Merge pull request #478 from Aditya8369/471

fix: Depth validation uses recursion, enabling CPU/resource exhaustion

Author: devanshi14malhotra

backend/security_parsers.py

@@ -145,28 +145,33 @@ def safe_get_json(
 
 def _validate_depth(obj: Any, current_depth: int = 0, max_depth: int = MAX_NESTED_DEPTH) -> bool:
     """
-    Recursively validate JSON nesting depth to prevent stack overflow attacks.
+    Iteratively validate JSON nesting depth to prevent stack overflow attacks.
     
     Args:
         obj: Object to validate
-        current_depth: Current recursion depth (internal use)
+        current_depth: Starting depth for the provided object (internal use)
         max_depth: Maximum allowed depth
     
     Returns:
         bool: True if depth is within limits
     """
-    if current_depth > max_depth:
-        return False
-    
-    if isinstance(obj, dict):
-        for value in obj.values():
-            if not _validate_depth(value, current_depth + 1, max_depth):
-                return False
-    elif isinstance(obj, (list, tuple)):
-        for item in obj:
-            if not _validate_depth(item, current_depth + 1, max_depth):
-                return False
-    
+    stack = [(obj, current_depth)]
+
+    while stack:
+        value, depth = stack.pop()
+
+        if depth > max_depth:
+            return False
+
+        if isinstance(value, dict):
+            next_depth = depth + 1
+            for child in value.values():
+                stack.append((child, next_depth))
+        elif isinstance(value, (list, tuple)):
+            next_depth = depth + 1
+            for child in value:
+                stack.append((child, next_depth))
+
     return True
 
 

tests/test_security.py

@@ -6,12 +6,13 @@
 """
 import pytest
 import json
+import sys
 from types import SimpleNamespace
 from unittest.mock import patch, MagicMock
 
 # Import security modules
 from backend.security_parsers import (
-    safe_get_json, get_request_arg_safe, validate_content_type,
+    safe_get_json, get_request_arg_safe, validate_content_type, _validate_depth,
     JSONParseError, MAX_JSON_SIZE_BYTES
 )
 from backend.sanitizer import (
@@ -85,6 +86,21 @@ def test_non_object_root_allowed_when_explicitly_opted_out(self):
         assert error is None
         assert data == [{"id": 1}]
 
+    def test_validate_depth_handles_deep_payload_without_recursion_error(self):
+        """Iterative traversal should reject deep payloads without recursion overhead."""
+        nested = {}
+        current = nested
+        for _ in range(30):
+            current["nested"] = {}
+            current = current["nested"]
+
+        old_limit = sys.getrecursionlimit()
+        try:
+            sys.setrecursionlimit(20)
+            assert _validate_depth(nested, max_depth=10) is False
+        finally:
+            sys.setrecursionlimit(old_limit)
+
 
 class TestXSSSanitization:
     """Test XSS attack prevention through sanitization."""