Repository navigation
fix(solid): bound the reads of documents outside the user's storages - #673
Merged
Merged
Conversation
An instance outside the user's storages could list many decks, and the deck list then read every deck's cards and reviews documents at once, each held only to its own limits. Nothing bounded the total, so such a catalog could take up the tab's memory. Reads outside the user's storages now count in a budget for the page session on top of the limits on each document, counted as the reads of releases from a link are: a document once, by its largest read, and reads of it again out of an allowance of their own. The reads as no one share one budget, and an instance the user registered on another server has one for each server, so reads elsewhere never take from it. Past the budget, such reads fail with a read error until the page is loaded again, and a read that goes past the budget names the budget in its error, not the limits on each document. Writes are not counted, so the user's writes to an instance they registered elsewhere go out whatever is spent. The deck arrangement refuses a catalog with more decks than MAX_CATALOG_LINKS, as the deck list already did, and the study counts are worked out a few decks at a time, whoever asks for them. Refs: GHSA-9q65-rfrp-5gj6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
An instance outside the user's storages could list many decks. The deck list then read every deck's cards and reviews documents at once, each held only to its own read limits, so nothing bounded the total and a large catalog could use up the tab's memory.
MAX_CATALOG_LINKS, as the deck list already did.docs/boundaries.mdanddocs/data-model.mddescribe the budget.Refs: GHSA-9q65-rfrp-5gj6