Protect `readLine()` against DoS #10

pixeebot · 2025-01-20T03:12:25Z

This change hardens all BufferedReader#readLine() operations against memory exhaustion.

There is no way to call readLine() safely since it is, by its nature, a read that must be terminated by the stream provider. Furthermore, a stream of data provided by an untrusted source could lead to a denial of service attack, as attackers can provide an infinite stream of bytes until the process runs out of memory.

Fixing it is straightforward using an API which limits the amount of expected characters to some sane limit. This is what our changes look like:

+ import io.github.pixee.security.BoundedLineReader;
  ...
  BufferedReader reader = getReader();
- String line = reader.readLine(); // unlimited read, can lead to DoS
+ String line = BoundedLineReader.readLine(reader, 5_000_000); // limited to 5MB

❌ The following packages couldn't be installed automatically, probably because the dependency manager is unsupported. Please install them manually:

Gradle

dependencies {
  implementation("io.github.pixee:java-security-toolkit:1.2.1")
}

Maven

<dependencies>
  <dependency>
    <groupId>io.github.pixee</groupId>
    <artifactId>java-security-toolkit</artifactId>
    <version>1.2.1</version>
  </dependency>
<dependencies>

More reading

I have additional improvements ready for this repo! If you want to see them, leave the comment:

@pixeebot next

... and I will open a new PR right away!

🧚🤖 Powered by Pixeebot

Feedback | Community | Docs | Codemod ID: pixee:java/limit-readline

pixeebot · 2025-01-28T03:01:17Z

I'm confident in this change, but I'm not a maintainer of this project. Do you see any reason not to merge it?

If this change was not helpful, or you have suggestions for improvements, please let me know!

pixeebot · 2025-01-29T03:01:27Z

Unless you expect (and want to handle) reading lines greater than 5MB, this change should be safe. You could also change the second argument to a set more aggressive or conservative limit.

If there are other concerns about this change, I'd love to hear about them!

Protect readLine() against DoS

75fc4d6

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Protect `readLine()` against DoS #10

Protect `readLine()` against DoS #10

Protect readLine() against DoS #10

Are you sure you want to change the base?

Protect readLine() against DoS #10

Conversation

Protect `readLine()` against DoS #10

Protect `readLine()` against DoS #10