[hardening][page-templates] Defense-in-depth: workspace checks + throttle fan-out #36

New Issue

Ghost · 2026-06-20T20:36:07+03:00

Ghost commented

2026-06-20 20:36:07 +03:00

From review of #17 (merged to develop). None of these are currently exploitable; they are consistency / defense-in-depth.

toggleTemplate (apps/server/src/core/page/transclusion/page-template.controller.ts) has no explicit page.workspaceId === user.workspaceId check; it relies on the space-membership model (a cross-workspace page yields no space role -> NotFound). Add an explicit check like unsyncReference for consistency.
PageTemplateReferencesRepo.deleteByReferenceAndSources is not workspace-scoped (filters only by referencePageId + sourcePageId). Add workspaceId for consistency with the "scope by workspaceId everywhere" invariant.
PAGE_TEMPLATE_THROTTLER allows 30 req/min x 50 ids = up to ~1500 full ProseMirror docs/min/user, while the recursion/depth guard is client-only. Consider monitoring or a tighter limit.

Severity: low.

From review of #17 (merged to develop). None of these are currently exploitable; they are consistency / defense-in-depth. - `toggleTemplate` (`apps/server/src/core/page/transclusion/page-template.controller.ts`) has no explicit `page.workspaceId === user.workspaceId` check; it relies on the space-membership model (a cross-workspace page yields no space role -> NotFound). Add an explicit check like `unsyncReference` for consistency. - `PageTemplateReferencesRepo.deleteByReferenceAndSources` is not workspace-scoped (filters only by referencePageId + sourcePageId). Add `workspaceId` for consistency with the "scope by workspaceId everywhere" invariant. - `PAGE_TEMPLATE_THROTTLER` allows 30 req/min x 50 ids = up to ~1500 full ProseMirror docs/min/user, while the recursion/depth guard is client-only. Consider monitoring or a tighter limit. Severity: low.

Ghost referenced this issue from a commit

2026-06-20 21:43:27 +03:00

fix(page-templates): defense-in-depth workspace checks (#36)

vvzvlad referenced this issue from a commit

2026-06-21 01:51:21 +03:00

Merge develop into fix/page-template-demo-issues (#45)

Ghost closed this issue

2026-06-21 02:05:33 +03:00

Sign in to join this conversation.