openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

[PR #40] [CLOSED] fix: add rate limiting to download counter to prevent inflation #227

New Issue
Closed
opened 2026-02-15 17:16:23 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:23 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/openclaw/clawhub/pull/40
Author: @orlyjamie
Created: 1/26/2026
Status: ❌ Closed

Base: main ← Head: fix/download-rate-limiting

📝 Commits (1)

  • d4d51cb fix: add rate limiting to download counter to prevent inflation

📊 Changes

1 file changed (+35 additions, -2 deletions)

View changed files

📝 convex/downloads.ts (+35 -2)

📄 Description

Summary

  • Add IP-based rate limiting (5 downloads per skill per IP per hour) to prevent download count inflation
  • Only trust cf-connecting-ip header - x-forwarded-for is trivially spoofable
  • Still serve files to rate-limited users, just don't count inflated downloads

The Vulnerability

The download endpoint at convex/downloads.ts:56 incremented download counts with no rate limiting. An
attacker could inflate any skill's download count by:

  for i in {1..1000}; do                                                                                      
    curl -H "X-Forwarded-For: 1.2.3.$i" \                                                                     
      "https://api.clawdhub.com/download?slug=target-skill" -o /dev/null                                      
  done

Important Note

Download counts are fundamentally gameable as trust metrics because downloads are anonymous. Even with
rate limiting, attackers can use proxies/VPNs/Tor.

Recommendation: De-emphasize downloads in the UI. Stars and installs are better trust signals because they
require authenticated sessions.

Reference: https://x.com/theonejvo/status/2015892980851474595

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/openclaw/clawhub/pull/40 **Author:** [@orlyjamie](https://github.com/orlyjamie) **Created:** 1/26/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/download-rate-limiting` --- ### 📝 Commits (1) - [`d4d51cb`](https://github.com/openclaw/clawhub/commit/d4d51cb1115160f33c1f64e7dc47991fc1771169) fix: add rate limiting to download counter to prevent inflation ### 📊 Changes **1 file changed** (+35 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `convex/downloads.ts` (+35 -2) </details> ### 📄 Description Summary - Add IP-based rate limiting (5 downloads per skill per IP per hour) to prevent download count inflation - Only trust cf-connecting-ip header - x-forwarded-for is trivially spoofable - Still serve files to rate-limited users, just don't count inflated downloads The Vulnerability The download endpoint at convex/downloads.ts:56 incremented download counts with no rate limiting. An attacker could inflate any skill's download count by: ``` for i in {1..1000}; do curl -H "X-Forwarded-For: 1.2.3.$i" \ "https://api.clawdhub.com/download?slug=target-skill" -o /dev/null done ``` Important Note Download counts are fundamentally gameable as trust metrics because downloads are anonymous. Even with rate limiting, attackers can use proxies/VPNs/Tor. Recommendation: De-emphasize downloads in the UI. Stars and installs are better trust signals because they require authenticated sessions. Reference: https://x.com/theonejvo/status/2015892980851474595 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 17:16:23 -05:00
yindo closed this issue 2026-02-15 17:16:23 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#227
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?