Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Handling DoS loops or max time processing #250

Closed
amit777 opened this issue Sep 30, 2020 · 7 comments
Closed

Handling DoS loops or max time processing #250

amit777 opened this issue Sep 30, 2020 · 7 comments
Labels
discuss needed question vulnerability

Comments

@amit777
Copy link
Contributor

amit777 commented Sep 30, 2020

Are there any recommended best practices or ways to put limits on the number of cycles the render function can take? For example, if a malicious user adds nested for loops with very large max lengths, how do you prevent this from taking up the entire CPU?

I've been searching around and haven't found any questions related to this, so I feel like I'm probably missing something obvious.
@harttle
Copy link
Owner

harttle commented Oct 2, 2020

Not available currently. But I think it's OK to have this feature, are there any other libs implementing this, for reference?

@amit777
Copy link
Contributor Author

amit777 commented Oct 2, 2020

I think I have a solution using a slightly patched paralleljs which uses webworkers. I will post the example here as soon as my patch is merged. But it's potentially pretty simple.

@amit777
Copy link
Contributor Author

amit777 commented Oct 6, 2020 •
edited by harttle
Loading

paralleljs v1.1.0 has my pull request merged in. You can pass opts.timeout to the Paralleljs's spawn method and call Liquidjs's render function within it.

@harttle
Copy link
Owner

harttle commented Feb 12, 2021

I guess limiting the processing time is better handled by external libraries. Closing this issue.

@harttle harttle closed this as completed Feb 12, 2021
@denis-isaev
Copy link

If this library doesn't have limits as the Shopify version does, then why is it called safe?

@harttle
Copy link
Owner

harttle commented Jan 5, 2024

I thought Shopify doesn't have a limit on this. Will investigate whether we can do the same.

@harttle harttle reopened this Jan 5, 2024
harttle added a commit that referenced this issue Jul 9, 2024
@harttle
feat: DoS prevention, #250
9e80cd7
harttle added a commit that referenced this issue Jul 9, 2024
@harttle
feat: DoS prevention, #250
858c0a3
harttle added a commit that referenced this issue Jul 9, 2024
@harttle
feat: DoS prevention, #250
4395697
harttle added a commit that referenced this issue Jul 9, 2024
@harttle
feat: DoS prevention, #250
e443068
github-actions bot pushed a commit that referenced this issue Jul 9, 2024
@semantic-release-bot
chore(release): 10.15.0 [skip ci]
542a75f 
# [10.15.0](v10.14.0...v10.15.0) (2024-07-09)

### Bug Fixes

* report error for malformed else/elsif/endif/endfor, [#713](#713) ([22b5a12](22b5a12))

### Features

* DoS prevention, [#250](#250) ([e443068](e443068))
* support in-memory template mapping, inspired by [@jg-rp](https://github.com/jg-rp) [#714](#714) ([df27ac6](df27ac6))
@harttle
Copy link
Owner

harttle commented Jul 9, 2024

Added DoS related support: https://liquidjs.com/tutorials/dos.html

@harttle harttle closed this as completed Jul 9, 2024
@snyk-io snyk-io bot mentioned this issue Aug 13, 2024
Open
@AKJUS AKJUS mentioned this issue Sep 13, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
discuss needed question vulnerability
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@denis-isaev @amit777 @harttle