Currently the SlidingWindow RateLimiter returns a negative value for getHitCount if the previous SlidingWindow was too long ago. This results in a really high value fromSlidingWindowLimiter::getAvailableTokens() which is higher than the configured limit.

This limits the value of percentOfCurrentTimeframe inSlidingWindow::getHitCount() to 1 so it can't result in a negative hitcount.

The 2nd fix fixes the SlidingWindow instance (essentially) not storing hits if the previous instance is way in the past, as the next instance will still be "in the past". This causes RateLimit to behave as if it were disabled until it has caught up again, which could take a long time when it is configured with a small window size.

carsonbot added Status: Needs Review RateLimiter Bug labels

Feb 9, 2021

carsonbot added this to the5.2 milestone

Feb 9, 2021

Copy link

carsonbot commentedFeb 9, 2021

Hey!

I see that this is your first PR. That is great! Welcome!

Symfony has acontribution guide which I suggest you to read.

In short:

Always add tests
Keep backward compatibility (seehttps://symfony.com/bc).
Bug fixes must be submitted against the lowest maintained branch where they apply (seehttps://symfony.com/releases)
Features and deprecations must be submitted against the 5.x branch.

Review the GitHub status checks of your pull request and try to solve the reported issues. If some tests are failing, try to see if they are failing because of this change.

When two Symfony core team members approve this change, it will be merged and you will become an official Symfony contributor!
If this PR is merged in a lower version branch, it will be merged up to all maintained branches within a few days.

I am going to sit back now and wait for the reviews.

Cheers!

Carsonbot

xesxen force-pushed theno-negative-hitcount branch 2 times, most recently from1073a52 to16a3f0cCompare

February 10, 2021 00:30

xesxen changed the title~~[RateLimiter] Fix remaining tokens for sliding_window overflowing the configured limit~~[RateLimiter] Fix sliding_window misbehaving with stale records

Feb 10, 2021

Copy link

ContributorAuthor

xesxen commentedFeb 10, 2021

Essentially only the last 2 commits are needed to fix the issue, but getHitCount() returning <0 even when it is invalid is still a bug worth fixing imho (the 1st commit).

If wanted, I can remove the 1st commit from this PR.