Title: Protect `readLine()` against DoS by pixeebot[bot] · Pull Request #27 · Pixee-Bot-Java/flow · GitHub
Open Graph Title: Protect `readLine()` against DoS by pixeebot[bot] · Pull Request #27 · Pixee-Bot-Java/flow
X Title: Protect `readLine()` against DoS by pixeebot[bot] · Pull Request #27 · Pixee-Bot-Java/flow
Description: This change hardens all BufferedReader#readLine() operations against memory exhaustion. There is no way to call readLine() safely since it is, by its nature, a read that must be terminated by the stream provider. Furthermore, a stream of data provided by an untrusted source could lead to a denial of service attack, as attackers can provide an infinite stream of bytes until the process runs out of memory. Fixing it is straightforward using an API which limits the amount of expected characters to some sane limit. This is what our changes look like: + import io.github.pixee.security.BoundedLineReader; ... BufferedReader reader = getReader(); - String line = reader.readLine(); // unlimited read, can lead to DoS + String line = BoundedLineReader.readLine(reader, 5_000_000); // limited to 5MB More reading https://vulncat.fortify.com/en/detail?id=desc.dataflow.abap.denial_of_service https://cwe.mitre.org/data/definitions/400.html I have additional improvements ready for this repo! If you want to see them, leave the comment: @pixeebot next ... and I will open a new PR right away! 🧚🤖 Powered by Pixeebot Feedback | Community | Docs | Codemod ID: pixee:java/limit-readline
Open Graph Description: This change hardens all BufferedReader#readLine() operations against memory exhaustion. There is no way to call readLine() safely since it is, by its nature, a read that must be terminated by the s...
X Description: This change hardens all BufferedReader#readLine() operations against memory exhaustion. There is no way to call readLine() safely since it is, by its nature, a read that must be terminated by the s...
Opengraph URL: https://github.com/Pixee-Bot-Java/flow/pull/27
X: @github
Domain: patch-diff.githubusercontent.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:b7d85986-fea9-6504-aae4-1523470ddfe4 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | AA92:1DEB:6BD924:89E82C:69906E32 |
| html-safe-nonce | 12efb7c3dc0d26af5b8b898084b7539fb6bea4112fda2c9231bcf038333313fb |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJBQTkyOjFERUI6NkJEOTI0Ojg5RTgyQzo2OTkwNkUzMiIsInZpc2l0b3JfaWQiOiIxOTMyODk3OTU2ODU3NDA5MDc0IiwicmVnaW9uX2VkZ2UiOiJpYWQiLCJyZWdpb25fcmVuZGVyIjoiaWFkIn0= |
| visitor-hmac | 0b8dff223dd16181bc4e29fa7595a4d2ffc9b25cc0dca592fd86fd0ea2a53d2c |
| hovercard-subject-tag | pull_request:2477798370 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/Pixee-Bot-Java/flow/pull/27/files |
| twitter:image | https://avatars.githubusercontent.com/in/193111?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/in/193111?s=400&v=4 |
| og:image:alt | This change hardens all BufferedReader#readLine() operations against memory exhaustion. There is no way to call readLine() safely since it is, by its nature, a read that must be terminated by the s... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 42c603b9d642c4a9065a51770f75e5e27132fef0e858607f5c9cb7e422831a7b |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/Pixee-Bot-Java/flow git https://github.com/Pixee-Bot-Java/flow.git |
| octolytics-dimension-user_id | 143516492 |
| octolytics-dimension-user_login | Pixee-Bot-Java |
| octolytics-dimension-repository_id | 795756272 |
| octolytics-dimension-repository_nwo | Pixee-Bot-Java/flow |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | true |
| octolytics-dimension-repository_parent_id | 34809191 |
| octolytics-dimension-repository_parent_nwo | vaadin/flow |
| octolytics-dimension-repository_network_root_id | 34809191 |
| octolytics-dimension-repository_network_root_nwo | vaadin/flow |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 3b33c5aedc9808f45bc5fcf0b1e4404cf749dac7 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width