{"action":"closed","issue":{"url":"https://api.github.com/repos/kuzzleio/kuzzle/issues/635","repository_url":"https://api.github.com/repos/kuzzleio/kuzzle","labels_url":"https://api.github.com/repos/kuzzleio/kuzzle/issues/635/labels{/name}","comments_url":"https://api.github.com/repos/kuzzleio/kuzzle/issues/635/comments","events_url":"https://api.github.com/repos/kuzzleio/kuzzle/issues/635/events","html_url":"https://github.com/kuzzleio/kuzzle/issues/635","id":202482673,"number":635,"title":"`document:m*` routes bypass overload protection","user":{"login":"scottinet","id":12997967,"avatar_url":"https://avatars.githubusercontent.com/u/12997967?v=3","gravatar_id":"","url":"https://api.github.com/users/scottinet","html_url":"https://github.com/scottinet","followers_url":"https://api.github.com/users/scottinet/followers","following_url":"https://api.github.com/users/scottinet/following{/other_user}","gists_url":"https://api.github.com/users/scottinet/gists{/gist_id}","starred_url":"https://api.github.com/users/scottinet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scottinet/subscriptions","organizations_url":"https://api.github.com/users/scottinet/orgs","repos_url":"https://api.github.com/users/scottinet/repos","events_url":"https://api.github.com/users/scottinet/events{/privacy}","received_events_url":"https://api.github.com/users/scottinet/received_events","type":"User","site_admin":false},"labels":[{"id":250449057,"url":"https://api.github.com/repos/kuzzleio/kuzzle/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"closed","locked":false,"assignee":{"login":"scottinet","id":12997967,"avatar_url":"https://avatars.githubusercontent.com/u/12997967?v=3","gravatar_id":"","url":"https://api.github.com/users/scottinet","html_url":"https://github.com/scottinet","followers_url":"https://api.github.com/users/scottinet/followers","following_url":"https://api.github.com/users/scottinet/following{/other_user}","gists_url":"https://api.github.com/users/scottinet/gists{/gist_id}","starred_url":"https://api.github.com/users/scottinet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scottinet/subscriptions","organizations_url":"https://api.github.com/users/scottinet/orgs","repos_url":"https://api.github.com/users/scottinet/repos","events_url":"https://api.github.com/users/scottinet/events{/privacy}","received_events_url":"https://api.github.com/users/scottinet/received_events","type":"User","site_admin":false},"assignees":[{"login":"scottinet","id":12997967,"avatar_url":"https://avatars.githubusercontent.com/u/12997967?v=3","gravatar_id":"","url":"https://api.github.com/users/scottinet","html_url":"https://github.com/scottinet","followers_url":"https://api.github.com/users/scottinet/followers","following_url":"https://api.github.com/users/scottinet/following{/other_user}","gists_url":"https://api.github.com/users/scottinet/gists{/gist_id}","starred_url":"https://api.github.com/users/scottinet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scottinet/subscriptions","organizations_url":"https://api.github.com/users/scottinet/orgs","repos_url":"https://api.github.com/users/scottinet/repos","events_url":"https://api.github.com/users/scottinet/events{/privacy}","received_events_url":"https://api.github.com/users/scottinet/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2017-01-23T09:28:21Z","updated_at":"2017-02-10T10:45:06Z","closed_at":"2017-02-10T10:45:06Z","body":"Simple recipe to overload Kuzzle's event loop and freeze a node without effort: submit a mCreate query with thousands of documents to process.\r\n\r\nThe `document` controller will parse the query content and submit 1 `processRequest` action from the funnel controller, without going through the overload protection mechanism nor imposing a process count limit.\r\n\r\nSimple fix: the `doMultipleActions` function, in the `document` controller, should invoke the `execute` function in the funnel controller, instead of the `processRequest` one.\r\nPro: fixes the problem\r\nCons:\r\n* impose a new rights check for each subrequest, which is less than ideal performance-wise\r\n* impose users to have the same rights for `m*` routes than for their single document action counterpart\r\n\r\nLess simple but better fix: separate and expose the funnel's overload mechanism from its `execute` function, by exposing a new `start(request, callback)` function (function name to be discussed), resolving the callback only when the event loop charge allows it.\r\nMake the `execute` function invokes it, as well as the `m*` routes for each document to process."}}
{"actor":{"display_login":"ballinette"}}