Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace recursion in TokenBuffer.copyCurrentStructure() with iteration #2398

Closed
cowtowncoder opened this issue Aug 2, 2019 · 0 comments
Closed
Milestone

Comments

@cowtowncoder
Copy link
Member

Implementation of method copyCurrentStructure in TokenBuffer is reasonable for most content, but possibly problematic for deeply nested structures, and especially for intentionally crafted content for possible DoS.

It would be good to address this concern either by converting current recursion-based implementation with iteration and simple stack (since amount of state is trivial relative to stack frames needed for method calls), or by adding suitable nesting limit.

Note that one possible concern for max-depth approach is that value to needs to be relatively high to cover legit use cases; and although it'd be possible to expose max value as configuration it would not be a good fit for any existing limits.
And in fact it would be better to address such limits as part of more general input-content complexity limitation (similar to how Woodstox/Stax has a nice set of maximum limits for lengths of various things, attribute counts, nesting); so for just this purpose it is probably better to try to avoid needing such limits.

@cowtowncoder cowtowncoder added this to the 2.10.0.pr2 milestone Aug 25, 2019
@cowtowncoder cowtowncoder changed the title Replace recursion in TokenBuffer.copyCurrentStructure() with iteration (or add limits) Replace recursion in TokenBuffer.copyCurrentStructure() with iteration Aug 25, 2019
cowtowncoder added a commit that referenced this issue Sep 4, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant