag is unconstrained and hence can be arbitrarily chosen by the sender. This introduces a potential DoS vector because the node currently loads all the logs into memory and returns them. Hence it could be feasible to re-use the same tag thousands of time and then spam a node by request for this tag.

I think the solution here is to simply define the maximum number of logs a node is willing to store per tag in the db. Given that there is no legitimate use case for log reuse I think making it even as low as 5 would be fine.

Note that this PR didn't introduce this DoS vector because even though I dropped the pagination here it didn't seem to be enforced before (if `limitPerTag` arg was undefined we just returned it all). For this reason I think we can merge it and tackle the issue in a followup PR.
@AztecBot AztecBot force-pushed the 12-19-refactor_dropping_pagination_from_getlogsbytags branch from 1497662 to 7afc547 Compare December 23, 2025 18:10
@benesjan benesjan added this pull request to the merge queue Dec 23, 2025
Merged via the queue into next with commit 331b458 Dec 23, 2025
18 checks passed
@benesjan benesjan deleted the 12-19-refactor_dropping_pagination_from_getlogsbytags branch December 23, 2025 18:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants