Merge pull request #564 from arumes31/jules-11679132576181270106-84432f98

🛡️ Sentinel: [HIGH] Fix body parsing in fast-path rate limits

Author: arumes31

.jules/sentinel.md

@@ -72,3 +72,7 @@
 **Vulnerability:** DOM-based XSS vulnerability due to unescaped interpolations in custom vanilla JS modal `rauthDialog`. Both user-facing dialog messages and template variables were vulnerable to injection via `innerHTML`.
 **Learning:** Developers building custom UI components (like dialog overlays) in vanilla JS sometimes use template literals + `innerHTML` directly without properly escaping inputs first, treating them like React props which inherently escape.
 **Prevention:** Establish a global or reusable `escapeHtml` utility and mandate its usage for all dynamic values being interpolated into HTML template literals prior to assignment to `innerHTML`.
+## 2024-05-31 - Fast-Path Rate Limiting Missing c.FormValue Exhaustion Fix
+**Vulnerability:** A fast-path rate limit implementation attempting to avoid parsing `c.FormValue()` (which reads the request body and can cause exhaustion DoS with large payloads) was still indirectly parsing the form by using a global `getRD()` helper that called `c.FormValue()`.
+**Learning:** When attempting to implement early fast-paths to bypass body parsing on limited connections, all helper functions utilized in the error response must be audited. Functions that conditionally fall back to form parsing (`getRD` via `c.FormValue`) will silently defeat the fast-path check, rendering the protection ineffective against resource exhaustion.
+**Prevention:** In fast-path error handlers that aim to avoid parsing large bodies (like early rate limits), strictly use `c.QueryParam()` instead of shared helper functions that may fall back to parsing `c.FormValue()`.

internal/handlers/auth.go

@@ -288,7 +288,7 @@ func (h *AuthHandler) Login(c echo.Context) error {
 	// Fast-path read-only check to prevent large payload parsing if already throttled.
 	if core.IsRateLimitExceeded("login_access:"+clientIP, h.Cfg.RateLimitLoginAccessMax) {
 		slog.Warn("General login access rate limit exceeded (fast-path)", "ip", clientIP)
-		return c.Render(http.StatusTooManyRequests, "login.html", map[string]interface{}{"error": "Too many requests. Please wait a minute.", "csrf": c.Get("csrf"), "rd": getRD(c)})
+		return c.Render(http.StatusTooManyRequests, "login.html", map[string]interface{}{"error": "Too many requests. Please wait a minute.", "csrf": c.Get("csrf"), "rd": c.QueryParam("rd")})
 	}
 
 	// Delegate 2FA verification before consuming this handler's rate-limit
@@ -433,7 +433,7 @@ func (h *AuthHandler) initiate2FASetupSession(c echo.Context, username string) e
 
 func (h *AuthHandler) checkLoginIPRateLimits(c echo.Context, clientIP, template string, extraContext map[string]interface{}) error {
 	if core.IsRateLimitExceeded("login_access:"+clientIP, h.Cfg.RateLimitLoginAccessMax) {
-		ctx := map[string]interface{}{"error": "Too many requests. Please wait a minute.", "csrf": c.Get("csrf"), "rd": getRD(c)}
+		ctx := map[string]interface{}{"error": "Too many requests. Please wait a minute.", "csrf": c.Get("csrf"), "rd": c.QueryParam("rd")}
 		for k, v := range extraContext {
 			ctx[k] = v
 		}
@@ -543,7 +543,7 @@ func (h *AuthHandler) Verify2FA(c echo.Context) error {
 	}
 
 	if core.IsRateLimitExceeded("2fa_fail_user:"+username, h.Cfg.RateLimitLoginFailUserMax) {
-		return c.Render(http.StatusTooManyRequests, "login.html", map[string]interface{}{"error": "Too many failed attempts. Please try again later.", "csrf": c.Get("csrf"), "display2fa": true, "rd": getRD(c)})
+		return c.Render(http.StatusTooManyRequests, "login.html", map[string]interface{}{"error": "Too many failed attempts. Please try again later.", "csrf": c.Get("csrf"), "display2fa": true, "rd": c.QueryParam("rd")})
 	}
 
 	totpOK := totp.Validate(code, secret)
@@ -613,7 +613,7 @@ func (h *AuthHandler) CompleteSetup2FA(c echo.Context) error {
 	}
 
 	if core.IsRateLimitExceeded("2fa_fail_user:"+username, h.Cfg.RateLimitLoginFailUserMax) {
-		return c.Render(http.StatusTooManyRequests, "setup_2fa.html", map[string]interface{}{"error": "Too many failed attempts. Please try again later.", "csrf": c.Get("csrf"), "rd": getRD(c)})
+		return c.Render(http.StatusTooManyRequests, "setup_2fa.html", map[string]interface{}{"error": "Too many failed attempts. Please try again later.", "csrf": c.Get("csrf"), "rd": c.QueryParam("rd")})
 	}
 
 	code := c.FormValue("totp_code")