Protect readLine() against DoS

OpticFusion1 · Nov 21, 2023 · f9adace · f9adace
1 parent b865243
commit f9adace
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 5 deletions.
diff --git a/pom.xml b/pom.xml
@@ -195,13 +195,26 @@
             <artifactId>pf4j</artifactId>
             <version>3.10.0</version>
         </dependency>   
-    </dependencies>
+      <dependency>
+         <groupId>io.github.pixee</groupId>
+         <artifactId>java-security-toolkit</artifactId>
+      </dependency>
+   </dependencies>
 
     <properties>
         <project.asmVer>9.5</project.asmVer>
         <maven.compiler.source>17</maven.compiler.source>
         <maven.compiler.target>17</maven.compiler.target>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-    </properties>
-
-</project>
+      <versions.java-security-toolkit>1.0.7</versions.java-security-toolkit>
+   </properties>
+   <dependencyManagement>
+      <dependencies>
+         <dependency>
+            <groupId>io.github.pixee</groupId>
+            <artifactId>java-security-toolkit</artifactId>
+            <version>${versions.java-security-toolkit}</version>
+         </dependency>
+      </dependencies>
+   </dependencyManagement>
+</project>
diff --git a/src/main/java/optic_fusion1/kitsune/parser/impl/vbs/util/Utils.java b/src/main/java/optic_fusion1/kitsune/parser/impl/vbs/util/Utils.java
@@ -16,6 +16,7 @@
  */
 package optic_fusion1.kitsune.parser.impl.vbs.util;
 
+import io.github.pixee.security.BoundedLineReader;
 import java.io.BufferedReader;
 import java.io.BufferedWriter;
 import java.io.File;
@@ -46,7 +47,7 @@ public static List<String> getLines(File inputfile) {
         try {
             String sCurrentLine;
             br = new BufferedReader(new FileReader(inputfile));
-            while ((sCurrentLine = br.readLine()) != null) {
+            while ((sCurrentLine = BoundedLineReader.readLine(br, 5_000_000)) != null) {
                 lines.add(sCurrentLine);
             }
         } catch (IOException e) {