Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

import_batch execution leak vulnerability #210

Open
developersteve opened this issue Feb 15, 2023 · 0 comments
Open

import_batch execution leak vulnerability #210

developersteve opened this issue Feb 15, 2023 · 0 comments

Comments

@developersteve
Copy link

There is an execution leak issue associated with the import_batch function, this seems to have been a reported issue for a few years and does indeed seem to exist.

It can be replicated with the following script and is detected when an initial invocation has not completed when a new invocation is triggered.

var Mixpanel = require('mixpanel');

exports.handler = async (event, context) => {
    context.callbackWaitsForEmptyEventLoop = false;
    
    // import an old event
    var mixpanel_importer = Mixpanel.init(token', {
        secret: "secret"
    });
    mixpanel_importer.set_config({ debug: true });
    
    
    // import multiple events at once
    mixpanel_importer.import_batch([
        {
            event: 'old event',
            properties: {
                time: new Date(2012, 4, 20, 12, 34, 56),
                distinct_id: 'billybob',
                gender: 'male'
            }
        },
        {
            event: 'another old event',
            properties: {
                time: new Date(2012, 4, 21, 11, 33, 55),
                distinct_id: 'billybob',
                color: 'red'
            }
        }
    ]);
    
};
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant