[anupamme]

The updateFromNetwork() function accepts an unbounded array of reference identifiers without size validation. While refs are batched into a single comma-separated query string (mitigating unbounded concurrent requests), an attacker providing a very large array (10,000+ refs) could construct an extremely long URL causing application slowdown and API quota depletion for bibliography services. The affected code is src/core/biblio.js:68. This change is the fix I would apply.

Reference: CWE-770

What changed

• src/core/biblio.js

Verification

No automated check could be run against this repository, so this change is unverified beyond review. Please treat it as a suggestion.

Regression test

The security boundary is maintained under adversarial input

Test

import { updateFromNetwork } from "../../src/core/biblio.js";
import { expect } from "chai";

describe("updateFromNetwork: input size is bounded to prevent resource exhaustion", () => {
  const payloads = [
    { name: "valid small array", refs: ["ref1", "ref2", "ref3"], shouldSucceed: true },
    { name: "boundary at limit", refs: Array(100).fill("x"), shouldSucceed: true },
    { name: "exploit oversized array", refs: Array(10000).fill("a".repeat(20)), shouldSucceed: false },
  ];

  payloads.forEach(({ name, refs, shouldSucceed }) => {
    it(`handles ${name}`, async () => {
      const result = await updateFromNetwork(refs);
      if (!shouldSucceed) {
        expect(result).to.be.null;
      }
    });
  });
});

---

Automated security fix by OrbisAI Security

[Copilot]

Copilot review overview

🟡 Changes recommended

The batching still permits unbounded concurrent requests and does not reject oversized duplicate-heavy inputs.

Review effort: Balanced
Findings: 1

Open (1)

• Enforce resource limits before deduplication and bound requests · New

What changed in this PR

Adds bibliography request limits intended to mitigate resource exhaustion.

Changes:

• Splits bibliography references into batches of 100.
• Merges batched responses and expiration metadata.

File	Description
src/​core/​biblio.js	Adds batching for bibliography network requests.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.