cloud-server/CODE_REVIEW_FIXES.md

Code Review Fixes Summary

Date: 2026-01-25 Project: cloud-instances-api Review Type: Comprehensive (QA, Security, Performance)

Overview

코드 리뷰를 통해 발견된 Critical, High, Medium 이슈들을 모두 수정했습니다.

Score Improvements

Category	Before	After	Change
QA	7/10	8/10	+1
Security	6/10	8/10	+2
Performance	7/10	8/10	+1

Issue Resolution

Priority	Found	Fixed	Skip
Critical	4	4	0
High	6	5	1
Medium	10	8	2

---

Critical Issues (4/4 Fixed)

1. Rate Limiter Triple KV Read

File: src/middleware/rateLimit.ts Fix: verification read 제거, 1 read/request로 최적화 Impact: 30-150ms → 30-50ms (66% 개선)

2. BATCH_SIZE Unbounded

File: src/services/sync.ts (6곳) Fix: Math.min(Math.max(parseInt(...) || 500, 1), 1000) 범위 제한 Impact: DoS 방지

3. sortOrder SQL Injection

File: src/services/query.ts Fix: whitelist 검증 추가 (validatedSortOrder) Impact: SQL Injection 방지

4. Health Check N+1 Subquery

File: src/routes/health.ts Fix: correlated subquery → efficient JOIN Impact: N+1 쿼리 제거

---

High Priority Issues (5/6 Fixed)

1. Timing Attack in verifyApiKey ✅

File: src/middleware/auth.ts Fix: 고정 256바이트 버퍼 사용, 길이 정보 노출 방지

2. Rate Limiting Bypass (non-CF) ✅

File: src/middleware/rateLimit.ts Fix: 'non-cloudflare-traffic' 고정 식별자 (fail-closed)

3. Error Message Information Disclosure ✅

Files: src/routes/instances.ts, sync.ts, recommend.ts Fix: 내부 에러 숨김, request_id 추가

4. Singleton Stale DB Reference ✅

File: src/routes/instances.ts Fix: cachedDb !== db 체크로 rolling deploy 대응

5. COUNT(*) Cartesian Product ✅

File: src/services/query.ts Fix: COUNT(DISTINCT it.id) 사용

6. Rate Limit TOCTOU ⏭️

Status: Skip (설계상 허용, 문서화됨)

---

Medium Priority Issues (8/10 Fixed)

1. Pagination Negative Page ✅

File: src/services/query.ts Fix: Math.max(page, 1), Math.max(limit, 1)

2. min/max Range Validation ✅

File: src/routes/instances.ts Fix: vcpu, memory 범위 일관성 검증

3. Logger Sensitive Keys ✅

File: src/utils/logger.ts Fix: 8개 → 18개 패턴 확장

4. Request ID / Audit Trail ✅

File: src/index.ts Fix: CF-Ray 또는 UUID, X-Request-ID 헤더

5. CORS Expose-Headers ✅

File: src/index.ts Fix: Rate limit + Request ID 헤더 노출

6. Sync Batch Size ✅

File: src/services/sync.ts (7곳) Fix: 100 → 500 (batch 수 80% 감소)

7. Anvil Pricing IN Query ✅

File: src/services/sync.ts Fix: Cartesian → paired OR, 100개 batch

8. Logger Instance Duplication ✅

File: src/repositories/base.ts + 14개 subclass Fix: static 캐시 패턴으로 공유

9. QueryService Tests ⏭️

Status: Skip (대규모 작업, 별도 진행)

10. Price History Triggers ⏭️

Status: Skip (스키마 변경, 별도 검토)

---

Additional Fixes (Round 2)

High Priority

Issue	File	Fix
Sync ID Math.random()	src/routes/sync.ts	crypto.randomUUID()
Missing Timeout	src/services/sync.ts	withTimeout() 10-60초
/sync Body Size	src/routes/sync.ts	10KB content-length 제한

Medium Priority

Issue	File	Fix
Stack Trace Exposure	src/services/sync.ts	error_details에서 stack 제거
Log Injection	src/index.ts	origin sanitization
Unsafe Type Casting	src/services/sync.ts	타입 검증 로직
CacheService Singleton	src/routes/recommend.ts	singleton 패턴
Page Upper Bound	src/services/query.ts	MAX_OFFSET = 100000
Hardcoded Providers	src/services/sync.ts	SUPPORTED_PROVIDERS 상수
Large OR Clause	src/services/sync.ts	100개 batch 처리
Missing Index	schema.sql	idx_instance_types_specs_filter

---

Removed Components

Vault Integration

Vault 연동 코드 완전 제거 (API 키는 Wrangler secrets 사용)

Deleted Files:

• src/connectors/vault.ts
• src/connectors/vault.test.ts
• tests/vault.test.ts
• src/connectors/README.md
• src/connectors/linode.README.md

---

Configuration Changes

wrangler.toml

# 6시간 pricing cron 제거
[triggers]
crons = ["0 0 * * *"]  # Daily sync only

schema.sql

-- 추가된 인덱스
CREATE INDEX IF NOT EXISTS idx_instance_types_specs_filter
ON instance_types(provider_id, memory_mb, vcpu);

---

Security Improvements Summary

1. Authentication: SHA-256 constant-time 비교, 256바이트 고정 버퍼
2. SQL Injection: Parameterized queries, whitelist 검증
3. Rate Limiting: Fail-closed for non-CF traffic
4. Information Disclosure: Stack trace 제거, request_id 추가
5. Input Validation: Content-length, page bounds, range consistency
6. Logging: Sensitive data masking (18 patterns), log injection 방지
7. CORS: Explicit origins, expose headers
8. Timeout: External API 호출 타임아웃 (10-60초)

---

Performance Improvements Summary

1. Rate Limiter: KV reads 66% 감소
2. Batch Size: 100 → 500 (batch 수 80% 감소)
3. Health Query: N+1 → single JOIN
4. COUNT Query: Cartesian → DISTINCT
5. Logger: 공유 캐시 패턴
6. CacheService: Singleton 패턴
7. Composite Index: Recommendation 쿼리 최적화

---

Remaining Items

Item	Priority	Reason
QueryService Tests	Medium	대규모 테스트 작성 필요
Price History Triggers	Low	스키마 변경, 성능 영향 분석
Rate Limit TOCTOU	Info	설계상 의도된 eventual consistency

---

Files Modified (44 files)

Core

• src/index.ts
• src/types.ts
• src/constants.ts
• wrangler.toml
• schema.sql

Middleware

• src/middleware/auth.ts
• src/middleware/auth.test.ts
• src/middleware/rateLimit.ts
• src/middleware/rateLimit.test.ts

Services

• src/services/sync.ts
• src/services/query.ts
• src/services/recommendation.ts
• src/services/recommendation.test.ts
• src/services/cache.ts

Routes

• src/routes/health.ts
• src/routes/instances.ts
• src/routes/sync.ts
• src/routes/recommend.ts

Repositories (15 files)

• src/repositories/base.ts
• src/repositories/providers.ts
• src/repositories/regions.ts
• src/repositories/instances.ts
• src/repositories/pricing.ts
• src/repositories/gpu-instances.ts
• src/repositories/gpu-pricing.ts
• src/repositories/g8-instances.ts
• src/repositories/g8-pricing.ts
• src/repositories/vpu-instances.ts
• src/repositories/vpu-pricing.ts
• src/repositories/anvil-instances.ts
• src/repositories/anvil-pricing.ts
• src/repositories/anvil-regions.ts
• src/repositories/anvil-transfer-pricing.ts

Connectors

• src/connectors/base.ts
• src/connectors/linode.ts
• src/connectors/vultr.ts
• src/connectors/aws.ts

Utils

• src/utils/logger.ts
• src/utils/logger.test.ts

Deleted

• src/connectors/vault.ts
• src/connectors/vault.test.ts
• tests/vault.test.ts
• src/connectors/README.md
• src/connectors/linode.README.md