liquid icon indicating copy to clipboard operation
liquid copied to clipboard

How to prevent denial of service caused by endless loop?

Open spazer5 opened this issue 2 years ago • 1 comments

I have noticed that there is no upper limits on iterations which makes it easy for someone to brick an app by launching an infinite loop:

Liquid::Template.parse("{% for n in (1..100000) %}{% endfor %}").render

Is there a configuration to prevent this?

spazer5 avatar Apr 05 '22 05:04 spazer5

A timeout can be used to interrupt liquid rendering.

dylanahsmith avatar Apr 06 '22 00:04 dylanahsmith