Notice that extra.params is an atom. In the worst case, people may be doing some Proxy, and you expose your service to a potential DDoS attack and create new atoms until you run out of Memory.
%Stripe.Error{
source: :stripe,
code: :invalid_request_error,
request_id: {"Request-Id", "req_unJcuRGfNFBuSb"},
extra: %{
card_code: :customer_tax_location_invalid,
http_status: 400,
param: :"customer_details[ip_address]", # notice here
raw_error: %{
"code" => "customer_tax_location_invalid",
"doc_url" => "https://stripe.com/docs/error-codes/customer-tax-location-invalid",
"message" => "We could not determine the customer's tax location based on the provided customer address.",
"param" => "customer_details[ip_address]",
"request_log_url" => "https://dashboard.stripe.com/test/logs/req_unJcuRGfNFBuSb?t=1683497407",
"type" => "invalid_request_error"
}
},
message: "We could not determine the customer's tax location based on the provided customer address.",
user_message: nil
}
Notice that
extra.params
is an atom. In the worst case, people may be doing some Proxy, and you expose your service to a potential DDoS attack and create new atoms until you run out of Memory.Proposal
Prevent using atoms for
extra.param