forms: harden honeypot — skip file save for spam, log triggers - #50
Merged
Conversation
Two follow-ups to #45 surfaced during self-review: 1. Spam submissions still wrote uploaded files to disk. For forms that accept uploads, a bot could fill __fl_hp and still flood storage. Gate the file-save block on !isSpam so spam submissions are a no-op for the filesystem. 2. The honeypot was entirely silent — operators had zero visibility into spam volume. Add a single Info log line on each trigger (form_id + form_slug). On by default so the signal is there, info-level so it can be filtered at scale. Also includes a test-infrastructure fix: SubmissionFile was missing from testsupport.SetupTestDB, so previous file-related tests would have failed with 'no such table' if anyone tried.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two follow-ups from a self-review of #45 (v3.0.9):
1. Spam submissions no longer save uploaded files
The original honeypot fix gated delivery events on
!isSpambut left the file-save block alone. For forms that accept uploads, a bot could still flood disk while looking like a normal trapped spam submission.CreateSubmissionWithFilesnow skips the file-save block (noSaveFilescall, noSubmissionFilerows,submission.Filesstays empty) when the honeypot is triggered.2. Honeypot triggers now log
Previously the honeypot was entirely silent — operators had no signal at all that bots were hitting them. Adds one
slog.Info("honeypot triggered", ...)line on each trip withform_id+form_slug. On by default; info-level so it can be filtered at scale if it ever gets noisy.Infra
SubmissionFiletotestsupport.SetupTestDB's migrations (was missing — any test that exercised the file path would have died with "no such table").TestCreateSubmission/honeypot-trapped_submission_does_not_save_uploaded_filesexercises files + payload + honeypot end-to-end and asserts no rows, no files attached, and no bytes in dataDir.Related: #45.