Fix unbounded public rate limit buckets

bitchat/Nostr/NostrProtocol.swift

@@ -501,10 +501,6 @@ struct NostrEvent: Codable {
             throw NostrError.invalidEvent
         }
         
-        guard Self.isWithinInboundTagLimits(tags) else {
-            throw NostrError.invalidEvent
-        }
-
         self.id = dict["id"] as? String ?? ""
         self.pubkey = pubkey
         self.created_at = createdAt
@@ -513,17 +509,6 @@ struct NostrEvent: Codable {
         self.content = content
         self.sig = dict["sig"] as? String
     }
-
-    private static func isWithinInboundTagLimits(_ tags: [[String]]) -> Bool {
-        guard tags.count <= TransportConfig.nostrMaxEventTags else { return false }
-
-        for tag in tags {
-            guard tag.count <= TransportConfig.nostrMaxEventTagValues else { return false }
-            guard tag.allSatisfy({ $0.utf8.count <= TransportConfig.nostrMaxEventTagValueBytes }) else { return false }
-        }
-
-        return true
-    }
     
     func sign(with key: P256K.Schnorr.PrivateKey) throws -> NostrEvent {
         let (eventId, eventIdHash) = try calculateEventId()

bitchat/Nostr/NostrRelayManager.swift

@@ -963,7 +963,6 @@ private enum ParsedInbound {
     
     init?(_ message: URLSessionWebSocketTask.Message) {
         guard let data = message.data,
-              data.count <= TransportConfig.nostrMaxInboundMessageBytes,
               let array = try? JSONSerialization.jsonObject(with: data) as? [Any],
               array.count >= 2,
               let type = array[0] as? String else {

bitchat/Services/TransportConfig.swift

@@ -56,6 +56,9 @@ enum TransportConfig {
     static let uiSenderRateBucketRefillPerSec: Double = 1.0
     static let uiContentRateBucketCapacity: Double = 3
     static let uiContentRateBucketRefillPerSec: Double = 0.5
+    static let uiSenderRateBucketMaxEntries: Int = 2000
+    static let uiContentRateBucketMaxEntries: Int = 2000
+    static let uiRateBucketIdleTTL: TimeInterval = 10 * 60
 
     // UI sleeps/delays
     static let uiStartupInitialDelaySeconds: TimeInterval = 1.0
@@ -129,12 +132,6 @@ enum TransportConfig {
     static let nostrGeohashSampleLimit: Int = 100
     static let nostrDMSubscribeLookbackSeconds: TimeInterval = 86400
 
-    // Nostr inbound event safety limits
-    static let nostrMaxInboundMessageBytes: Int = 256 * 1024
-    static let nostrMaxEventTags: Int = 64
-    static let nostrMaxEventTagValues: Int = 16
-    static let nostrMaxEventTagValueBytes: Int = 1024
-
     // Nostr helpers
     static let nostrShortKeyDisplayLength: Int = 8
     static let nostrConvKeyPrefixLength: Int = 16

bitchat/ViewModels/ChatNostrCoordinator.swift

@@ -262,10 +262,8 @@ final class ChatNostrCoordinator {
         if viewModel.deduplicationService.hasProcessedNostrEvent(event.id) { return }
         viewModel.deduplicationService.recordNostrEvent(event.id)
 
-        SecureLogger.debug(
-            "GeoTeleport: recv pub=\(event.pubkey.prefix(8))… tagCount=\(event.tags.count)",
-            category: .session
-        )
+        let tagSummary = event.tags.map { "[" + $0.joined(separator: ",") + "]" }.joined(separator: ",")
+        SecureLogger.debug("GeoTeleport: recv pub=\(event.pubkey.prefix(8))… tags=\(tagSummary)", category: .session)
 
         if viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey) {
             return

bitchat/ViewModels/MessageRateLimiter.swift

@@ -26,6 +26,10 @@ struct MessageRateLimiter {
             }
             return false
         }
+
+        func isIdle(since now: Date, idleTTL: TimeInterval) -> Bool {
+            now.timeIntervalSince(lastRefill) >= idleTTL
+        }
     }
 
     private var senderBuckets: [String: TokenBucket] = [:]
@@ -35,43 +39,93 @@ struct MessageRateLimiter {
     private let senderRefill: Double
     private let contentCapacity: Double
     private let contentRefill: Double
+    private let maxSenderBuckets: Int
+    private let maxContentBuckets: Int
+    private let bucketIdleTTL: TimeInterval
 
     init(
         senderCapacity: Double,
         senderRefillPerSec: Double,
         contentCapacity: Double,
-        contentRefillPerSec: Double
+        contentRefillPerSec: Double,
+        maxSenderBuckets: Int = TransportConfig.uiSenderRateBucketMaxEntries,
+        maxContentBuckets: Int = TransportConfig.uiContentRateBucketMaxEntries,
+        bucketIdleTTL: TimeInterval = TransportConfig.uiRateBucketIdleTTL
     ) {
         self.senderCapacity = senderCapacity
         self.senderRefill = senderRefillPerSec
         self.contentCapacity = contentCapacity
         self.contentRefill = contentRefillPerSec
+        self.maxSenderBuckets = max(1, maxSenderBuckets)
+        self.maxContentBuckets = max(1, maxContentBuckets)
+        self.bucketIdleTTL = bucketIdleTTL
     }
 
     mutating func allow(senderKey: String, contentKey: String, now: Date = Date()) -> Bool {
-        var senderBucket = senderBuckets[senderKey] ?? TokenBucket(
+        var senderBucket = bucket(
+            for: senderKey,
+            in: &senderBuckets,
             capacity: senderCapacity,
-            tokens: senderCapacity,
             refillPerSec: senderRefill,
-            lastRefill: now
+            maxBuckets: maxSenderBuckets,
+            now: now
         )
         let senderAllowed = senderBucket.allow(now: now)
         senderBuckets[senderKey] = senderBucket
+        guard senderAllowed else { return false }
 
-        var contentBucket = contentBuckets[contentKey] ?? TokenBucket(
+        var contentBucket = bucket(
+            for: contentKey,
+            in: &contentBuckets,
             capacity: contentCapacity,
-            tokens: contentCapacity,
             refillPerSec: contentRefill,
-            lastRefill: now
+            maxBuckets: maxContentBuckets,
+            now: now
         )
         let contentAllowed = contentBucket.allow(now: now)
         contentBuckets[contentKey] = contentBucket
 
-        return senderAllowed && contentAllowed
+        return contentAllowed
     }
 
     mutating func reset() {
         senderBuckets.removeAll()
         contentBuckets.removeAll()
     }
+
+    var bucketCountsForTesting: (sender: Int, content: Int) {
+        (senderBuckets.count, contentBuckets.count)
+    }
+
+    private mutating func bucket(
+        for key: String,
+        in buckets: inout [String: TokenBucket],
+        capacity: Double,
+        refillPerSec: Double,
+        maxBuckets: Int,
+        now: Date
+    ) -> TokenBucket {
+        if let bucket = buckets[key] {
+            return bucket
+        }
+
+        evictIfNeeded(from: &buckets, maxBuckets: maxBuckets, now: now)
+        return TokenBucket(
+            capacity: capacity,
+            tokens: capacity,
+            refillPerSec: refillPerSec,
+            lastRefill: now
+        )
+    }
+
+    private func evictIfNeeded(from buckets: inout [String: TokenBucket], maxBuckets: Int, now: Date) {
+        guard buckets.count >= maxBuckets else { return }
+
+        buckets = buckets.filter { !$0.value.isIdle(since: now, idleTTL: bucketIdleTTL) }
+        guard buckets.count >= maxBuckets else { return }
+
+        if let oldestKey = buckets.min(by: { $0.value.lastRefill < $1.value.lastRefill })?.key {
+            buckets.removeValue(forKey: oldestKey)
+        }
+    }
 }

bitchatTests/MessageRateLimiterTests.swift

@@ -0,0 +1,56 @@
+//
+// MessageRateLimiterTests.swift
+// bitchatTests
+//
+// Ensures public-message rate limiter state remains bounded for attacker-derived keys.
+//
+
+import Foundation
+import Testing
+@testable import bitchat
+
+struct MessageRateLimiterTests {
+    @Test("Content buckets do not grow when sender is rate limited")
+    func contentBucketsDoNotGrowAfterSenderLimit() {
+        var limiter = MessageRateLimiter(
+            senderCapacity: 1,
+            senderRefillPerSec: 0,
+            contentCapacity: 1,
+            contentRefillPerSec: 0,
+            maxSenderBuckets: 10,
+            maxContentBuckets: 10,
+            bucketIdleTTL: 60
+        )
+        let now = Date()
+
+        #expect(limiter.allow(senderKey: "sender", contentKey: "content-0", now: now))
+        for index in 1...100 {
+            #expect(!limiter.allow(senderKey: "sender", contentKey: "content-\(index)", now: now))
+        }
+
+        #expect(limiter.bucketCountsForTesting.sender == 1)
+        #expect(limiter.bucketCountsForTesting.content == 1)
+    }
+
+    @Test("Bucket maps evict entries at configured caps")
+    func bucketMapsEvictAtConfiguredCaps() {
+        let maxEntries = 3
+        var limiter = MessageRateLimiter(
+            senderCapacity: 1,
+            senderRefillPerSec: 0,
+            contentCapacity: 1,
+            contentRefillPerSec: 0,
+            maxSenderBuckets: maxEntries,
+            maxContentBuckets: maxEntries,
+            bucketIdleTTL: 60
+        )
+        let now = Date()
+
+        for index in 0..<25 {
+            #expect(limiter.allow(senderKey: "sender-\(index)", contentKey: "content-\(index)", now: now.addingTimeInterval(TimeInterval(index))))
+        }
+
+        #expect(limiter.bucketCountsForTesting.sender == maxEntries)
+        #expect(limiter.bucketCountsForTesting.content == maxEntries)
+    }
+}

bitchatTests/NostrProtocolTests.swift

@@ -241,51 +241,6 @@ struct NostrProtocolTests {
         #expect(!signed.isValidSignature())
     }
 
-    @Test func inboundNostrEventRejectsTooManyTags() throws {
-        var eventDict = Self.validInboundEventDict()
-        eventDict["tags"] = Array(
-            repeating: ["g", "u4pruyd"],
-            count: TransportConfig.nostrMaxEventTags + 1
-        )
-
-        #expect(throws: NostrError.invalidEvent) {
-            _ = try NostrEvent(from: eventDict)
-        }
-    }
-
-    @Test func inboundNostrEventRejectsTooManyTagValues() throws {
-        var eventDict = Self.validInboundEventDict()
-        eventDict["tags"] = [Array(
-            repeating: "value",
-            count: TransportConfig.nostrMaxEventTagValues + 1
-        )]
-
-        #expect(throws: NostrError.invalidEvent) {
-            _ = try NostrEvent(from: eventDict)
-        }
-    }
-
-    @Test func inboundNostrEventRejectsOversizedTagValues() throws {
-        var eventDict = Self.validInboundEventDict()
-        eventDict["tags"] = [[
-            "g",
-            String(repeating: "a", count: TransportConfig.nostrMaxEventTagValueBytes + 1)
-        ]]
-
-        #expect(throws: NostrError.invalidEvent) {
-            _ = try NostrEvent(from: eventDict)
-        }
-    }
-
-    @Test func inboundNostrEventAcceptsTagsWithinLimits() throws {
-        var eventDict = Self.validInboundEventDict()
-        eventDict["tags"] = [["g", "u4pruyd"], ["t", "teleport"]]
-
-        let event = try NostrEvent(from: eventDict)
-
-        #expect(event.tags.count == 2)
-    }
-
     @Test func geohashNotesSingleFilter_encodesExpectedTagShape() throws {
         let since = Date(timeIntervalSince1970: 1_234_567)
         let filter = NostrFilter.geohashNotes("u4pruyd", since: since, limit: 42)
@@ -299,18 +254,6 @@ struct NostrProtocolTests {
     }
 
     // MARK: - Helpers
-    private static func validInboundEventDict() -> [String: Any] {
-        [
-            "id": String(repeating: "0", count: 64),
-            "pubkey": String(repeating: "1", count: 64),
-            "created_at": 1_234_567,
-            "kind": NostrProtocol.EventKind.ephemeralEvent.rawValue,
-            "tags": [["g", "u4pruyd"]],
-            "content": "hello",
-            "sig": String(repeating: "2", count: 128)
-        ]
-    }
-
     private static func base64URLDecode(_ s: String) -> Data? {
         var str = s.replacingOccurrences(of: "-", with: "+").replacingOccurrences(of: "_", with: "/")
         let rem = str.count % 4