zedshaw/Tir — Issue #10: Tir is vulnerable to a hash collision DOS attack.
Author: pygy
Created: 2012-01-16 12:58:02+00:00
State: open

In its current form, Tir is vulnerable to the attack described [here](http://lua-users.org/lists/lua-l/2011-12/msg00813.html).

Lua strings are interned. The predictability of the hashing algorithm allows to flood it with strings designed to produced collisions. which can slow down the server. You can take a server down a single client using this technique.

Since the url_parse and its POST equivalent parse everything, Tir is vulnerable to these attacks.

A solution would be to pass a table with the keys to extract from the request.