Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ndarray-scratch.eye suffers a DoS issue with true as the shape argument #8

Open
zyscoder opened this issue Nov 25, 2024 · 0 comments
Open

Comments

@zyscoder
Copy link

Version

node v22.11.0
npm 10.9.0

Platform

Linux u24vm 6.8.0-48-generic #48-Ubuntu SMP PREEMPT_DYNAMIC Fri Sep 27 14:04:52 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

What steps will reproduce the bug?

  1. Try to install the package: ndarray-scratch
a. npm init -y
b. npm shrinkwrap
c. npm install --save ndarray-scratch
d. npm audit fix

the final package.json is as follows:

{
  "name": "package-f7e73b82e381b4db5a7fd842cb0a897b",
  "version": "1.0.0",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "description": "",
  "dependencies": {
    "ndarray-scratch": "^1.2.0"
  }
}
  1. Setup a node instance,
node
  1. and run the following javascript code.
var lib = await import('ndarray-scratch');
 lib.eye(true);

Then the node instance will hang and no response returned.

» node           
Welcome to Node.js v22.11.0.
Type ".help" for more information.
> var lib = await import('ndarray-scratch');
undefined
> lib.eye(true);

(the node server hanged here)
...

How often does it reproduce? Is there a required condition?

This issue can always be triggered following the steps above.

What is the expected behavior? Why is that the expected behavior?

check if the shape argument fit the requirement type to avoid the DoS problem.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant