mirror of
https://github.com/Kong/insomnia.git
synced 2026-08-02 10:49:11 -04:00
d3eb7daf0b
The export manifest reports request/response hooks as a count, and the host
builds Array.from({ length: count }) of throw-stubs. A hostile plugin could
export a non-array with a huge `.length` (e.g. { length: 1e12 }) so the count
crosses to the host and drives an enormous allocation — even though the plugin
only ran in the sandbox.
Coerce the count to a finite, non-negative integer capped at 1000 inside the
sandbox (__describeExports), and clamp again host-side before Array.from as
defense in depth. Unit test covers a fake huge-length hooks export.