CodeMirror
/
uMatrix
mirror of https://github.com/gorhill/uMatrix.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Fix infinite recursion with maliciously crafted URL 

Related issue:
- https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adoc
This commit is contained in:
Raymond Hill 2021-07-19 10:18:45 -04:00
parent 0bcb7669e7
commit 1603b33b27
No known key found for this signature in database
GPG Key ID: 25E1490B761470C2
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/js/main-blocked.js
View File

@ -87,7 +87,7 @@ uDom('.what').text(details.url);
return s;
};
const renderParams = function(parentNode, rawURL) {
const renderParams = function(parentNode, rawURL, depth = 0) {
const a = document.createElement('a');
a.href = rawURL;
if ( a.search.length === 0 ) { return false; }
@ -109,9 +109,9 @@ uDom('.what').text(details.url);
const name = safeDecodeURIComponent(param.slice(0, pos));
const value = safeDecodeURIComponent(param.slice(pos + 1));
const li = liFromParam(name, value);
if ( reURL.test(value) ) {
if ( depth < 2 && reURL.test(value) ) {
const ul = document.createElement('ul');
renderParams(ul, value);
renderParams(ul, value, depth + 1);
li.appendChild(ul);
}
parentNode.appendChild(li);