Protect readLine() against DoS
#4
Conversation
| <type>pom</type> | ||
| <scope>test</scope> | ||
| </dependency> | ||
| <dependency> |
There was a problem hiding this comment.
This library holds security tools for protecting Java API calls.
License: MIT ✅ | Open source ✅ | More facts
| </pluginManagement> | ||
| </build> | ||
| </profile> | ||
| </profiles> |
There was a problem hiding this comment.
This library holds security tools for protecting Java API calls.
License: MIT ✅ | Open source ✅ | More facts
| <artifactId>xwiki-platform-index-api</artifactId> | ||
| <version>${project.version}</version> | ||
| </dependency> | ||
| <dependency> |
There was a problem hiding this comment.
This library holds security tools for protecting Java API calls.
License: MIT ✅ | Open source ✅ | More facts
| <dependency> | ||
| <groupId>io.github.pixee</groupId> | ||
| <artifactId>java-security-toolkit</artifactId> | ||
|
|
There was a problem hiding this comment.
This library holds security tools for protecting Java API calls.
License: MIT ✅ | Open source ✅ | More facts
| <artifactId>xwiki-platform-lesscss-api</artifactId> | ||
| <version>${project.version}</version> | ||
| </dependency> | ||
| <dependency> |
There was a problem hiding this comment.
This library holds security tools for protecting Java API calls.
License: MIT ✅ | Open source ✅ | More facts
| </modules> | ||
| </profile> | ||
| </profiles> | ||
| <dependencyManagement> |
There was a problem hiding this comment.
This library holds security tools for protecting Java API calls.
License: MIT ✅ | Open source ✅ | More facts
This change hardens all
BufferedReader#readLine()operations against memory exhaustion.There is no way to call
readLine()safely since it is, by its nature, a read that must be terminated by the stream provider. Furthermore, a stream of data provided by an untrusted source could lead to a denial of service attack, as attackers can provide an infinite stream of bytes until the process runs out of memory.Fixing it is straightforward using an API which limits the amount of expected characters to some sane limit. This is what our changes look like:
More reading
I have additional improvements ready for this repo! If you want to see them, leave the comment:
... and I will open a new PR right away!
🧚🤖 Powered by Pixeebot
Feedback | Community | Docs | Codemod ID: pixee:java/limit-readline