Fix Unrestricted Resource Consumption in Spiral

Spiral's high-performance worker model, powered by RoadRunner, is susceptible to resource exhaustion if you don't bound user input. Because workers are long-lived, a single unoptimized request that consumes excessive memory or CPU won't just slow down one hit—it can poison the worker or the entire pool. To mitigate Unrestricted Resource Consumption, we must move beyond basic PHP 'memory_limit' and implement strict input validation via Spiral Filters and RoadRunner-level constraints.

The Vulnerable Pattern

public function generateReport(Request $request): array
{
    // VULNERABLE: Trusting user-provided 'count' to allocate memory
    $count = $request->input('count');
    $data = [];
for ($i = 0; $i < $count; $i++) {
    $data[] = bin2hex(random_bytes(1024));
}

return ['status' => 'done', 'items' => count($data)];
}

The Secure Implementation

The fix involves three critical layers. First, we replace the raw 'Request' object with a 'Spiral Filter' (DTO) that performs schema-level validation before the controller logic even executes. This ensures 'count' is an integer and stays within a safe range (1-100), preventing an attacker from passing '99999999' to crash the worker. Second, we use the filter's validated data to perform the operation. Finally, for defense-in-depth, ensure your '.rr.yaml' configuration includes 'max_worker_memory' limits; this allows RoadRunner to automatically kill and restart any Spiral worker that leaks memory or exceeds its allocated footprint, ensuring the system remains self-healing.

public function generateReport(ReportFilter $filter): array
{
    // SECURE: Spiral Filter enforces 'count' is an integer between 1 and 100
    $count = $filter->count;
    $data = [];
for ($i = 0; $i < $count; $i++) {
    $data[] = bin2hex(random_bytes(1024));
}

return ['status' => 'done', 'items' => count($data)];
}
// ReportFilter.php definition
class ReportFilter extends Filter
{
protected const SCHEMA = [
‘count’ => ‘data:count’
];
protected const VALIDATES = [
    'count' => [
        ['notEmpty'],
        ['integer'],
        ['range', 1, 100] // Hard limit on resource allocation
    ]
];
}