mirror of
https://github.com/binwiederhier/ntfy.git
synced 2026-11-14 00:21:00 +08:00
binwiederhier
c45e07fddf
The sprig replace, join and regexReplaceAll functions (and the must* regex variants) built their result with no size limit, so a template could amplify small inputs into a huge string: replace "a" with two 10k strings returns 100 MB in one call, and nesting reaches terabytes. The existing guards miss this, since the 100 ms deadline is only checked between template steps and the 1 MB output limit only applies to the final write, so the single allocation inside the function crashed the whole process with an unrecoverable out-of-memory fatal error. Anonymous publishing is on by default, so anyone who can publish to a topic could crash the server with one request. Each of these functions now measures the result it is about to build and panics past stringLengthLimit (the template executor recovers that into a render error), the same guard repeat and indent already use. repeat, indent and nindent were already capped; cat and indent grow additively and stay bounded. Reported privately by Robert Flosbach of Neodyme. Claude-Session: https://claude.ai/code/session_01DeXuhSjq5Gta5qPJgSceFe