Skip to content

buffer: fix DoS vector in atob

Rodrigo Muino Tomonari requested to merge github/fork/chjj/fix-atob into main

I know the consensus is that this function shouldn't be optimized, but the O(n*70) worst case complexity of the loop isn't mentioned in the docs. In fact, the comments in the code don't even go into detail why the function is slow, it simply says it's "not optimized".

This is a DoS vector to the unaware user and irresponsible IMO. We only found this while running benchmarks for the browserify buffer module.

We are currently trying to remove our dependency on base64-js by using atob in both node and the browser. Performance in Chromium is exceptional and faster than anything we could write in javascript. Node is a different story.

The mitigation for this is absolutely trivial, and I'm scratching my head as to why this wasn't done in the first place.

Anyway, I could optimize it even further with a few more lines, but that's against the rules, so I just did the absolute bare minimum to make it more palatable to everyone here. Please reconsider.

Merge request reports

Loading