Background
PUT /answer/api/v1/question/invite accepts an uncapped invite_user array (internal/schema/question_schema.go:206), so a single request can trigger a large number of "invited you to answer" notifications.
I reported this privately to the ASF security team. They confirmed the endpoint's rank-gated, site-wide behaviour is by design (not a boundary crossing), but noted the missing maximum on invite_user reads as hardening. Filing here per that suggestion.
Suggested hardening
- Add a sane server-side maximum on
invite_user (e.g. matching the UI's limit) to bound the notification fan-out.
Happy to send a PR.
Background
PUT /answer/api/v1/question/inviteaccepts an uncappedinvite_userarray (internal/schema/question_schema.go:206), so a single request can trigger a large number of "invited you to answer" notifications.I reported this privately to the ASF security team. They confirmed the endpoint's rank-gated, site-wide behaviour is by design (not a boundary crossing), but noted the missing maximum on
invite_userreads as hardening. Filing here per that suggestion.Suggested hardening
invite_user(e.g. matching the UI's limit) to bound the notification fan-out.Happy to send a PR.