Handling DoS loops or max time processing

[amit777]

trafficstars

Are there any recommended best practices or ways to put limits on the number of cycles the render function can take? For example, if a malicious user adds nested for loops with very large max lengths, how do you prevent this from taking up the entire CPU?

I've been searching around and haven't found any questions related to this, so I feel like I'm probably missing something obvious.

[harttle]

Not available currently. But I think it's OK to have this feature, are there any other libs implementing this, for reference?

[amit777]

I think I have a solution using a slightly patched paralleljs which uses webworkers. I will post the example here as soon as my patch is merged. But it's potentially pretty simple.

[amit777]

paralleljs v1.1.0 has my pull request merged in. You can pass opts.timeout to the Paralleljs's spawn method and call Liquidjs's render function within it.

[harttle]

I guess limiting the processing time is better handled by external libraries. Closing this issue.

[denis-isaev]

If this library doesn't have limits as the Shopify version does, then why is it called safe?

[harttle]

I thought Shopify doesn't have a limit on this. Will investigate whether we can do the same.

[harttle]

Added DoS related support: https://liquidjs.com/tutorials/dos.html