fix(security): reject imported and setattr Gunicorn workers with memory:// - #161
Conversation
…ry:// The startup AST scan treated gunicorn configs that bind workers via import/from-star or object.__setattr__ as single-worker deployments, allowing memory:// rate limiting and per-process sessions while Gunicorn actually forks multiple workers. Co-authored-by: Alexander Wagner <info@alexanderwagnerdev.com>
|
@codex review |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_ceb94b1b-4ba2-45f4-a60f-ae9256a0ac1c) |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 771828b09a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_1b4c92c3-5d9c-4ada-9e23-2e07e4574cbb) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_b4950c2c-0c05-45a3-a131-1b27ce43fd27) |
|
2 participants
Security fix
Severity: Medium
Location:
config.pyIssue: #160
Impact
Gunicorn configs that bind
workersviafrom module import workers, star imports, orobject.__setattr__(..., "workers", N)were treated as single-worker deployments. WithRATELIMIT_STORAGE_URI=memory://, startup succeeded while Gunicorn still forked multiple workers, multiplying login rate-limit buckets and breaking cross-worker session revocation.Remediation
ImportFromstatements that importworkersor*as dynamic.object.__setattr__calls bindingworkerslike existingsetattrdetection.Closes #160
Note
Medium Risk
Changes startup security validation for multi-worker + in-memory rate limits; behavior is intentionally stricter for some Gunicorn config patterns.
Overview
Tightens Gunicorn config AST scanning so
workersset via imports, star imports, orobject.__setattr__is treated as dynamic, matching existingsetattrhandling. That forces a shared rate-limit backend (or blocks startup) whenRATELIMIT_STORAGE_URI=memory://, instead of assuming a single worker while Gunicorn forks many.New helpers
_call_sets_workers_attributeand_import_from_binds_workersplug into the workers walk and dynamic-mutation checks. Imports that bindworkersor*are flagged;from module import workers as other_nameis not flagged.Regression coverage adds startup rejection tests for imported workers and
object.__setattr__, extends the security parametrized cases, and asserts aliased imports stay non-dynamic.Reviewed by Cursor Bugbot for commit 75d6739. Bugbot is set up for automated code reviews on this repo. Configure here.