Fix Unrestricted Resource Consumption in Symfony
Unrestricted resource consumption in Symfony applications often manifests as a Denial of Service (DoS) vulnerability. Attackers exploit endpoints that perform heavy CPU, memory, or disk I/O operations—such as image processing, PDF generation, or complex database queries—by flooding them with requests. Without rate limiting or strict input validation, a single malicious actor can exhaust the PHP-FPM pool or server memory, taking the entire service offline.
The Vulnerable Pattern
use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\Routing\Annotation\Route;class ExportController { #[Route(‘/export/orders’, methods: [‘POST’])] public function export(Request $request): Response { // VULNERABILITY: No limit on the ‘days’ parameter or request frequency. // An attacker can pass days=999999 to trigger a massive memory-intensive DB query. $days = $request->request->get(‘days’); $orders = $this->repository->findAllOrdersFromLastDays($days);
$csvData = $this->serializer->serialize($orders, 'csv'); return new Response($csvData, 200, ['Content-Type' => 'text/csv']); }
}
The Secure Implementation
To mitigate resource exhaustion, the solution implements two critical layers of defense. First, it integrates the Symfony Rate Limiter component to restrict the number of times an IP address can hit the expensive endpoint within a specific window. Second, it enforces strict input validation (Quotas) on the 'days' parameter, preventing attackers from requesting massive datasets that would lead to memory exhaustion. For extremely heavy tasks, the researcher recommendation is to offload the work to a background worker using Symfony Messenger instead of processing it synchronously within the request lifecycle.
use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpKernel\Exception\TooManyRequestsHttpException; use Symfony\Component\RateLimiter\RateLimiterFactory; use Symfony\Component\Routing\Annotation\Route;class ExportController { #[Route(‘/export/orders’, methods: [‘POST’])] public function export(Request $request, RateLimiterFactory $anonymousApiLimiter): Response { // 1. Implement Rate Limiting $limiter = $anonymousApiLimiter->create($request->getClientIp()); if (false === $limiter->consume(1)->isAccepted()) { throw new TooManyRequestsHttpException(); }
// 2. Enforce strict input constraints $days = (int) $request->request->get('days', 1); if ($days <= 0 || $days > 30) { return new Response('Invalid range. Max 30 days.', 400); } $orders = $this->repository->findAllOrdersFromLastDays($days); // ... logic }
}
Your Symfony API
might be exposed to Unrestricted Resource Consumption
74% of Symfony apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.