Commit Graph

3 Commits

Author SHA1 Message Date
Howard Hinnant
881cd4cfad Limit STVar recursion during deserialization (RIPD-1603):
Constructing deeply nested objects could allow an attacker to
cause a server to overflow its available stack.

We now enforce a 10-deep nesting limit, and signal an error
if we encounter objects that are nested deeper.

Acknowledgements:
Ripple thanks Guido Vranken for responsibly disclosing this
issues.

Bug Bounties and Responsible Disclosures:
We welcome reviews of the rippled codebase and urge reviewers
to responsibly disclose any issues that they may find. For
more on Ripple's Bug Bounty program, please visit
https://ripple.com/bug-bounty
2018-03-23 14:18:36 -07:00
seelabs
5ad49454f1 Remove unused lambda captures 2017-07-31 18:39:58 -04:00
Brad Chase
8f97889176 Don't include unit test sources in code coverage (RIPD-1132):
Most files containing unit test code are moved to
src/test. JTx and the test client code are not yet moved.
2016-09-02 15:26:16 -04:00