Skip to content

No Expiry Cleanup for Stale OAuth State Entries (Memory Leak) #95

Description

@andrewmusselman

Issue: FINDING-276 - No Expiry Cleanup for Stale OAuth State Entries (Memory Leak)

Labels: bug, security, priority:low, asvs-level:L2

ASVS Level(s): L2

Description:

Summary

Expired state entries are only cleaned up when specifically looked up during a callback. If a user initiates an OAuth flow but never completes the callback, the state entry remains in the dictionary indefinitely until process restart, causing gradual memory growth. With ~200 bytes per entry, 1000 abandoned flows would leak ~200 KB. This is a resource leak rather than a security vulnerability, but could impact long-running processes in high-traffic scenarios.

Details

In src/asfquart/generics.py at line 40 and lines 87-93, expired state entries are only cleaned up on lookup, not proactively.

Recommended Remediation

Implement periodic cleanup mechanism.

Option 1: Add async background task that runs every 5 minutes to clean expired states:

async def _cleanup_expired_states():
    current_time = time.time()
    expired = [s for s, d in pending_states.items() if d['timestamp'] < (current_time - workflow_timeout)]
    for state in expired:
        pending_states.pop(state, None)

Option 2: Probabilistic cleanup on each request (e.g., 10% of requests trigger cleanup).

Option 3: Migrate to Redis with automatic TTL-based expiry.

Acceptance Criteria

  • Periodic cleanup mechanism implemented
  • Memory leak eliminated
  • Long-running processes maintain stable memory usage
  • Unit tests verify cleanup logic

References

  • Source reports: L2:10.4.7.md
  • Related findings: FINDING-272
  • ASVS sections: 10.4.7

Priority

Low

Metadata

Metadata

Assignees

No one assigned

    Labels

    ASVSASVS LLM driven audit

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions