feat: add rate limiting for creating federated shares for non-trusted servers

feat: add rate limiting for creating federated shares for non-trusted servers

Signed-off-by: Robin Appelman <robin@icewind.nl>

[skip ci]

Author: icewind1991

apps/cloud_federation_api/lib/Controller/RequestHandlerController.php

@@ -79,6 +79,7 @@ public function __construct(
 	#[PublicPage]
 	#[NoCSRFRequired]
 	#[BruteForceProtection(action: 'receiveFederatedShare')]
+	#[FederationRateLimit(limit: 5, period: 1200)]
 	public function addShare($shareWith, $name, $description, $providerId, $owner, $ownerDisplayName, $sharedBy, $sharedByDisplayName, $protocol, $shareType, $resourceType) {
 		// check if all required parameters are set
 		if ($shareWith === null ||

apps/federatedfilesharing/lib/Controller/RequestHandlerController.php

@@ -120,6 +120,7 @@ public function __construct(string $appName,
 	 */
 	#[NoCSRFRequired]
 	#[PublicPage]
+	#[FederationRateLimit(limit: 5, period: 1200)]
 	public function createShare(
 		?string $remote = null,
 		?string $token = null,

lib/private/AppFramework/Http/Attributes/FederationRateLimit.php

@@ -0,0 +1,55 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OC\AppFramework\Http\Attributes;
+
+use Attribute;
+use OC\OCM\OCMDiscoveryService;
+use OCA\Federation\TrustedServers;
+use OCP\AppFramework\Http\Attribute\AnonRateLimit;
+use OCP\IRequest;
+use OCP\Server;
+
+/**
+ * Attribute for controller methods that want to limit the times a not logged-in
+ * guest can call the endpoint in a given time period.
+ *
+ * Unlike regular AnonRateLimit, signed requests from trusted servers are excluded from the rate limit.
+ */
+#[Attribute(Attribute::TARGET_METHOD)]
+class FederationRateLimit extends AnonRateLimit {
+	private readonly OCMDiscoveryService $discoveryService;
+	private readonly ?TrustedServers $trustedServers;
+
+	public function __construct(int $limit, int $period) {
+		parent::__construct($limit, $period);
+
+		$this->discoveryService = Server::get(OCMDiscoveryService::class);
+		$this->trustedServers = Server::get(TrustedServers::class);
+	}
+
+	#[\Override]
+	public function shouldApply(IRequest $request): bool {
+		if ($this->trustedServers === null) {
+			return true;
+		}
+
+		try {
+			$signedRequest = $this->discoveryService->getIncomingSignedRequest();
+			if (!$signedRequest) {
+				return true;
+			}
+			$signedRequest->verify();
+			return !$this->trustedServers->isTrustedServer($signedRequest->getOrigin());
+		} catch (\Exception) {
+			// no or invalid signature
+			return true;
+		}
+	}
+}