redhat-developer / redhat-developer/yaml-language-server
Add Diagnostic for "Billion Laughs"
Open
Nobody has claimed this yet.
enhancement
- Dominant language
- TypeScript
- Stars
- 1.5k
- Forks
- 352
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 11
Description
Is your enhancement related to a problem? Please describe.
We have fix for "Billion Laughs" attack, but we do not show that LS face that problem.
Describe the solution you would like
Error/Warning Diagnostic on "Billion Laughs" ref nodes.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing pull request #464, which contains the existing Billion Laughs fix, and trace how ref nodes are handled in the language server. Add an error or warning diagnostic for the affected ref nodes, then verify that Billion Laughs references are reported without changing the existing protection.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- devtools, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100