Pensar - auto fix for Unbounded Tweet Retrieval Resource Exhaustion Vulnerability

[pensarappstaging]

• The resource exhaustion vulnerability in the user_lookup_tweepy method has been fixed as follows:
  • A class constant MAX_TWEETS (set to 3200, Twitter's maximum) was added to define a safe upper bound for tweets fetchable.
  • The quantity parameter is now explicitly checked and converted to int if needed. If conversion fails or if value is less than 1, zero tweets are returned. If more than MAX_TWEETS is requested, it is capped at that value.
  • This prevents arbitrarily large resource consumption and API abuse.
• No dependency/version issues were present in the provided metadata, so no other changes were made.
• All formatting and whitespace were preserved as required.

More Details

Type	Identifier	Message	Severity	Link
Application	CWE-400, ML08	The user_lookup_tweepy method accepts an attacker-controlled quantity parameter and feeds it directly to tweepy.Cursor(...).items(quantity). Because no upper bound or sanity check is enforced, a caller can request an arbitrarily large number (e.g., 1e9) and force the program to iterate until the Twitter API is exhausted (or until local resources are). This can result in excessive API calls, CPU, memory, and network usage, potentially leading to denial-of-service conditions or unexpected cost spikes. In an ML context, this constitutes OWASP ML Top-10 ML08 (Resource Exhaustion via Oversized Inputs).	high	Link