SPDT/sapl: Sistema de Apoio ao Processo Legislativo - sapl

Sistema de Apoio ao Processo Legislativo

Edward Ribeiro 5086491157 continuous-integration/drone/push Build is passing Details Mitigate pesquisar-sessao DDoS and fix page= param pollution Coordinated DDoS attack used repeated page= params (?page=3&page=2&page=3&...) as a scraping fingerprint, likely harvested from SAPL's own paginated search links which had a long-standing bug producing those polluted URLs. Reject duplicate page= at the middleware layer: RateLimitMiddleware.__call__ returns 400 (param_pollution) if request.GET.getlist('page') has more than one value — before any Redis or DB work runs, covering all paths universally. PesquisarSessaoPlenariaView.get has the same check as a backstop. Fix the root cause — page= leaking into filter_url on 9 search views: All affected views built filter_url from the raw QUERY_STRING and guarded with startswith("&page"), which only strips page= when it is the first param. With ?filter=X&page=2 the page= leaked through and paginacao.html produced ?page=N&filter=X&page=2 on every link. Replaced with qr = request.GET.copy(); qr.pop('page', None). Views fixed: PesquisarStatusTramitacaoView, PesquisarAssuntoNormaView, PesquisarAuditLogView, PesquisarParlamentarView, PesquisarColigacaoView, PesquisarPartidoView, ProtocoloPesquisaView, PesquisarDocumentoAdministrativoView, PesquisarSessaoPlenariaView. Cache anonymous GET on PesquisarSessaoPlenariaView (2 min TTL) to reduce ORM load from repeated identical queries. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	1 week ago
..
nginx.conf	Align nginx rate limit zones with Django rate limiter thresholds	4 weeks ago
sapl.conf	Mitigate pesquisar-sessao DDoS and fix page= param pollution	1 week ago

Edward Ribeiro 5086491157 Mitigate pesquisar-sessao DDoS and fix page= param pollution

Coordinated DDoS attack used repeated page= params
(?page=3&page=2&page=3&...) as a scraping fingerprint, likely
harvested from SAPL's own paginated search links which had a
long-standing bug producing those polluted URLs.

Reject duplicate page= at the middleware layer:
  RateLimitMiddleware.__call__ returns 400 (param_pollution) if
  request.GET.getlist('page') has more than one value — before any
  Redis or DB work runs, covering all paths universally.
  PesquisarSessaoPlenariaView.get has the same check as a backstop.

Fix the root cause — page= leaking into filter_url on 9 search views:
  All affected views built filter_url from the raw QUERY_STRING and
  guarded with startswith("&page"), which only strips page= when it
  is the first param. With ?filter=X&page=2 the page= leaked through
  and paginacao.html produced ?page=N&filter=X&page=2 on every link.
  Replaced with qr = request.GET.copy(); qr.pop('page', None).
  Views fixed: PesquisarStatusTramitacaoView, PesquisarAssuntoNormaView,
  PesquisarAuditLogView, PesquisarParlamentarView, PesquisarColigacaoView,
  PesquisarPartidoView, ProtocoloPesquisaView,
  PesquisarDocumentoAdministrativoView, PesquisarSessaoPlenariaView.

Cache anonymous GET on PesquisarSessaoPlenariaView (2 min TTL) to
reduce ORM load from repeated identical queries.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 week ago

nginx.conf

Align nginx rate limit zones with Django rate limiter thresholds

4 weeks ago

sapl.conf

Mitigate pesquisar-sessao DDoS and fix page= param pollution

1 week ago