mirror of
https://github.com/HolgerHatGarKeineNode/einundzwanzig-app.git
synced 2026-06-05 01:15:36 +00:00
🛡️ **Add robust Livewire payload validation and throttling**
- ✅ Implemented handling for `CorruptComponentPayloadException` to prevent logging noise and improve exception management. - 🛠️ Added IP-based throttling (120 requests/min) for the `/livewire/update` endpoint with middleware integration for better traffic control. - ✅ Introduced unit tests to validate throttle settings and middleware application. - 🧪 Enhanced tests for ensuring silent handling of corrupt payload scenarios and reduced log noise.
This commit is contained in:
@@ -10,6 +10,7 @@ use Illuminate\Http\Request;
|
||||
use Livewire\Exceptions\MethodNotFoundException;
|
||||
use Livewire\Features\SupportFileUploads\MissingFileUploadsTraitException;
|
||||
use Livewire\Features\SupportLifecycleHooks\DirectlyCallingLifecycleHooksNotAllowedException;
|
||||
use Livewire\Mechanisms\HandleComponents\CorruptComponentPayloadException;
|
||||
use Stefro\LaravelLangCountry\Middleware\LangCountrySession;
|
||||
|
||||
return Application::configure(basePath: dirname(__DIR__))
|
||||
@@ -100,6 +101,17 @@ return Application::configure(basePath: dirname(__DIR__))
|
||||
if ($isLivewireExploitProbe($e)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Bots replay `/livewire/update` with a mutated snapshot whose HMAC
|
||||
// checksum no longer matches its [name, id, data]. Checksum::verify()
|
||||
// rejects these, so the rejection is the tamper signature, not an app
|
||||
// fault — we silence the report noise. Rendering is left untouched:
|
||||
// the exception already returns a native 419 on its own.
|
||||
if ($e instanceof CorruptComponentPayloadException) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return null;
|
||||
});
|
||||
|
||||
$exceptions->render(function (Throwable $e, Request $request) use ($isStaleLivewireAsset, $isStaleCompiledView, $isMissingFileUploadsTrait, $isLivewireExploitProbe) {
|
||||
|
||||
Reference in New Issue
Block a user