Merge pull request #163 from cakephp/rate-limiting

add rate limiting

Author: LordSimal

Dockerfile

@@ -12,6 +12,8 @@ RUN apt-get update \
     && apt-get update \
     && apt-get install -y --no-install-recommends nodejs \
     && docker-php-ext-install intl pdo_mysql zip \
+    && pecl install redis \
+    && docker-php-ext-enable redis \
     && a2enmod rewrite headers expires \
     && sed -ri "s!/var/www/html!${APACHE_DOCUMENT_ROOT}!g" /etc/apache2/sites-available/000-default.conf /etc/apache2/apache2.conf \
     && rm -rf /var/lib/apt/lists/*

README.md

@@ -2,6 +2,18 @@
 
 This repository contains the code responsible for https://plugins.cakephp.org
 
+## Production request protection
+
+The public package listing has query validation and an IP-based rate limit. It
+uses Dokku's `REDIS_URL` by default. `RATE_LIMIT_CACHE_URL` can override it if
+you later want a dedicated Redis database or service.
+
+The container includes the PHP Redis extension. `TRUSTED_PROXY_IPS` must list
+only proxies that overwrite `X-Forwarded-For`; for the current Dokku setup its
+default is `172.17.0.1`. Set `RATE_LIMIT_ENABLED=false` only for temporary
+maintenance or local development. The defaults are 90 listing views/minute,
+15 filtered listings/minute, and 30 autocomplete requests/minute per client IP.
+
 ## Starting local development
 
 You need [DDEV](https://docs.ddev.com/en/stable/) installed and configured on your machine.

composer.json

@@ -65,7 +65,7 @@
         "illuminate": "bin/cake illuminate code",
         "phpstan": "phpstan analyse",
         "phpstan-baseline": "phpstan --generate-baseline",
-        "rector-setup": "cp composer.json composer.backup && composer require --dev rector/rector:\"~2.3.1\" && mv composer.backup composer.json",
+        "rector-setup": "cp composer.json composer.backup && composer require --dev rector/rector:\"~2.6.1\" && mv composer.backup composer.json",
         "rector-check": "vendor/bin/rector process --dry-run",
         "rector-fix": "vendor/bin/rector process"
     }

composer.lock

@@ -1,12 +1,24 @@
 <?php
 
+declare(strict_types=1);
+
 use Cake\Cache\Engine\FileEngine;
 use Cake\Database\Connection;
 use Cake\Database\Driver\Mysql;
 use Cake\Log\Engine\FileLog;
 use Cake\Mailer\Transport\MailTransport;
 use function Cake\Core\env;
 
+$rateLimitCacheUrl = env('RATE_LIMIT_CACHE_URL', env('REDIS_URL'));
+$rateLimitEnabled = filter_var(
+    env('RATE_LIMIT_ENABLED', $rateLimitCacheUrl !== null),
+    FILTER_VALIDATE_BOOL,
+);
+$trustedProxyIps = array_values(array_filter(array_map(
+    trim(...),
+    explode(',', (string)env('TRUSTED_PROXY_IPS', '172.17.0.1')),
+)));
+
 return [
     /*
      * Debug Level:
@@ -112,6 +124,23 @@
         ],
     ],
 
+    /*
+     * Protection for the public package listing and autocomplete endpoints.
+     *
+     * RATE_LIMIT_CACHE_URL must be a redis:// DSN. The rate limiter remains
+     * disabled until that shared, atomic cache has been configured.
+     */
+    'PublicRequestProtection' => [
+        'rateLimitEnabled' => $rateLimitEnabled && is_string($rateLimitCacheUrl) && str_starts_with($rateLimitCacheUrl, 'redis://'),
+        'trustedProxyIps' => $trustedProxyIps,
+        'maxFilterValues' => max(1, (int)env('MAX_PACKAGE_FILTER_VALUES', 3)),
+        'rateLimits' => [
+            'browse' => ['limit' => 90, 'window' => 60],
+            'filtered' => ['limit' => 15, 'window' => 60],
+            'autocomplete' => ['limit' => 30, 'window' => 60],
+        ],
+    ],
+
     /*
      * Configure the cache adapters.
      */
@@ -122,6 +151,14 @@
             'url' => env('CACHE_DEFAULT_URL'),
         ],
 
+        'rate_limit' => [
+            'className' => FileEngine::class,
+            'path' => CACHE . 'rate_limit' . DS,
+            'duration' => '+1 minute',
+            'prefix' => 'plugins_rate_limit_',
+            'fallback' => false,
+        ] + ($rateLimitCacheUrl ? ['url' => $rateLimitCacheUrl] : []),
+
         /*
          * Configure the cache used for general framework caching.
          * Translation cache files are stored with this configuration.

config/app.php

@@ -1,5 +1,7 @@
 <?php
 
+declare(strict_types=1);
+
 use function Cake\Core\env;
 
 /*

config/app_local.example.php

@@ -1,4 +1,6 @@
 <?php
+declare(strict_types=1);
+
 /**
  * CakePHP(tm) : Rapid Development Framework (https://cakephp.org)
  * Copyright (c) Cake Software Foundation, Inc. (https://cakefoundation.org)

config/paths.php

@@ -1,4 +1,7 @@
 <?php
+
+declare(strict_types=1);
+
 /**
  * Plugin configuration.
  *
@@ -18,15 +21,14 @@
  * @since         5.0.0
  * @license       https://opensource.org/licenses/mit-license.php MIT License
  */
-
- /*
-  * List of plugins to load in the form `PluginName` => `[configuration options]`.
-  *
-  * Available options:
-  * - onlyDebug: Load the plugin only in debug mode. Default false.
-  * - onlyCli: Load the plugin only in CLI mode. Default false.
-  * - optional: Do not throw an exception if the plugin is not found. Default false.
-  */
+/*
+ * List of plugins to load in the form `PluginName` => `[configuration options]`.
+ *
+ * Available options:
+ * - onlyDebug: Load the plugin only in debug mode. Default false.
+ * - onlyCli: Load the plugin only in CLI mode. Default false.
+ * - optional: Do not throw an exception if the plugin is not found. Default false.
+ */
 return [
     'DebugKit' => ['onlyDebug' => true],
     'Bake' => ['onlyCli' => true, 'optional' => true],

config/plugins.php

@@ -1,4 +1,6 @@
 <?php
+declare(strict_types=1);
+
 /**
  * Routes configuration.
  *

config/routes.php

@@ -60,7 +60,6 @@
         CompactToVariablesRector::class,
         SplitDoubleAssignRector::class,
         ChangeOrIfContinueToMultiContinueRector::class,
-        ExplicitBoolCompareRector::class,
         NewlineBeforeNewAssignSetRector::class,
         DisallowedEmptyRuleFixerRector::class,
         RemoveUselessParamTagRector::class,