tj / node-querystring

querystring parser for node and the browser - supporting nesting (used by Express, Connect, etc)
MIT License
455 stars 66 forks source link

Nested arrays can be used to crash node. #104

Open Dshiv opened 10 years ago

Dshiv commented 10 years ago

This may be the same as issue https://github.com/visionmedia/node-querystring/issues/28 but the parser will create a new array if the parameter looks like: foo[0]=bar. Taking that a step farther foo[0][100000000]=bar will create an array with an array of null objects at the first index of the object. Any time the server tries to perform an action on this object the process runs out of memory and crashes.

I'd suggest range checks be performed before the creation of the query string parameter object, or cap the size of the parameter object.