4 results · Feed
-
Medium 5.3
smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line
### Summary `parse()` has a quadratic-time path in `parseKey`, reachable on default options with ordinary valid input. For every key line and table-header line, `parseKey` (dist/struct.js, lines 58 and 86) finds the dotted-key separator with `ctx.s.indexOf('.…
-
High 8.2
smol-toml: Denial of Service via malformed TOML documents
smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNew…
-
Medium 5.3
smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines
### Summary An attacker can send a maliciously crafted TOML to cause the parser to crash, because of a stack overflow caused by thousands of consecutive commented lines. The library uses recursion internally while parsing to skip over commented lines, which c…
-
Medium 5.3
smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables
### Summary An attacker can send a maliciously crafted TOML to cause the parser to crash because of a stack overflow caused by a deeply nested inline structure. A similar problem occurs when attempting to stringify deeply nested objects. The library does not …