-
Notifications
You must be signed in to change notification settings - Fork 66
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Nested arrays can be used to crash node. #104
Comments
This was referenced Nov 14, 2017
This was referenced Nov 14, 2017
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
This may be the same as issue #28 but the parser will create a new array if the parameter looks like: foo[0]=bar. Taking that a step farther foo[0][100000000]=bar will create an array with an array of null objects at the first index of the object. Any time the server tries to perform an action on this object the process runs out of memory and crashes.
I'd suggest range checks be performed before the creation of the query string parameter object, or cap the size of the parameter object.
The text was updated successfully, but these errors were encountered: