Fix posible DOS
Запрос
curl -i 'https://auction-staging.prozorro.sale/api/auctions?page=1&limit=99999'
может привести к DOS из-за отсутствия верхнего ограничения по количеству выборки limit=99999
Необходимо ограничить максимум до 100
Vulnerability Details:
API requests consume resources such as network, CPU, memory, and storage. The amount
of resources required to satisfy a request greatly depends on the input from the user and
the business logic of the endpoint. APIs do not always impose restrictions on the size or
number of resources that can be requested by the client or user. Not only can this impact
the API server performance, leading to Denial of Service (DoS), but it also leaves the door
open to brute-forcing and enumeration attacks against APIs that provide authentication and
data fetching functionality.
For example, think of an application that displays a list of 100 users per page. The URL will
look like this https://www.example.com/users?page=1&count=100. An attacker can change
the "count" parameter to a large number like "1 000 000", making the application query the
database for 1 million users. The attacker can use such behavior to make API/DB
unresponsive and break the application for all other users.
Edited by Pavel Kuzmenko