LiquidJS Memory Limit Bypass in Filter Output Calculation Causing DoS

Vulnerability Overview This vulnerability involves the project, where improper calculation of the output size for the , , and filters leads to excessive memory usage, potentially triggering a Denial of Service (DoS) attack. Affected Scope Affected Components: , , and filters. Specific Impact: When these filters process large arrays or strings, they may consume excessive memory, exceeding the configured , which can result in system crashes or performance degradation. Remediation Plan 1. Fix output size calculation for the filter: - In , modify the output size calculation logic within the function to ensure correct calculation of string length. - Use to calculate the string length of each element, rather than using the array length directly. 2. Fix output size calculation for serialization in and filters: - In , modify the output size calculation logic within the and functions to ensure correct calculation of the serialized string length. - Use to calculate the length of the serialized string. 3. Fix output size calculation for the filter: - In , modify the output size calculation logic within the function to ensure correct calculation of string length. - Use to calculate the string length of each element. 4. Add test cases: - Add multiple test cases in to verify the effectiveness of the above fixes. - The test cases include: - Verification of the filter's output size calculation. - Verification of the serialization output size calculation for and filters. - Verification of the filter's output size calculation. Proof of Concept (POC) Code Below is part of the POC code used to verify the existence of the vulnerability: ```javascript // test/integration/liquid/non-spec.ts it('should charge join by produced output size, not element count', () => { const array = ['a'.repeat(100), 'b'.repeat(100)]; const liquid = new Liquid({ memoryLimit: 100 }); expect(() => liquid.parseAndRenderSync('{{ array .toThrow('memory alloc limit exceeded'); }); it('should charge json serialization of concat-doubled arrays', () => { const liquid = new Liquid({ memoryLimit: 1e4 }); const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '{% assign a = a const src = '

Goal Reached Thanks to every supporter — we hit 100%!

LiquidJS Memory Limit Bypass in Filter Output Calculation Causing DoS

More from this source