decentraland / world-storage-service / 28628817499 / 1

99%

main: 99%

push

github

fix: harden storage quotas, input validation, and upstream resilience (#111)

* fix: harden storage quotas, input validation, and upstream resilience

Fixes from a full-codebase audit:

Quota correctness:
- Credit the existing value against the exact (place_id, key) row on
  upserts; a same-named key in another scene could previously be credited,
  letting worlds exceed their storage limit without bound.
- Aggregate quota totals and usage per place for shared Genesis City realms
  (per world for *.dcl.eth worlds, unchanged), so unrelated land scenes no
  longer compete for or disclose a single realm-wide pool. New place-aware
  covering indexes keep the per-write aggregation index-only.
- Run limits validation and the write atomically: upserts go through a new
  storage-operations logic component that holds pg_advisory_xact_lock on
  the quota scope inside a transaction, so concurrent upserts cannot
  validate against the same usage snapshot and both pass.
- Cast size sums to bigint (an int cast overflows at 2 GB and 500s every
  request in the scope).

Input validation and HTTP hardening:
- Validate :key length (1-255 chars) on all nine key endpoints instead of
  failing the varchar insert with a 500.
- Cap request bodies via Content-Length before anything buffers or parses
  them (411/413), and run authorization before schema validation so
  unauthorized callers cannot make the server parse bodies.
- Validate parcel metadata as two integers before it reaches upstream API
  paths; encode the LAMBDAS permission URL segments.
- Lowercase realm names so casing cannot split storage, cache namespaces,
  or quotas; a data migration lowercases existing rows (keeping the
  canonical lowercase row on collision) so mixed-case data stays reachable.
- Reject values containing NUL characters with a 400 (jsonb cannot store
  them); return stored empty-string env values instead of 404; validate the
  player address in clearPlayerStorageHandler; escape LIKE wildcard... (continued)

381 of 393 branches covered (96.95%)

Branch coverage included in aggregate %.

2156 of 2168 relevant lines covered (99.45%)

35.6 hits per line