Comments (4)
I'll try to answer, but keep in mind depending on your components, your needs, ..et some of those points may not be relatable to your project
- you can add a RateLimiter in your components (they are service, so you can inject a RateLimiter inside one specific component, or -probably better- you can leverage one of the available events and create a shared Listener for this)
- you may want to restrict this URL to specific users (authenticated, or by IP, header...) with firewall + access control rules
- you can enable CSRF verification for your component actions
- you could set a global request control in your app that triggers custom HTTP codes + a ban system (fail2ban-like)
- you could also ban on your web server / host IP's that you often see trying some "malicious" things as you said
On your app side, there is no risk of SQL injection if you're using DTO's or scalars ..
For Doctrine entities if you use query builder or predefined repository functions neither (the string values will be escaped by Doctrine before beeing set.. and should probably not pass your entity validation constraints i guess).
In the end, a live component URL is like any controller URL in symfony, and you can leverage all the usual tools provided by Symfony / your server to control.
Concerning the error log messages: are they just "404" errors or is there something more suspicious here ?
from ux.
@rajansharmax could you provide more details to security [at] symfony.com?
from ux.
is there a way to stop this or any rate limiter?
from ux.
So the attacker added the live component URL to the bot, and maybe they are trying to inject a SQL query. so my questions is: how can we prevent these kind of form submissions. We are getting a lot of error log messages.
Is there any rate limiter for this, or do we need to add rate limiters on the server??
from ux.
Related Issues (20)
- [LiveComponent] In a batch request, the backend only returned that view for the last call HOT 7
- [LiveComponent] Validation of URL parameter values HOT 3
- [InteractsWithLiveComponent] Invoking a LiveAction submitting a Form with a RepeatedType-Password fails upon validation. HOT 2
- [Stimulus] Input type "date" and "datetime-local" do not display initial value HOT 3
- [Doc] Little error on form-collection-type demo HOT 4
- [Assetmapper] "importmap:require" downloads a minified version of the base package - sub directories are not included HOT 3
- [LiveComponent] Error on Vector props hydratation HOT 5
- Add the Map component to the UX website HOT 7
- [TwigComponent] Scope of translation domains HOT 8
- [LiveComponent] Stimulus controller inside a Live Component does not rerender HOT 14
- [AutoComplete] the `openOnFocus` option works only on the second focus? HOT 3
- [LiveComponent] [Turbo] "Error: Form responses must redirect to another location" when using a search form inside a Live Component HOT 2
- Unable to load the "Symfony\UX\Icons\IconRenderer" runtime. after update symfony/ux-icons v2.18.1 to v2.19.0 HOT 3
- [Translator] Cache is not warmed anymore
- [LiveComponent] ComponentWithForm prevent onUpdated to be triggered
- [Feature Idea] [Turbo Streams] [ux-turbo] Render view as Turbo Stream
- [TwigComponent] Cva in html_extra HOT 3
- [Map] Feature: Mapbox bridge (and searchbox) HOT 3
- [TwigComponents] [Question] Performance hit when passing content to nested component HOT 9
- Issue with data-loading and disabled attribute
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ux.