From 878ca6dfbd745434a2736b378f7b0eda1f93684e Mon Sep 17 00:00:00 2001 From: Aykhan Shahsuvarov Date: Thu, 24 Sep 2026 19:08:58 +0400 Subject: [PATCH] fix(script): bound maxRedirects to 100 and reject out of range values --- docs/configuration.md | 2 +- internal/script/http.go | 10 ++++++++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/docs/configuration.md b/docs/configuration.md index 93c52ad..bee01f9 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -582,7 +582,7 @@ http(url, opts) | `body` | string | `""` | Request body | | `timeout` | duration string (`"500ms"`) | `30s` | Request timeout (the `timeout` config does not apply), applied to each hop when redirects are followed | | `insecure` | boolean | `false` | Skip TLS verification (the `insecure` config does not apply) | -| `maxRedirects` | number | `0` | How many redirects to follow, `0` follows none | +| `maxRedirects` | number | `0` | How many redirects to follow, `0` follows none, maximum 100 | Unknown options and values of the wrong type raise an error. diff --git a/internal/script/http.go b/internal/script/http.go index 7dc1b80..0b80b1f 100644 --- a/internal/script/http.go +++ b/internal/script/http.go @@ -63,6 +63,9 @@ type HTTPDoer interface { // httpDefaultMethod is used when the options set no method. const httpDefaultMethod = http.MethodGet +// httpMaxRedirectsLimit is the highest maxRedirects a script may ask for. +const httpMaxRedirectsLimit = 100 + // Option keys accepted by the http function. const ( httpOptionMethod = "method" @@ -103,10 +106,13 @@ func (b *httpBridge) do(req *HTTPRequest) (*HTTPResponse, error) { // It can return the following errors: // - types.ScriptHTTPOptionError func parseHTTPMaxRedirects(count float64) (int, error) { - if count < 0 || count != math.Trunc(count) { + if math.IsNaN(count) || count < 0 || count > httpMaxRedirectsLimit || count != math.Trunc(count) { return 0, types.NewScriptHTTPOptionError( httpOptionMaxRedirects, - types.NewScriptTypeError("a whole number of 0 or more", strconv.FormatFloat(count, 'f', -1, 64)), + types.NewScriptTypeError( + "a whole number between 0 and "+strconv.Itoa(httpMaxRedirectsLimit), + strconv.FormatFloat(count, 'g', -1, 64), + ), ) } return int(count), nil