From 8f288c60daf4da5e2f44bc65fedcca803d6ae896 Mon Sep 17 00:00:00 2001
From: xfy <i@rua.plus>
Date: Thu, 18 Jun 2026 13:43:57 +0800
Subject: [PATCH] fix(comments): rate-limit check_pending_status to prevent
 status enumeration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

该接口供访客轮询自己刚提交评论的审核状态，故不加 admin 鉴权（会破坏合法
轮询）；改为加 strict 限流（对 unknown IP 降级宽松桶），阻止批量枚举评论
状态（L3）。复用 check_strict_limit，与其它敏感接口一致。
---
 src/api/comments/check.rs | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/api/comments/check.rs b/src/api/comments/check.rs
index d6c0aad..fc7bc85 100644
--- a/src/api/comments/check.rs
+++ b/src/api/comments/check.rs
@@ -31,6 +31,17 @@ pub async fn check_pending_status(ids: Vec<i64>) -> Result<Vec<PendingStatusItem
             return Ok(vec![]);
         }
 
+        // 限流防高速遍历枚举评论状态（L3）。本接口供访客轮询自己刚提交的评论
+        // 审核状态，故不加 admin 鉴权；但 strict 限流（对 unknown IP 降级宽松桶）
+        // 足以阻止批量枚举。
+        if let Some(ctx) = dioxus::fullstack::FullstackContext::current() {
+            let parts = ctx.parts_mut();
+            let ip = crate::api::rate_limit::get_client_ip(&parts.headers);
+            if let Err(_msg) = crate::api::rate_limit::check_strict_limit(&ip) {
+                return Err(ServerFnError::new("请求过于频繁，请稍后再试"));
+            }
+        }
+
         let client = get_conn().await.map_err(AppError::db_conn)?;
 
         let rows = client