pangolin_mirror/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-03-05 18:26:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add max recursion depth to matchSegments

Browse Source
This commit is contained in:
Owen
2025-12-31 10:40:16 -05:00
parent 6660c850f3
commit f7fcde8312
1 changed files with 19 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
server/routers/badger/verifySession.ts
View File

@@ -1035,14 +1035,25 @@ export function isPathAllowed(pattern: string, path: string): boolean {
logger.debug(`Normalized pattern parts: [${patternParts.join(", ")}]`); logger.debug(`Normalized pattern parts: [${patternParts.join(", ")}]`);
logger.debug(`Normalized path parts: [${pathParts.join(", ")}]`); logger.debug(`Normalized path parts: [${pathParts.join(", ")}]`);
// Maximum recursion depth to prevent stack overflow and memory issues
const MAX_RECURSION_DEPTH = 100;
// Recursive function to try different wildcard matches // Recursive function to try different wildcard matches
function matchSegments(patternIndex: number, pathIndex: number): boolean { function matchSegments(patternIndex: number, pathIndex: number, depth: number = 0): boolean {
const indent = " ".repeat(pathIndex); // Indent based on recursion depth // Check recursion depth limit
if (depth > MAX_RECURSION_DEPTH) {
logger.warn(
`Path matching exceeded maximum recursion depth (${MAX_RECURSION_DEPTH}) for pattern "${pattern}" and path "${path}"`
);
return false;
}
const indent = " ".repeat(depth); // Indent based on recursion depth
const currentPatternPart = patternParts[patternIndex]; const currentPatternPart = patternParts[patternIndex];
const currentPathPart = pathParts[pathIndex]; const currentPathPart = pathParts[pathIndex];
logger.debug( logger.debug(
`${indent}Checking patternIndex=${patternIndex} (${currentPatternPart || "END"}) vs pathIndex=${pathIndex} (${currentPathPart || "END"})` `${indent}Checking patternIndex=${patternIndex} (${currentPatternPart || "END"}) vs pathIndex=${pathIndex} (${currentPathPart || "END"}) [depth=${depth}]`
); );
// If we've consumed all pattern parts, we should have consumed all path parts // If we've consumed all pattern parts, we should have consumed all path parts
@@ -1075,7 +1086,7 @@ export function isPathAllowed(pattern: string, path: string): boolean {
logger.debug( logger.debug(
`${indent}Trying to skip wildcard (consume 0 segments)` `${indent}Trying to skip wildcard (consume 0 segments)`
); );
if (matchSegments(patternIndex + 1, pathIndex)) { if (matchSegments(patternIndex + 1, pathIndex, depth + 1)) {
logger.debug( logger.debug(
`${indent}Successfully matched by skipping wildcard` `${indent}Successfully matched by skipping wildcard`
); );
@@ -1086,7 +1097,7 @@ export function isPathAllowed(pattern: string, path: string): boolean {
logger.debug( logger.debug(
`${indent}Trying to consume segment "${currentPathPart}" for wildcard` `${indent}Trying to consume segment "${currentPathPart}" for wildcard`
); );
if (matchSegments(patternIndex, pathIndex + 1)) { if (matchSegments(patternIndex, pathIndex + 1, depth + 1)) {
logger.debug( logger.debug(
`${indent}Successfully matched by consuming segment for wildcard` `${indent}Successfully matched by consuming segment for wildcard`
); );
@@ -1114,7 +1125,7 @@ export function isPathAllowed(pattern: string, path: string): boolean {
logger.debug( logger.debug(
`${indent}Segment with wildcard matches: "${currentPatternPart}" matches "${currentPathPart}"` `${indent}Segment with wildcard matches: "${currentPatternPart}" matches "${currentPathPart}"`
); );
return matchSegments(patternIndex + 1, pathIndex + 1); return matchSegments(patternIndex + 1, pathIndex + 1, depth + 1);
} }
logger.debug( logger.debug(
@@ -1135,10 +1146,10 @@ export function isPathAllowed(pattern: string, path: string): boolean {
`${indent}Segments match: "${currentPatternPart}" = "${currentPathPart}"` `${indent}Segments match: "${currentPatternPart}" = "${currentPathPart}"`
); );
// Move to next segments in both pattern and path // Move to next segments in both pattern and path
return matchSegments(patternIndex + 1, pathIndex + 1); return matchSegments(patternIndex + 1, pathIndex + 1, depth + 1);
} }
const result = matchSegments(0, 0); const result = matchSegments(0, 0, 0);
logger.debug(`Final result: ${result}`); logger.debug(`Final result: ${result}`);
return result; return result;
} }