RocketChat / RocketChat/Rocket.Chat
Endless loop in WebHook Script freezes Rocket.Chat instance
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
An Incoming WebHook Script with an endless loop can freeze the Rocket.Chat instance (at 100% CPU usage).
There is a timeout for running Script.process_incoming_request:
https://github.com/RocketChat/Rocket.Chat/blob/80ba8cfb0409f21d993930f795d537fc0b1871ee/app/integrations/server/api/api.js#L201-L214
but not for running the script itself:
https://github.com/RocketChat/Rocket.Chat/blob/80ba8cfb0409f21d993930f795d537fc0b1871ee/app/integrations/server/api/api.js#L70
Steps to reproduce:
- Add Incoming WebHook Script
while(true) {}
- Trigger the script
Expected behavior:
Script execution should be terminated after a timeout.
Actual behavior:
The Rocket.Chat instance freezes at 100% CPU usage.
Server Setup Information:
- Version of Rocket.Chat Server: 3.5.1
- Operating System: Win 10
- Deployment Method: docker
- NodeJS Version: 12.16.1 - x64
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in app/integrations/server/api/api.js at the script execution around line 70 and compare it with the existing timeout around lines 201-214. Reproduce the issue with an Incoming WebHook Script containing while(true) {}, then verify execution terminates after a timeout and the Rocket.Chat instance remains responsive.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100