Security: Add fix, and tests, for Lorem Ipsum DoS issue (#2557)

src/core/operations/GenerateLoremIpsum.mjs

@@ -8,6 +8,10 @@ import Operation from "../Operation.mjs";
 import OperationError from "../errors/OperationError.mjs";
 import { GenerateParagraphs, GenerateSentences, GenerateWords, GenerateBytes } from "../lib/LoremIpsum.mjs";
 
+// arbitrary limits set to avoid DoS by requesting ridiculous amounts of data
+const maxLoremWords = 100_000; // same limit also used for paragraphs/sentences
+const maxLoremCharacters = 1_000_000;
+
 /**
  * Generate Lorem Ipsum operation
  */
@@ -47,9 +51,7 @@ class GenerateLoremIpsum extends Operation {
      */
     run(input, args) {
         const [length, lengthType] = args;
-        if (length < 1) {
-            throw new OperationError("Length must be greater than 0");
-        }
+        checkLimits(lengthType, length);
         switch (lengthType) {
             case "Paragraphs":
                 return GenerateParagraphs(length);
@@ -68,3 +70,32 @@ class GenerateLoremIpsum extends Operation {
 }
 
 export default GenerateLoremIpsum;
+
+/**
+ * check combined validity of lengthType and length arguments
+ * @param {string} lengthType
+ * @param {number} length
+ * @throws {OperationError}
+ */
+function checkLimits(lengthType, length) {
+    if (length < 1) {
+        throw new OperationError("Length must be greater than 0");
+    }
+
+    switch (lengthType) {
+        case "Paragraphs":
+        case "Sentences":
+        case "Words":
+            if (length > maxLoremWords) {
+                throw new OperationError("Length must be less than " + maxLoremWords);
+            }
+            break;
+        case "Bytes":
+            if (length > maxLoremCharacters) {
+                throw new OperationError("Length must be less than " + maxLoremCharacters);
+            }
+            break;
+        default:
+            throw new OperationError("Invalid length type");
+    }
+}