Introduced protections against DoS via unterminated read operations

[pixeebot[bot]]

This change hardens all BufferedReader#readLine() operations against attack.

There is no way to call readLine() safely since it is, by its nature, a read that must be terminated by the stream provider. A stream influenced by an attacker could keep providing bytes until the JVM runs out of memory.

Fixing it is straightforward using an API which limits the amount of expected characters to some sane limit. This is what our changes look like:

+ import io.github.pixee.security.BoundedLineReader;
  ...
  BufferedReader reader = getReader();
- String line = reader.readLine(); // unlimited read, can lead to DoS
+ String line = BoundedLineReader.readLine(reader, 5_000_000); // limited to 5MB

More reading

• https://vulncat.fortify.com/en/detail?id=desc.dataflow.abap.denial_of_service
• https://cwe.mitre.org/data/definitions/400.html

I have additional improvements ready for this repo! If you want to see them, leave the comment:

@pixeebot next

... and I will open a new PR right away!

Powered by: pixeebot (codemod ID: pixee:java/limit-readline)

[pixeebot[bot]]

I'm confident in this change, but I'm not a maintainer of this project. Do you see any reason not to merge it?

If this change was not helpful, or you have suggestions for improvements, please let me know!