Security / reliability issue
The API stores one asyncio.Lock forever for every caller-provided session_id:
session_lock = session_locks.setdefault(session_key, asyncio.Lock())
This is at nanobot/api/server.py:240 and the dictionary is initialized at line 413. There is no TTL, eviction, maximum size, or identity-based keying.
Impact
An attacker can send many unique session IDs and grow process memory indefinitely. This also allows unbounded lock bookkeeping even when requests finish.
Suggested fix
Use bounded/LRU lock storage, remove idle locks safely, cap session IDs, or derive locks from an authenticated principal rather than arbitrary request input. Add a regression test for bounded growth.
Security / reliability issue
The API stores one
asyncio.Lockforever for every caller-providedsession_id:This is at
nanobot/api/server.py:240and the dictionary is initialized at line 413. There is no TTL, eviction, maximum size, or identity-based keying.Impact
An attacker can send many unique session IDs and grow process memory indefinitely. This also allows unbounded lock bookkeeping even when requests finish.
Suggested fix
Use bounded/LRU lock storage, remove idle locks safely, cap session IDs, or derive locks from an authenticated principal rather than arbitrary request input. Add a regression test for bounded growth.