security: scope this PR to the per-analyzer DoS caps; drop the rate-limit write-race fix (superseded by #549)

The Cache-API await fix here (GHSA-v7qc-7qh8-h69g) is only a partial mitigation; #549 fully supersedes it with an atomic Durable Object rate limiter and deletes the checkRateLimitCache path this touched. Revert the rate-limit.ts change, the rateLimitMiddleware hunk in index.ts, and the f30 test so this PR scopes cleanly to the per-analyzer caps that nothing else duplicates: DKIM selector count/length (GHSA-6fqp-4vhc-59mf) and MTA-STS policy body size (GHSA-p676-gc7j-96mx). Avoids a same-line conflict with #549's middleware rewrite.

Signed-off-by: schmug <38227427+schmug@users.noreply.github.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: schmug

src/index.ts

@@ -409,9 +409,10 @@ type RateLimitBlockedResponder = (
 export function rateLimitMiddleware(onBlocked: RateLimitBlockedResponder) {
   return async (c: Context, next: () => Promise<void>) => {
     const { identity, config } = await resolveRateLimitScope(c);
-    // checkRateLimit now awaits the counter write internally (GHSA-v7qc-7qh8-h69g),
-    // so there is no deferred write to hand to waitUntil here.
     const result = await checkRateLimit(identity, config);
+    if (result.pendingWrite) {
+      c.executionCtx.waitUntil(result.pendingWrite.catch(() => {}));
+    }
 
     const headers = rateLimitHeaders(result);
 

src/rate-limit.ts

@@ -9,6 +9,7 @@ export interface RateLimitResult {
   limit: number;
   windowSec: number;
   resetAt: number;
+  pendingWrite?: Promise<void>;
 }
 
 export type PlanTier = "free" | "pro";
@@ -100,23 +101,18 @@ async function checkRateLimitCache(
       "Cache-Control": `s-maxage=${ttl}`,
     },
   });
-  // SECURITY (GHSA-v7qc-7qh8-h69g): await the counter write before returning.
-  // Deferring it via executionCtx.waitUntil() (a prior perf optimization)
-  // widened the read-modify-write race: a sequential burst from one identity in
-  // the same isolate could each read a stale count before any write landed,
-  // bypassing the limit. Awaiting closes that intra-isolate window. NOTE: the
-  // Cache API offers no atomic increment/CAS, so a cross-isolate/cross-colo race
-  // remains; fully closing it needs a Durable Object or the native Rate Limiting
-  // binding (tracked in the advisory). The small write latency is the accepted
-  // cost of a correctly-incrementing counter.
-  await cache.put(key, response);
+  // ⚡ Bolt Optimization: Do not await cache.put on the critical path.
+  // Return the promise so the caller can pass it to executionCtx.waitUntil(),
+  // removing Cache API write latency from every rate-limited request.
+  const pendingWrite = cache.put(key, response);
 
   return {
     allowed,
     remaining,
     limit: config.limit,
     windowSec: config.windowSec,
     resetAt,
+    pendingWrite,
   };
 }
 

test/rate-limit.test.ts

@@ -232,51 +232,4 @@ describe("rate-limit", () => {
       expect(headers["X-RateLimit-Remaining"]).toBe("0");
     });
   });
-
-  // f30 / GHSA-v7qc-7qh8-h69g — the Cache-API counter write must be awaited
-  // before the result is returned, not deferred via executionCtx.waitUntil().
-  // Deferring it (the prior "Bolt" optimization) widened the read-modify-write
-  // race so a sequential burst within one isolate could read a stale count.
-  // Awaiting the put closes the intra-isolate window. (Cross-isolate atomicity
-  // is a fundamental Cache-API limitation and a separate, larger fix.)
-  describe("Cache API path — counter write durability (f30)", () => {
-    let store: Map<string, string>;
-    let putResolved: boolean;
-    let putCalls: number;
-
-    beforeEach(() => {
-      store = new Map();
-      putResolved = false;
-      putCalls = 0;
-      const mockCache = {
-        match: async (key: Request) => {
-          const val = store.get(key.url);
-          return val === undefined ? undefined : new Response(val);
-        },
-        put: async (key: Request, resp: Response) => {
-          putCalls++;
-          await Promise.resolve(); // simulate async write latency
-          store.set(key.url, await resp.text());
-          putResolved = true;
-        },
-      };
-      vi.stubGlobal("caches", { default: mockCache });
-    });
-
-    it("awaits the cache write before returning (no deferred pendingWrite)", async () => {
-      const result = await checkRateLimit("ip:9.9.9.9", FREE);
-      expect(putCalls).toBe(1);
-      // If the write were deferred (handed back for waitUntil instead of
-      // awaited), putResolved would still be false at this point.
-      expect(putResolved).toBe(true);
-      expect(result.allowed).toBe(true);
-      expect(result.remaining).toBe(FREE.limit - 1);
-    });
-
-    it("persists the incremented count for the next sequential request", async () => {
-      await checkRateLimit("ip:9.9.9.9", FREE);
-      const second = await checkRateLimit("ip:9.9.9.9", FREE);
-      expect(second.remaining).toBe(FREE.limit - 2);
-    });
-  });
 });