mixpanel-node
mixpanel-node copied to clipboard
import_batch execution leak vulnerability
There is an execution leak issue associated with the import_batch function, this seems to have been a reported issue for a few years and does indeed seem to exist.
It can be replicated with the following script and is detected when an initial invocation has not completed when a new invocation is triggered.
var Mixpanel = require('mixpanel');
exports.handler = async (event, context) => {
context.callbackWaitsForEmptyEventLoop = false;
// import an old event
var mixpanel_importer = Mixpanel.init(token', {
secret: "secret"
});
mixpanel_importer.set_config({ debug: true });
// import multiple events at once
mixpanel_importer.import_batch([
{
event: 'old event',
properties: {
time: new Date(2012, 4, 20, 12, 34, 56),
distinct_id: 'billybob',
gender: 'male'
}
},
{
event: 'another old event',
properties: {
time: new Date(2012, 4, 21, 11, 33, 55),
distinct_id: 'billybob',
color: 'red'
}
}
]);
};