shoko/jujutsu-skills
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

[SECURITY] LOW: No rate limiting on API calls #10

New Issue
Closed
opened 2026-03-25 10:39:50 +01:00 by shoko · 0 comments
shoko commented 2026-03-25 10:39:50 +01:00
Owner
Copy Link

Severity: LOW

An attacker who can pass arguments to this script (e.g., via a web wrapper) could repeatedly call the Polymarket API in a loop, potentially getting the user's IP rate-limited or banned by Polymarket.

Location

scripts/browse.py lines 74-76 (fetch_all_pages())

Recommended Fix

Add a cooldown between runs if called repeatedly, or use a token bucket rate limiter.

Reference

See reviews/2026-03-25.md Section 6.8

## Severity: LOW An attacker who can pass arguments to this script (e.g., via a web wrapper) could repeatedly call the Polymarket API in a loop, potentially getting the user's IP rate-limited or banned by Polymarket. ## Location `scripts/browse.py` lines 74-76 (`fetch_all_pages()`) ## Recommended Fix Add a cooldown between runs if called repeatedly, or use a token bucket rate limiter. ## Reference See `reviews/2026-03-25.md` Section 6.8
shoko added the lowsecurity labels 2026-03-25 10:39:51 +01:00
shoko closed this issue 2026-03-27 04:10:04 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
approved
bug
Bug fix
 critical
Critical severity - stop using until fixed
 enhancement
Enhancement or feature
 high
High severity - fix ASAP
 in review
low
Low severity
 medium
Medium severity
 need adjustment
need clarification
need review
security
Security-related issues
No Label low security
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
han shoko
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: shoko/jujutsu-skills#10
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?