vpm icon indicating copy to clipboard operation
vpm copied to clipboard

Fix stack overflow DoS in package edit/delete routes

Open ayushch80 opened this issue 1 month ago • 0 comments

This PR fixes an issue where error paths in the package edit and delete routes could trigger infinite recursion, leading to a stack overflow and crashing the server.

Routes affected

/packages/:name/edit /packages/:name/delete

Problem

src/package.v

	pkg := app.packages().get(name) or {
		app.error(err.msg())
		return app.edit(name) // this is called recursively
	}

Fix

Respond with status code 404 and an error message

	pkg := app.packages().get(name) or {
		app.set_status(404, '')
		return app.text(err.msg())
	}

PoC

➜  curl -X GET http://localhost:8081/packages/somepackage/edit
curl: (52) Empty reply from server
➜  ./vpm
NOTICE:  relation "Category" already exists, skipping
NOTICE:  relation "CategoryPackage" already exists, skipping
NOTICE:  relation "Package" already exists, skipping
NOTICE:  relation "User" already exists, skipping
[Vweb] Running app on http://localhost:8081/
[Vweb] We have 1 workers
[vweb] Context.error: Found no module with name "somepackage"
[vweb] Context.error: Found no module with name "somepackage"
.
.
.
[vweb] Context.error: Found no module with name "somepackage"
[1]    21337 segmentation fault  ./vpm

ayushch80 avatar Jan 02 '26 20:01 ayushch80