[GH-ISSUE #712] server/topic.Subscribe can produce duplicate subscriber IDs #521

New issue

Closed

opened 2026-05-07 00:25:02 +02:00 by BreizhHardware · 5 comments

BreizhHardware commented

2026-05-07 00:25:02 +02:00

Owner

Originally created by @peterbourgon on GitHub (May 1, 2023).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/712

github.com/binwiederhier/ntfy@6ad3b2e802/server/topic.go (L50)

// Subscribe subscribes to this topic
func (t *topic) Subscribe(s subscriber, userID string, cancel func()) int {
	t.mu.Lock()
	defer t.mu.Unlock()
	subscriberID := rand.Int() // <---- here
	t.subscribers[subscriberID] = &topicSubscriber{
		userID:     userID, // May be empty
		subscriber: s,
		cancel:     cancel,
	}
	t.lastAccess = time.Now()
	return subscriberID
}

Nothing prevents subscriberID := rand.Int() from producing an integer which is already present in the t.subscribers map. In that case, the previous subscriber is over-written.

Originally created by @peterbourgon on GitHub (May 1, 2023). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/712 https://github.com/binwiederhier/ntfy/blob/6ad3b2e8020082a5b7206d36d425f925354cd059/server/topic.go#L50 ```go // Subscribe subscribes to this topic func (t *topic) Subscribe(s subscriber, userID string, cancel func()) int { t.mu.Lock() defer t.mu.Unlock() subscriberID := rand.Int() // <---- here t.subscribers[subscriberID] = &topicSubscriber{ userID: userID, // May be empty subscriber: s, cancel: cancel, } t.lastAccess = time.Now() return subscriberID } ``` Nothing prevents `subscriberID := rand.Int()` from producing an integer which is already present in the `t.subscribers` map. In that case, the previous subscriber is over-written.

BreizhHardware

2026-05-07 00:25:02 +02:00

closed this issue
added the
🪲 bug
label

BreizhHardware commented

2026-05-07 00:25:03 +02:00

Author

Owner

@dropdevrahul commented on GitHub (May 2, 2023):

can I pick this up?

@dropdevrahul commented on GitHub (May 2, 2023): can I pick this up?

BreizhHardware commented

2026-05-07 00:25:03 +02:00

Author

Owner

@binwiederhier commented on GitHub (May 2, 2023):

Sure thing

@binwiederhier commented on GitHub (May 2, 2023): Sure thing

BreizhHardware commented

2026-05-07 00:25:03 +02:00

Author

Owner

@dropdevrahul commented on GitHub (May 2, 2023):

@binwiederhier tried a fix with https://github.com/binwiederhier/ntfy/pull/713

@dropdevrahul commented on GitHub (May 2, 2023): @binwiederhier tried a fix with https://github.com/binwiederhier/ntfy/pull/713

BreizhHardware commented

2026-05-07 00:25:04 +02:00

Author

Owner

@dropdevrahul commented on GitHub (May 2, 2023):

Please note Just added a simple retry mechanism and added a test case to catch the edge case

@dropdevrahul commented on GitHub (May 2, 2023): Please note Just added a simple retry mechanism and added a test case to catch the edge case

BreizhHardware commented

2026-05-07 00:25:04 +02:00

Author

Owner

@binwiederhier commented on GitHub (May 2, 2023):

Thanks to you both. The best effort retry should be enough.

@binwiederhier commented on GitHub (May 2, 2023): Thanks to you both. The best effort retry should be enough.