decentraland / world-storage-service / 28615156822

99%

main: 99%

Build Type

Pull #111

github

Committed by LautaroPetaccio

Commit Message

fix: harden storage quotas, input validation, and upstream resilience

Fixes from a full-codebase audit:

Quota correctness:
- Credit the existing value against the exact (place_id, key) row on
  upserts; a same-named key in another scene could previously be credited,
  letting worlds exceed their storage limit without bound.
- Aggregate quota totals and usage per place for shared Genesis City realms
  (per world for *.dcl.eth worlds, unchanged), so unrelated land scenes no
  longer compete for or disclose a single realm-wide pool. New place-aware
  covering indexes keep the per-write aggregation index-only.
- Run limits validation and the write atomically: upserts go through a new
  storage-operations logic component that holds pg_advisory_xact_lock on
  the quota scope inside a transaction, so concurrent upserts cannot
  validate against the same usage snapshot and both pass.
- Cast size sums to bigint (an int cast overflows at 2 GB and 500s every
  request in the scope).

Input validation and HTTP hardening:
- Validate :key length (1-255 chars) on all nine key endpoints instead of
  failing the varchar insert with a 500.
- Cap request bodies via Content-Length before anything buffers or parses
  them (411/413), and run authorization before schema validation so
  unauthorized callers cannot make the server parse bodies.
- Validate parcel metadata as two integers before it reaches upstream API
  paths; encode the LAMBDAS permission URL segments.
- Lowercase realm names so casing cannot split storage, cache namespaces,
  or quotas; a data migration lowercases existing rows (keeping the
  canonical lowercase row on collision) so mixed-case data stays reachable.
- Reject values containing NUL characters with a 400 (jsonb cannot store
  them); return stored empty-string env values instead of 404; validate the
  player address in clearPlayerStorageHandler; escape LIKE wildcards in
  prefix filters so they match literally.

Upstream resilience:
- Add share... (continued)

Pull Request Pull Request #111: fix: harden storage quotas, input validation, and upstream resilience

Coverage Stats

352 of 364 branches covered (96.7%)

Branch coverage included in aggregate %.

166 of 171 new or added lines in 30 files covered. (97.08%)

1 existing line in 1 file now uncovered.

1072 of 1079 relevant lines covered (99.35%)

70.19 hits per line