rack/rack — Issue #356: [Security] KeySpaceConstrainedParams useless in its current implementation?
Author: tizoc
Created: 2012-03-05 17:40:52+00:00
State: open

KeySpaceConstrainedParams is supposed to prevent the application from clients that send too many keys+values by limiting the amount of space they can take up. I don't think that this is the correct approach, and also, in its current version it isn't very useful because anyone who wants to do damage can circumvent the protection mechanism with ease being that nesting is supported.

The code in question is:

https://github.com/rack/rack/blob/master/lib/rack/utils.rb#L56
https://github.com/rack/rack/blob/master/lib/rack/utils.rb#L436

The current limit applies to every KeySpaceConstrainedParams instance in isolation, but the childrens are not being considered, which means that for the possible resulting structures, the limit is actually much higher (actually, it is infinite, there is no limit when nesting is involved)