CodeMirror/uMatrix
1
0
Fork 0
mirror of https://github.com/gorhill/uMatrix.git synced 2024-05-18 11:13:28 +12:00
Code Issues Releases Wiki Activity

Fix infinite recursion with maliciously crafted URL

Browse source 
Related issue:
- https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adoc
This commit is contained in:
Raymond Hill 2021-07-19 10:18:45 -04:00
parent 1d936742a7
commit 30c12dabdc
No known key found for this signature in database
GPG key ID: 25E1490B761470C2
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/js/main-blocked.js
View file

@ -86,7 +86,7 @@ uDom('.what').text(details.url);
return s;
};
let renderParams = function(parentNode, rawURL) {
let renderParams = function(parentNode, rawURL, depth = 0) {
let a = document.createElement('a');
a.href = rawURL;
if ( a.search.length === 0 ) { return false; }
@ -108,9 +108,9 @@ uDom('.what').text(details.url);
let name = safeDecodeURIComponent(param.slice(0, pos));
let value = safeDecodeURIComponent(param.slice(pos + 1));
li = liFromParam(name, value);
if ( reURL.test(value) ) {
if ( depth < 2 && reURL.test(value) ) {
let ul = document.createElement('ul');
renderParams(ul, value);
renderParams(ul, value, depth + 1);
li.appendChild(ul);
}
parentNode.appendChild(li);