Hardening suggestions for Stirling-PDF / certValidate (#2395)

* Protect `readLine()` against DoS * Switch order of literals to prevent NullPointerException --------- Co-authored-by: pixeebot[bot] <104101892+pixeebot[bot]@users.noreply.github.com>
Stirling-Tools · Dec 5, 2024 · 6152d3f · 6152d3f
1 parent 86b20b9
commit 6152d3f
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/src/main/java/stirling/software/SPDF/service/CertificateValidationService.java b/src/main/java/stirling/software/SPDF/service/CertificateValidationService.java
@@ -1,5 +1,6 @@
 package stirling.software.SPDF.service;
 
+import io.github.pixee.security.BoundedLineReader;
 import java.io.BufferedReader;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
@@ -44,14 +45,14 @@ private void loadMozillaCertificates() throws Exception {
             boolean inCert = false;
             int certCount = 0;
 
-            while ((line = reader.readLine()) != null) {
+            while ((line = BoundedLineReader.readLine(reader, 5_000_000)) != null) {
                 if (line.startsWith("CKA_VALUE MULTILINE_OCTAL")) {
                     inCert = true;
                     certData = new StringBuilder();
                     continue;
                 }
                 if (inCert) {
-                    if (line.equals("END")) {
+                    if ("END".equals(line)) {
                         inCert = false;
                         byte[] certBytes = parseOctalData(certData.toString());
                         if (certBytes != null) {