CenterForDigitalHumanities / CenterForDigitalHumanities/rerum_server_nodejs

RERUM Can Be Attacked By Trees

Open
#254 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
JavaScript
Stars
3
Forks
6
Avg merge
1h 25m
Merged PRs (30d)
3

Description

`getAllVersions` loads unbounded data into memory. We were able to perform a successful History Tree Attack using an object that has 100 versions in history. Deeply versioned objects (1000+) can cause pm2 threads to run out of memory.

**Recommendation**: Add pagination to version queries. Limit default response to 100 versions with cursor-based pagination. This is how using /query for large data responses is handled by clients when they query for data. The technique can be used internally too.

Ensure the change is functional by testing it yourself and ensuring it solves the attack vector. Human developers can deploy the app and manually test the code you propose.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.