Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add limits to prevent abuse #110

Open
akissa opened this issue Dec 13, 2018 · 1 comment
Open

Add limits to prevent abuse #110

akissa opened this issue Dec 13, 2018 · 1 comment

Comments

@akissa
Copy link

akissa commented Dec 13, 2018

What I did:

Investigating the package for use in a email scanning project, looked at the docs and the source.

What I expected:

Options to limit the max number of mime parts to be processed and max nested levels to descend.

What I got:

Cannot find any limits, meaning memory exhaustion could occur on a message with very many parts.

I suspect you could also run into issues with recursion limits being exceeded for deeply nested messages ?

Release or branch I am using:

master

@jhillyerd
Copy link
Owner

enmime doesn't have protection for that. Given that we hold parsed messages in memory, I think it's more likely we run out of memory with large attachments than run out of stack due to recursion.

Once #90 is implemented, we could have optional limits on parts, part size, and nesting depth.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants