{"action":"created","issue":{"url":"https://api.github.com/repos/nodejs/node/issues/4905","repository_url":"https://api.github.com/repos/nodejs/node","labels_url":"https://api.github.com/repos/nodejs/node/issues/4905/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/node/issues/4905/comments","events_url":"https://api.github.com/repos/nodejs/node/issues/4905/events","html_url":"https://github.com/nodejs/node/issues/4905","id":129143118,"number":4905,"title":"Node crashes when a big sparse array is given to console.log (might cause DoS)","user":{"login":"mik01aj","id":3027415,"avatar_url":"https://avatars.githubusercontent.com/u/3027415?v=3","gravatar_id":"","url":"https://api.github.com/users/mik01aj","html_url":"https://github.com/mik01aj","followers_url":"https://api.github.com/users/mik01aj/followers","following_url":"https://api.github.com/users/mik01aj/following{/other_user}","gists_url":"https://api.github.com/users/mik01aj/gists{/gist_id}","starred_url":"https://api.github.com/users/mik01aj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mik01aj/subscriptions","organizations_url":"https://api.github.com/users/mik01aj/orgs","repos_url":"https://api.github.com/users/mik01aj/repos","events_url":"https://api.github.com/users/mik01aj/events{/privacy}","received_events_url":"https://api.github.com/users/mik01aj/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/nodejs/node/labels/console","name":"console","color":"ff88cc"},{"url":"https://api.github.com/repos/nodejs/node/labels/util","name":"util","color":"d4c5f9"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":20,"created_at":"2016-01-27T13:23:42Z","updated_at":"2016-03-22T13:53:21Z","closed_at":null,"body":"```\r\nvar a=[] \r\na[1000000000]=1 \r\nconsole.log(a) \r\n```\r\n\r\nThis ends up with a `FATAL ERROR: process out of memory`. Wouldn't expect this...\r\n\r\nNote that many applications use `console.log` for logging their stuff, and this can lead to a DoS attack: for example, when an user-specified JSON `{\"1000000000\":\"a\"}` is merged with some pre-existing array and then printed on console. Having an upper bound on printed `Array` items in `console.log` seems like an easy fix for this.\r\n\r\nI originally reported this to `security@nodejs.org`, but I got this response:\r\n\r\n> I don't think we consider this a security issue (it's known and documented) but it's arguably a quality-of-implementation issue. If you'd like to pursue this further, can you file an issue (...)?\r\n\r\nSo I'm opening an issue :smiley: \r\n\r\nBtw, I can't see this documented anywhere in the [console docs](https://nodejs.org/api/console.html), but maybe I'm missing something?"},"comment":{"url":"https://api.github.com/repos/nodejs/node/issues/comments/199825942","html_url":"https://github.com/nodejs/node/issues/4905#issuecomment-199825942","issue_url":"https://api.github.com/repos/nodejs/node/issues/4905","id":199825942,"user":{"login":"tunniclm","id":5011883,"avatar_url":"https://avatars.githubusercontent.com/u/5011883?v=3","gravatar_id":"","url":"https://api.github.com/users/tunniclm","html_url":"https://github.com/tunniclm","followers_url":"https://api.github.com/users/tunniclm/followers","following_url":"https://api.github.com/users/tunniclm/following{/other_user}","gists_url":"https://api.github.com/users/tunniclm/gists{/gist_id}","starred_url":"https://api.github.com/users/tunniclm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tunniclm/subscriptions","organizations_url":"https://api.github.com/users/tunniclm/orgs","repos_url":"https://api.github.com/users/tunniclm/repos","events_url":"https://api.github.com/users/tunniclm/events{/privacy}","received_events_url":"https://api.github.com/users/tunniclm/received_events","type":"User","site_admin":false},"created_at":"2016-03-22T13:53:21Z","updated_at":"2016-03-22T13:53:21Z","body":"@mik01aj I'm not sure why this would necessarily be semver-major, since it could even be completely disabled by default, if necessary. (I was thinking setting the module options to be disabled by default, and to change the REPL to use the per-invocation values `arrayMaxUnsetElementsBeforeElide: 0` and `arrayMaxOutputElements: A_SUFFICIENTLY_LARGE_NUMBER` by default).\r\n\r\nI _can_ see that it doesn't help with selecting the right value for a maximum number of array output elements though -- would a flat value be sufficient? would we want a number calculated at startup depending on the machine? would we want a value calculated at run time based on the amount of free memory?"}}