prevent json-ld bombing, turn off browser autocomplete on channel sources creation

This commit is contained in:
zotlabs
2018-08-11 16:16:54 -07:00
parent 1d13cc1601
commit 5afe779ffc
3 changed files with 18 additions and 2 deletions

View File

@@ -2042,6 +2042,22 @@ function jsonld_document_loader($url) {
require_once('library/jsonld/jsonld.php');
$recursion = 0;
$x = debug_backtrace();
if($x) {
foreach($x as $n) {
if($n['function'] === __FUNCTION__) {
$recursion ++;
}
}
}
if($recursion > 5) {
logger('jsonld bomb detected at: ' . $url);
killme();
}
$cachepath = 'store/[data]/ldcache';
if(! is_dir($cachepath))
os_mkdir($cachepath, STORAGE_DEFAULT_PERMISSIONS, true);