newOS4 v4.6.37: bug-report pipeline (report.php, bug command, HTML generator, telemetry-loop fix)

1 files changed, 8 insertions, 2 deletions

diff --git a/api/debug/ingest.php b/api/debug/ingest.php
index 363dd09..b513593 100644
--- a/api/debug/ingest.php
+++ b/api/debug/ingest.php
@@ -17,6 +17,12 @@ $errors = $payload['errors'];
 $session = $payload['session'] ?? [];
 $clientVersion = $payload['version'] ?? 'unknown';
 
+// Client-supplied counts are untrusted: clamp so a bad client cannot store 38,495× rows.
+function clamp_count($v) {
+    $n = (int)$v;
+    return $n < 1 ? 1 : ($n > 1000 ? 1000 : $n);
+}
+
 // Validate batch size
 if (count($errors) > MAX_ERRORS_PER_BATCH) {
     $errors = array_slice($errors, 0, MAX_ERRORS_PER_BATCH);
@@ -65,7 +71,7 @@ foreach ($errors as $e) {
     if (isset($existingHashes[$hash])) {
         // Update existing entry
         $idx = $existingHashes[$hash];
-        $allErrors[$idx]['count'] += $e['count'] ?? 1;
+        $allErrors[$idx]['count'] += clamp_count($e['count'] ?? 1);
         $allErrors[$idx]['last_seen'] = $e['lastSeen'] ?? $now;
         $allErrors[$idx]['ingested_at'] = $now;
         if (!empty($e['stack'])) {
@@ -85,7 +91,7 @@ foreach ($errors as $e) {
         'module' => $e['module'] ?? null,
         'stack' => isset($e['stack']) ? substr($e['stack'], 0, 2000) : null,
         'session_id' => $sessionId,
-        'count' => $e['count'] ?? 1,
+        'count' => clamp_count($e['count'] ?? 1),
         'first_seen' => $e['firstSeen'] ?? $now,
         'last_seen' => $e['lastSeen'] ?? $now,
         'ingested_at' => $now,