Skip to content

Fix/track user storage exhaustion#2155

Open
anshika1179 wants to merge 4 commits into
JhaSourav07:mainfrom
anshika1179:fix/track-user-storage-exhaustion
Open

Fix/track user storage exhaustion#2155
anshika1179 wants to merge 4 commits into
JhaSourav07:mainfrom
anshika1179:fix/track-user-storage-exhaustion

Conversation

@anshika1179
Copy link
Copy Markdown
Contributor

Description

Fixes #1980

This PR addresses the database storage exhaustion vulnerability where arbitrary usernames could be inserted into the tracking database without validation.

Modifications implemented:

  • GitHub Username Formatting Gate: Implemented strict GitHub username regex validation to block UUIDs/malformed strings immediately.
  • GitHub Existence Check: Confirms if the user exists on GitHub before committing database writes.
  • Validation Cache: Caches lookup results (both valid and invalid) for 24 hours to optimize external rate limits.
  • Write Cooldown Deduplication: Limits tracking writes to at most once every 5 minutes per user, gracefully skipping redundant DB upserts.

Pillar

  • 🎨 Pillar 1 — New Theme Design
  • 📐 Pillar 2 — Geometric SVG Improvement
  • 🕐 Pillar 3 — Timezone Logic Optimization
  • 🛠️ Other (Bug fix, refactoring, docs)

Visual Preview

(N/A - Security backend/middleware hardening change. Complete test suite validation has been performed locally).

Checklist before requesting a review:

  • I have read the CONTRIBUTING.md file.
  • I have tested these changes locally (localhost:3000/api/streak?user=YOUR_USERNAME).
  • I have run npm run format and npm run lint locally and resolved all errors (CI will fail otherwise).
  • My commits follow the Conventional Commits format (e.g., feat(themes): ..., fix(calculate): ...).
  • I have updated README.md if I added a new theme or URL parameter.
  • I have started the repo.
  • I have made sure that i have only one commit to merge in this PR.
  • The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth animations, correct fonts).
  • (Recommended) I joined the CommitPulse Discord community for contributor discussions, mentorship, and faster PR support.

@vercel
Copy link
Copy Markdown
Contributor

vercel Bot commented May 31, 2026

@anshika1179 is attempting to deploy a commit to the jhasourav07's projects Team on Vercel.

A member of the Team first needs to authorize it.

Copy link
Copy Markdown
Collaborator

@Aamod007 Aamod007 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR! The changes look great, but it appears there are massive unintended changes to \package-lock.json. Please revert the \package-lock.json\ changes so we can review and merge this.

@github-actions github-actions Bot added the needs-rebase This PR has merge conflicts and needs a rebase. label May 31, 2026
@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

26 similar comments
@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

14 similar comments
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

⚠️ Hey @anshika1179, this PR has merge conflicts with the main branch.

Please pull the latest changes and resolve the conflicts so we can review it!

git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-lease

Once resolved, the needs-rebase label will be removed automatically on the next check. 🙌

@github-actions github-actions Bot added status:blocked This PR is blocked due to a failing CI check. and removed needs-rebase This PR has merge conflicts and needs a rebase. labels Jun 1, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

🚨 Hey @anshika1179, the CI Pipeline is failing on this PR and it has been marked as status:blocked.

Please fix the issues before this can be reviewed. Here's how:

1. Run checks locally before pushing:

npm run format:check   # Check Prettier formatting
npm run lint           # Run ESLint
npm run typecheck      # TypeScript type check
npm run test           # Run unit tests (Vitest)
npm run build          # Verify production build passes

2. Auto-fix common issues:

npm run format         # Auto-fix formatting with Prettier
npm run lint -- --fix  # Auto-fix lint errors where possible

3. Check the full failure log here:
👉 View CI Run

Once you push a fix and the CI passes, the status:blocked label will be removed automatically. 💪

@anshika1179 anshika1179 force-pushed the fix/track-user-storage-exhaustion branch from b147fda to cca1cf9 Compare June 1, 2026 03:00
@github-actions github-actions Bot removed the status:blocked This PR is blocked due to a failing CI check. label Jun 1, 2026
@Aamod007 Aamod007 added GSSoC 2026 mentor:Aamod007 type:security Security fixes, dependency updates, or hardening level:advanced Complex contributions involving architecture, optimization, or significant feature work quality:exceptional Outstanding contribution with exceptional implementation quality, testing. labels Jun 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

GSSoC 2026 level:advanced Complex contributions involving architecture, optimization, or significant feature work mentor:Aamod007 quality:exceptional Outstanding contribution with exceptional implementation quality, testing. type:security Security fixes, dependency updates, or hardening

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug:Unauthenticated Database Storage Exhaustion (Denial of Wallet) via `/api/track-user

2 participants