Skip to content

Commit c75f4fc

Browse files
author
christopherholland-workday
committed
Add protections for loop-bound injections
1 parent 00fd663 commit c75f4fc

3 files changed

Lines changed: 0 additions & 58 deletions

File tree

‎packages/components/evaluation/EvaluationRunner.ts‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -94,21 +94,11 @@ export class EvaluationRunner {
9494
throw new Error('chatflowId must be a valid array')
9595
}
9696

97-
const MAX_CHATFLOWS = 1000
98-
if (chatflowIds.length > MAX_CHATFLOWS) {
99-
throw new Error(`Cannot evaluate more than ${MAX_CHATFLOWS} chatflows at once`)
100-
}
101-
10297
// Validate dataset.rows is an actual array to prevent DoS attacks
10398
if (!data.dataset || !Array.isArray(data.dataset.rows)) {
10499
throw new Error('dataset.rows must be a valid array')
105100
}
106101

107-
const MAX_ROWS = 1000
108-
if (data.dataset.rows.length > MAX_ROWS) {
109-
throw new Error(`Dataset cannot exceed ${MAX_ROWS} rows`)
110-
}
111-
112102
const returnData: ICommonObject = {}
113103
returnData.evaluationId = data.evaluationId
114104
returnData.runDate = new Date()

‎packages/server/src/services/evaluations/EvaluatorRunner.ts‎

Lines changed: 0 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,6 @@ interface EvaluatorReturnType {
1010
result: 'Pass' | 'Fail' | 'Error'
1111
}
1212

13-
// Limit maximum array sizes to prevent DoS attacks
14-
const MAX_OUTPUTS = 10000
15-
const MAX_EVALUATORS = 1000
16-
const MAX_SPLIT_VALUES = 1000
17-
1813
export const runAdditionalEvaluators = async (
1914
metricsArray: ICommonObject[],
2015
actualOutputArray: string[],
@@ -27,14 +22,6 @@ export const runAdditionalEvaluators = async (
2722
throw new Error('Invalid input: expected arrays')
2823
}
2924

30-
if (actualOutputArray.length > MAX_OUTPUTS) {
31-
throw new Error(`Too many outputs: maximum allowed is ${MAX_OUTPUTS}`)
32-
}
33-
34-
if (selectedEvaluators.length > MAX_EVALUATORS) {
35-
throw new Error(`Too many evaluators: maximum allowed is ${MAX_EVALUATORS}`)
36-
}
37-
3825
const evaluationResults: any[] = []
3926
const evaluatorDict: any = {}
4027

@@ -121,10 +108,6 @@ export const runAdditionalEvaluators = async (
121108
case 'ContainsAny':
122109
passed = false
123110
splitValues = value.split(',').map((v) => v.trim().toLowerCase()) // Split, trim, and convert to lowercase
124-
// Limit split values to prevent unbounded iteration
125-
if (splitValues.length > MAX_SPLIT_VALUES) {
126-
throw new Error(`Too many split values: maximum allowed is ${MAX_SPLIT_VALUES}`)
127-
}
128111

129112
for (let i = 0; i < splitValues.length; i++) {
130113
if (actualOutput.includes(splitValues[i])) {
@@ -140,10 +123,6 @@ export const runAdditionalEvaluators = async (
140123
case 'ContainsAll':
141124
passed = true
142125
splitValues = value.split(',').map((v) => v.trim().toLowerCase()) // Split, trim, and convert to lowercase
143-
// Limit split values to prevent unbounded iteration
144-
if (splitValues.length > MAX_SPLIT_VALUES) {
145-
throw new Error(`Too many split values: maximum allowed is ${MAX_SPLIT_VALUES}`)
146-
}
147126

148127
for (let i = 0; i < splitValues.length; i++) {
149128
if (!actualOutput.includes(splitValues[i])) {
@@ -159,10 +138,6 @@ export const runAdditionalEvaluators = async (
159138
case 'DoesNotContainAny':
160139
passed = true
161140
splitValues = value.split(',').map((v) => v.trim().toLowerCase()) // Split, trim, and convert to lowercase
162-
// Limit split values to prevent unbounded iteration
163-
if (splitValues.length > MAX_SPLIT_VALUES) {
164-
throw new Error(`Too many split values: maximum allowed is ${MAX_SPLIT_VALUES}`)
165-
}
166141

167142
for (let i = 0; i < splitValues.length; i++) {
168143
if (actualOutput.includes(splitValues[i])) {
@@ -178,10 +153,6 @@ export const runAdditionalEvaluators = async (
178153
case 'DoesNotContainAll':
179154
passed = true
180155
splitValues = value.split(',').map((v) => v.trim().toLowerCase()) // Split, trim, and convert to lowercase
181-
// Limit split values to prevent unbounded iteration
182-
if (splitValues.length > MAX_SPLIT_VALUES) {
183-
throw new Error(`Too many split values: maximum allowed is ${MAX_SPLIT_VALUES}`)
184-
}
185156

186157
for (let i = 0; i < splitValues.length; i++) {
187158
if (actualOutput.includes(splitValues[i])) {

‎packages/server/src/services/evaluations/index.ts‎

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -78,21 +78,11 @@ const createEvaluation = async (body: ICommonObject, baseURL: string, orgId: str
7878
throw new Error('chatflowType must be a valid array')
7979
}
8080

81-
const MAX_CHATFLOW_TYPES = 1000
82-
if (chatflowTypes.length > MAX_CHATFLOW_TYPES) {
83-
throw new Error(`Cannot evaluate more than ${MAX_CHATFLOW_TYPES} chatflow types at once`)
84-
}
85-
8681
const simpleEvaluators = body.selectedSimpleEvaluators.length > 0 ? JSON.parse(body.selectedSimpleEvaluators) : []
8782
if (!Array.isArray(simpleEvaluators)) {
8883
throw new Error('selectedSimpleEvaluators must be a valid array')
8984
}
9085

91-
const MAX_EVALUATORS = 1000
92-
if (simpleEvaluators.length > MAX_EVALUATORS) {
93-
throw new Error(`Cannot use more than ${MAX_EVALUATORS} simple evaluators at once`)
94-
}
95-
9686
const additionalConfig: ICommonObject = {
9787
chatflowTypes: chatflowTypes,
9888
datasetAsOneConversation: body.datasetAsOneConversation,
@@ -105,10 +95,6 @@ const createEvaluation = async (body: ICommonObject, baseURL: string, orgId: str
10595
throw new Error('selectedLLMEvaluators must be a valid array')
10696
}
10797

108-
if (lLMEvaluators.length > MAX_EVALUATORS) {
109-
throw new Error(`Cannot use more than ${MAX_EVALUATORS} LLM evaluators at once`)
110-
}
111-
11298
additionalConfig.lLMEvaluators = lLMEvaluators
11399
additionalConfig.llmConfig = {
114100
credentialId: body.credentialId,
@@ -159,11 +145,6 @@ const createEvaluation = async (body: ICommonObject, baseURL: string, orgId: str
159145
throw new Error('chatflowId must be a valid array')
160146
}
161147

162-
const MAX_CHATFLOWS_EVAL = 100
163-
if (chatflowIds.length > MAX_CHATFLOWS_EVAL) {
164-
throw new Error(`Cannot evaluate more than ${MAX_CHATFLOWS_EVAL} chatflows at once`)
165-
}
166-
167148
for (let i = 0; i < chatflowIds.length; i++) {
168149
const chatflowId = chatflowIds[i]
169150
const cFlow = await appServer.AppDataSource.getRepository(ChatFlow).findOneBy({

0 commit comments

Comments
 (0)