A feed's Directory page builds the whole Directory to check that one feed is listed #160

Closed
opened 2026-10-08 18:36:26 -07:00 by rays · 1 comment
Owner

Found in a code audit on 2026-10-09.

GET /api/directory/{id} and POST /api/popular/{id} (src/web.rs:1050, src/web.rs:1085) check that the feed may be listed by building the whole Directory (popular(): every feed's listing, every file row for the Podcasts/Blogs split, every subscription) and looking for the id. In production the Directory takes 0.4 s and one feed's Directory page 0.57 s, measured 2026-10-09; subscribing from it pays the same.

Fix: ask the one question for the one feed: in the catalogue, not an OPML itself, and neither it nor its OPML private.

Found in a code audit on 2026-10-09. `GET /api/directory/{id}` and `POST /api/popular/{id}` (`src/web.rs:1050`, `src/web.rs:1085`) check that the feed may be listed by building the whole Directory (`popular()`: every feed's listing, every file row for the Podcasts/Blogs split, every subscription) and looking for the id. In production the Directory takes 0.4 s and one feed's Directory page 0.57 s, measured 2026-10-09; subscribing from it pays the same. Fix: ask the one question for the one feed: in the catalogue, not an OPML itself, and neither it nor its OPML private.
rays added the bug label 2026-10-08 18:36:26 -07:00
Author
Owner

Fixed in e710103: the listing rule is listable(), which the Directory filters by and a feed's page and subscribing ask of the catalogue directly. A feed's Directory page: 0.57 s before, 0.14 s after. Test: the_directory_lists_feeds_not_their_groups_and_nothing_private. Deployed as 0.10.3-dev on 2026-10-09.

Fixed in e710103: the listing rule is listable(), which the Directory filters by and a feed's page and subscribing ask of the catalogue directly. A feed's Directory page: 0.57 s before, 0.14 s after. Test: the_directory_lists_feeds_not_their_groups_and_nothing_private. Deployed as 0.10.3-dev on 2026-10-09.
rays closed this issue 2026-10-08 18:58:47 -07:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: rays/ipx#160