vpm
vpm copied to clipboard
Fix stack overflow DoS in package edit/delete routes
This PR fixes an issue where error paths in the package edit and delete routes could trigger infinite recursion, leading to a stack overflow and crashing the server.
Routes affected
/packages/:name/edit
/packages/:name/delete
Problem
src/package.v
pkg := app.packages().get(name) or {
app.error(err.msg())
return app.edit(name) // this is called recursively
}
Fix
Respond with status code 404 and an error message
pkg := app.packages().get(name) or {
app.set_status(404, '')
return app.text(err.msg())
}
PoC
➜ curl -X GET http://localhost:8081/packages/somepackage/edit
curl: (52) Empty reply from server
➜ ./vpm
NOTICE: relation "Category" already exists, skipping
NOTICE: relation "CategoryPackage" already exists, skipping
NOTICE: relation "Package" already exists, skipping
NOTICE: relation "User" already exists, skipping
[Vweb] Running app on http://localhost:8081/
[Vweb] We have 1 workers
[vweb] Context.error: Found no module with name "somepackage"
[vweb] Context.error: Found no module with name "somepackage"
.
.
.
[vweb] Context.error: Found no module with name "somepackage"
[1] 21337 segmentation fault ./vpm