fluent icon indicating copy to clipboard operation
fluent copied to clipboard

Published 20 hours ago • verified publisher icon projectfluent

Protect against the Billion Laughs attack

Open stasm opened this issue 6 years ago • 1 comments

The resolver should be resilient to exponential reference expansion attacks. See https://en.wikipedia.org/wiki/Billion_laughs_attack

stasm avatar Jul 17 '19 13:07 stasm

The mitigation in fluent.js involves checking the length of the resolved placeable against a constant. We should 1) make the maximum length configurable in the constructor, and 2) consider how this works with #273.

stasm avatar Jul 18 '19 10:07 stasm