You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
To protect against primitive DoS attacks, it should be possible to halt further validation on the first error. Cheap checks (e.g. length, range) should be performed first, and expensive checks (pattern, custom) last. There should be a priority system so that custom checks can be put first if the user know that they are cheap.
priority wraps a a rule and changes its priority level:
#[derive(Validate)]structTest{#[garde( length(min=10, max=100), priority( custom(cheap_check),100),)]value:String,}fncheap_check(_:&str,value:&str, _:&()) -> Result<(),Error>{// ... something cheaper than the `length` checkOk(())}
Rules should have a constant priority (e.g. range is cheap because it's O(1), contains is not because it is worst case O(N*M)). It should also be possible to designate some rules as having complexity that depends on their input, e.g. prefix priority will be based on the length of the value, and regex priority will be based on the complexity of the expression.
The text was updated successfully, but these errors were encountered:
To protect against primitive DoS attacks, it should be possible to halt further validation on the first error. Cheap checks (e.g.
length
,range
) should be performed first, and expensive checks (pattern
,custom
) last. There should be a priority system so thatcustom
checks can be put first if the user know that they are cheap.priority
wraps a a rule and changes its priority level:Rules should have a constant priority (e.g.
range
is cheap because it's O(1),contains
is not because it is worst caseO(N*M)
). It should also be possible to designate some rules as having complexity that depends on their input, e.g.prefix
priority will be based on the length of the value, andregex
priority will be based on the complexity of the expression.The text was updated successfully, but these errors were encountered: