Specify a maximum number of runs to limit the request params -> DoS.

[ioquatix]

No description provided.

[Sim4n6]

suppose i set maximum_runs = profiler_runs+1 and profiler_runs = 999_999_999 ?

[ioquatix]

It's your own fault if you use this code incorrectly. I also think we should document that should avoid using this in production or in any environment where a denial of service would cause an outage.

[Sim4n6]

LGTM

[jeremyevans]

I prefer clamp, or at least something similar that sets both a low and high bound. What are your thoughts?

[mpalmer]

I guess in the interests of preventing people from trying to do "potato" profile runs, doing profiler_runs.to_i.clamp(1, @maximum_runs) would be advisable, but I wouldn't make it a blocker for merge. The important thing, for this PR, is to prevent the DoS, which the current implementation does.

[Sim4n6]

Meanwhile, could you please consider enabling the private vulnerability reporting feature for this repo?

[mpalmer]

I've enabled that, @Sim4n6, and there's also the option to go through Tidelift for vulnerability disclosure, per the README.

[ioquatix]

Okay, I released it, thanks everyone!