Harden email subscription throttle keys

Author: MoneroOcean

lib/api/account.js

@@ -1,4 +1,5 @@
 "use strict";
+const crypto = require("crypto");
 
 const SENSITIVE_FAILURE_DELAY_MS = 2 * 1000;
 const SENSITIVE_FAILURE_RETENTION_MS = 10 * 60 * 1000;
@@ -28,9 +29,23 @@ module.exports = function registerAccountRoutes(ctx) {
 
     function timeNow() { return typeof now === "function" ? now() : Date.now(); }
 
-    function sensitiveKey(username) {
-        const value = typeof username === "string" ? username.trim() : "";
-        return value ? value : null;
+    function sensitivePart(value) {
+        if (typeof value === "string") return value.trim();
+        if (typeof value === "number" || typeof value === "boolean") return String(value);
+        return "";
+    }
+
+    function sensitiveKey(kind, username, from, to, enabled) {
+        const userValue = sensitivePart(username);
+        if (!userValue) return null;
+
+        const hash = crypto.createHash("sha256");
+        for (const part of [kind, userValue, sensitivePart(from), sensitivePart(to), sensitivePart(enabled)]) {
+            hash.update(String(Buffer.byteLength(part)));
+            hash.update(":");
+            hash.update(part);
+        }
+        return hash.digest("hex");
     }
 
     function pruneSensitiveFailures(time) {
@@ -54,6 +69,7 @@ module.exports = function registerAccountRoutes(ctx) {
     function acquireSensitiveAttempt(key) {
         if (!key) return null;
         const time = timeNow();
+        pruneSensitiveFailures(time);
         const entry = sensitiveFailures.get(key);
         if (entry && entry.nextAllowedAt > time) return throttlePayload(entry.nextAllowedAt - time);
         sensitiveFailures.set(key, {
@@ -124,7 +140,7 @@ module.exports = function registerAccountRoutes(ctx) {
             if (body) return sendJson(res, 401, { success: false, msg: "No \"username\" parameter was found" });
             return;
         }
-        const throttleKey = sensitiveKey(body.username);
+        const throttleKey = sensitiveKey("subscribeEmail", body.username, body.from, body.to, body.enabled);
         const throttle = acquireSensitiveAttempt(throttleKey);
         if (throttle) return sendJson(res, 429, throttle);
 

tests/api/public_and_auth.js

@@ -347,6 +347,48 @@ test.describe("api public and auth", { concurrency: false }, () => {
         });
     });
 
+    test("email subscription throttle does not let a mismatched email block a valid update", async () => {
+        let updateCalls = 0;
+        const mysql = createMysql(async function handler(sql, params) {
+            if (sql.startsWith("UPDATE users SET enable_email = ?, email = ? WHERE username = ? AND email = ?")) {
+                updateCalls += 1;
+                assert.equal(params[2], "wallet");
+                if (params[3] === "attacker@example.com") return { affectedRows: 0 };
+                assert.deepEqual(params, [1, "new@example.com", "wallet", "old@example.com"]);
+                return { affectedRows: 1 };
+            }
+            throw new Error("Unexpected SQL: " + sql + " params=" + JSON.stringify(params));
+        });
+
+        await withRuntime({
+            blockTemplate: createBlockTemplate(),
+            config: createConfig(),
+            database: createDatabase({ caches: {} }),
+            mysql: mysql,
+            now: () => 0,
+            support: createSupport()
+        }, async (port) => {
+            const attackerFailure = await requestJson(port, "POST", "/user/subscribeEmail", {
+                username: "wallet",
+                enabled: 1,
+                from: "attacker@example.com",
+                to: "bad@example.com"
+            });
+            assert.equal(attackerFailure.statusCode, 401);
+            assert.deepEqual(attackerFailure.json, { error: "FROM email does not match" });
+
+            const validUpdate = await requestJson(port, "POST", "/user/subscribeEmail", {
+                username: "wallet",
+                enabled: 1,
+                from: "old@example.com",
+                to: "new@example.com"
+            });
+            assert.equal(validUpdate.statusCode, 200);
+            assert.deepEqual(validUpdate.json, { msg: "Email preferences were updated" });
+            assert.equal(updateCalls, 2);
+        });
+    });
+
     test("public threshold updates still work and missing worker cache rows fail safely", async () => {
         const mysql = createMysql(async function handler(sql) {
             if (sql.startsWith("SELECT id FROM users WHERE username = ? AND payout_threshold_lock = '1'")) return [];