Batch process limit parameter not capped - potential DoS #42

New Issue

2026-05-31T01:19:00Z

jmiller commented

2026-05-31 01:19:00 +00:00

Problem

BatchController::process() reads the limit parameter from user input with no upper bound:

$limit = $app->getInput()->getInt('limit', 50);

A user could pass limit=999999 to process all articles in a single request, causing memory exhaustion or a PHP timeout.

Fix

$limit = min($app->getInput()->getInt('limit', 50), 100);

File

src/packages/com_mokoog/src/Controller/BatchController.php:63

## Problem `BatchController::process()` reads the `limit` parameter from user input with no upper bound: ```php $limit = $app->getInput()->getInt('limit', 50); ``` A user could pass `limit=999999` to process all articles in a single request, causing memory exhaustion or a PHP timeout. ## Fix ```php $limit = min($app->getInput()->getInt('limit', 50), 100); ``` ## File - `src/packages/com_mokoog/src/Controller/BatchController.php:63`

jmiller added the priority: low security labels 2026-05-31 01:19:00 +00:00

jmiller commented

2026-05-31 01:19:04 +00:00

Branch created: feature/42-batch-process-limit-parameter-not-capped

git fetch origin
git checkout feature/42-batch-process-limit-parameter-not-capped

Branch created: [`feature/42-batch-process-limit-parameter-not-capped`](https://git.mokoconsulting.tech/MokoConsulting/MokoJoomOpenGraph/src/branch/feature/42-batch-process-limit-parameter-not-capped) ```bash git fetch origin git checkout feature/42-batch-process-limit-parameter-not-capped ```

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoJoomOpenGraph#42