perf: fix Dashboard cache stampede vulnerability #25

New issue

Open

opened 2026-02-20 03:02:23 +00:00 by Clotho · 0 comments

Clotho commented

2026-02-20 03:02:23 +00:00

Member

Issue

View/Modal/Admin/Dashboard.php::cacheWithLock() (lines 237-270) has race condition.

Current Behavior

When lock acquisition fails, method falls back to executing callback unprotected:

if ($lock->get()) {
    // Protected execution
}
return $callback();  // Unprotected fallback

Problem

Multiple simultaneous requests can execute expensive callback when lock fails, causing cache stampede.

Expected Behavior

Wait for lock with timeout
OR return stale data
OR queue computation

Acceptance Criteria

Implement proper lock waiting strategy
Add stale-while-revalidate pattern
Add tests for concurrent access
Document caching strategy

References

Security concern identified in codebase scan
Affects admin dashboard performance

## Issue `View/Modal/Admin/Dashboard.php::cacheWithLock()` (lines 237-270) has race condition. ## Current Behavior When lock acquisition fails, method falls back to executing callback unprotected: ```php if ($lock->get()) { // Protected execution } return $callback(); // Unprotected fallback ``` ## Problem Multiple simultaneous requests can execute expensive callback when lock fails, causing cache stampede. ## Expected Behavior - Wait for lock with timeout - OR return stale data - OR queue computation ## Acceptance Criteria - [ ] Implement proper lock waiting strategy - [ ] Add stale-while-revalidate pattern - [ ] Add tests for concurrent access - [ ] Document caching strategy ## References - Security concern identified in codebase scan - Affects admin dashboard performance