From 9799963c5317e124967430431a830966a04192fa Mon Sep 17 00:00:00 2001 From: anupamme Date: Fri, 28 Aug 2026 09:13:53 +0000 Subject: [PATCH] fix: V-002 security vulnerability Automated security fix generated by OrbisAI Security --- saltgui/static/scripts/Api.js | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/saltgui/static/scripts/Api.js b/saltgui/static/scripts/Api.js index bc2a8507a..7c3f0857e 100644 --- a/saltgui/static/scripts/Api.js +++ b/saltgui/static/scripts/Api.js @@ -362,9 +362,15 @@ export class API { options.body = JSON.stringify(pParams); } + // simple client-side throttle to avoid flooding the server with rapid requests + const now = Date.now(); + API._requestTimestamps = (API._requestTimestamps || []).filter((pTs) => now - pTs < 1000); + const delay = API._requestTimestamps.length >= 20 ? 1000 - (now - API._requestTimestamps[0]) : 0; + API._requestTimestamps.push(now); + /* eslint-disable compat/compat */ /* fetch is not supported in op_mini all, IE 11 */ - return window.fetch(url, options). + return new Promise((pResolve) => setTimeout(pResolve, Math.max(0, delay))).then(() => window.fetch(url, options)). /* eslint-enable compat/compat */ then((pResponse) => { if (pResponse.ok && pPage.endsWith(".txt")) {