{"action":"opened","issue":{"url":"https://api.github.com/repos/ctrl-alt-dev/harbinger/issues/2","repository_url":"https://api.github.com/repos/ctrl-alt-dev/harbinger","labels_url":"https://api.github.com/repos/ctrl-alt-dev/harbinger/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/ctrl-alt-dev/harbinger/issues/2/comments","events_url":"https://api.github.com/repos/ctrl-alt-dev/harbinger/issues/2/events","html_url":"https://github.com/ctrl-alt-dev/harbinger/issues/2","id":191518063,"number":2,"title":"Blacklisting: stuck in loop","user":{"login":"Braffdev","id":15154304,"avatar_url":"https://avatars.githubusercontent.com/u/15154304?v=3","gravatar_id":"","url":"https://api.github.com/users/Braffdev","html_url":"https://github.com/Braffdev","followers_url":"https://api.github.com/users/Braffdev/followers","following_url":"https://api.github.com/users/Braffdev/following{/other_user}","gists_url":"https://api.github.com/users/Braffdev/gists{/gist_id}","starred_url":"https://api.github.com/users/Braffdev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Braffdev/subscriptions","organizations_url":"https://api.github.com/users/Braffdev/orgs","repos_url":"https://api.github.com/users/Braffdev/repos","events_url":"https://api.github.com/users/Braffdev/events{/privacy}","received_events_url":"https://api.github.com/users/Braffdev/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-11-24T13:17:31Z","updated_at":"2016-11-24T13:17:31Z","closed_at":null,"body":"It seems like I encountered a bug in the blacklisting mechanism. Imagine the following:\r\n\r\nA user performs several malicious activities that are totaled up by the `EvidenceCollector`. As soon as the score exceeds the IP-threshold, the user's IP is blacklisted for the configured amount of time. \r\nAfter the blacklisting has expired, the user can access the application again. However, the collected and aggregated evidence is still stored by the `EvidenceCollector`. Upon the next request (doesn't matter if malicious or not) the aggregated evidence is checked and the user is blacklisted again because the score has not been cleared and is still exceeding the IP-threshold.\r\n\r\nIs this a bug or something I got wrong?\r\n\r\nI implemented a small Bugfix that clears the evidence from the `EvidenceCollector` as soon as a `BlacklistIpAction` is performed. Now the blacklisting mechanism works fine. "}}
{"actor":{"display_login":"Braffdev"}}