merchant

commit f8727f10f5f30b09d4284dc2f561924a1063baf6
parent 96bee3da047753d35456d6ed6782270efaa90181
Author: Christian Grothoff <grothoff@gnunet.org>
Date:   Fri, 10 Jul 2026 09:10:13 +0200

hard cap number of buckets server-side

Diffstat:
M
src/backend/taler-merchant-httpd_get-private-statistics-report-transactions.c
 | 
11
+++++++++++

1 file changed, 11 insertions(+), 0 deletions(-)
diff --git a/src/backend/taler-merchant-httpd_get-private-statistics-report-transactions.c b/src/backend/taler-merchant-httpd_get-private-statistics-report-transactions.c
@@ -29,6 +29,12 @@
 
 
 /**
+ * Sensible bound on the number of buckets a client may request.
+ */
+#define MAX_DELTA 1024
+
+
+/**
  * Closure for the detail_cb().
  */
 struct ResponseContext
@@ -672,6 +678,11 @@ TMH_private_get_statistics_report_transactions (
   TALER_MHD_parse_request_number (connection,
                                   "count",
                                   &rctx->count);
+  /* Cap the client-supplied count to a sane maximum to prevent
+     resource amplification (used both as DB bucket count and in
+     GNUNET_TIME_relative_multiply() for the start_date). */
+  if (rctx->count > MAX_DELTA)
+    rctx->count = MAX_DELTA;
 
   /* create charts */
   charts = json_array ();