- Notifications
You must be signed in to change notification settings - Fork26.4k
fix(devtools): add event tagging to prevent DDOS#62645
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
base:main
Are you sure you want to change the base?
Conversation
8e83db9
to20fa9d5
CompareUh oh!
There was an error while loading.Please reload this page.
20fa9d5
tob55f820
Compare/gemini review |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Code Review
This pull request introduces two important defensive mechanisms for the message bus: event tagging to filter out irrelevant messages, and a spam protection mechanism to prevent the devtools from being overwhelmed by high-frequency event streams. The event tagging is implemented correctly across the different message bus types.
My main feedback is on the spam protection logic incontent-script.ts
. The current implementation has a delay in detection which could still allow a burst of messages to impact the extension. I've provided a suggestion for a more immediate protection strategy. Overall, this is a valuable improvement for the stability of the devtools.
Uh oh!
There was an error while loading.Please reload this page.
b55f820
to54b55af
Compare54b55af
toe060593
CompareThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
So happy to see this issue solved. Thanks for this@JeanMeche 🙏
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
e060593
to5ef124c
CompareOne common problem encountered by the devtools content script is that it accepted almost any message send over the message bus. Some websites like `auth.openai.com` were spamming the bus and DDOS the devtools app.By introducing event tagging and skipping non-devtools events we prevent DDOS of the Angular devtools content script by on forward tagged events.
5ef124c
toa6503d4
Compare
Uh oh!
There was an error while loading.Please reload this page.
One common problem encountered by the devtools content script is that it accepted almost any message send over the message bus. Some websites like
auth.openai.com
were spamming the bus and DDOS the devtools app.By introducing event tagging and skipping non-devtools events we prevent DDOS of the Angular devtools content script by on forward tagged events.
fixes#62471#62450#55854