Pensar - auto fix for Unbounded Twitter API Request Resource Consumption

[pensarappdev]

Security Issue Fixed:

• Resource Consumption Vulnerability in Utils.user_lookup_tweepy:
  • The quantity parameter was previously user-controlled and unchecked, allowing a malicious/naïve caller to request an excessively high number of tweets, resulting in potential Denial of Service through network, memory, or API rate exhaustion.
  • Fix applied:
    • Added a constant MAX_TWEETS = 3200 to cap the maximum retrievable tweets.
    • Added input validation:
      • If quantity is not a positive integer, a ValueError is raised.
      • If quantity exceeds MAX_TWEETS, it is capped and a log info message is emitted.
    • These changes are made before calling .items(quantity), ensuring no excessive resource usage can occur.

There were no dependency issues reported, so no dependency changes were needed.

More Details

Type	Identifier	Message	Severity	Link
Application	CWE-400	The quantity argument—fully controlled by external input—is passed unchecked to tweepy.Cursor(...).items(quantity). If an attacker supplies an extremely large value, the code will initiate an unbounded number of API requests and store every returned tweet in memory. This leads to excessive network usage, possible Twitter-rate-limit bans, and unbounded memory/CPU growth on the host, resulting in a denial-of-service condition. No upper limit, validation, or throttling is applied.	high	Link