digitalbazaar / rdf-canonize

An implementation of the RDF Dataset Normalization Algorithm in JavaScript.
Other
22 stars 13 forks source link

Fail closed by default on deep recursion when canonizing bnode labels #46

Open dlongley opened 2 years ago

dlongley commented 2 years ago

If deep recursion occurs when determining the canonical labels for blank nodes, we should bail out by default instead of continuing until all blank nodes receive their canonical labels. Since the recursion can be a slower than normal process and is extremely non-typical in useful data, we should require the developer to pass a flag to allow the algorithm to execute in these cases. This creates a stronger security-minded posture, enabling the library to "fail closed" by default when encountering such data.