| tiêu đề | grass 0.13.4 Asymmetric Resource Consumption |
|---|
| Mô tả | Grass is a pure-Rust Sass-to-CSS compiler.
`grass` implements Sass's nested parent-selector (`&`) and combinator (`+`, `~`, `>`) semantics. When evaluating rulesets that combine multiple parent-selector references inside child blocks separated by adjacent-sibling
or general-sibling combinators, the resolver in `grass_compiler::selector::extend` and `grass_compiler::evaluate::visitor` recursively materializes the cross-product of every (parent × child) combinator combination.
For adversarial nesting patterns this materialization is super-linear in the number of `&` and combinator tokens, and the per-step Vec allocation overhead is non-trivial. An 85-byte SCSS source is sufficient to drive
grass to allocate ~2.5 GiB of memory and spend ~8 seconds of CPU on a single compilation, against a Sass spec where compile time should be linear in input size.
The compiler does eventually return `Ok(_)`, but the memory and CPU footprint makes any service that compiles untrusted SCSS trivially DoS-able with sub-100-byte payloads. |
|---|
| Nguồn | ⚠️ https://github.com/connorskees/grass/issues/117 |
|---|
| Người dùng | Zyz3366 (UID 97230) |
|---|
| Đệ trình | 03/06/2026 04:42 (cách đây 1 tháng) |
|---|
| Kiểm duyệt | 03/07/2026 20:40 (1 month later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 376164 [connorskees grass đến 0.13.4 visitor Từ chối dịch vụ] |
|---|
| điểm | 20 |
|---|