Skip to content

fix(security): guard EPG XML importer against oversized text nodes #602

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Bladestar2105 wants to merge 1 commit into from
Closed

fix(security): guard EPG XML importer against oversized text nodes #602

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion src/services/epgService.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,7 @@ export async function importEpgFromUrl(url, sourceType, sourceId) {

// Implement node-xml-stream for robust streaming XML parsing
const parser = new XmlStream();
const MAX_XML_TEXT_NODE_LENGTH = 50 * 1024; // 50KB safeguard against unbounded text growth

let currentTag = null;
let currentChannel = null;
Expand Down Expand Up @@ -163,7 +164,14 @@ export async function importEpgFromUrl(url, sourceType, sourceId) {
});

const appendText = (text) => {
if (currentChannel && currentTag === 'display-name') {
if (currentText.length + text.length > MAX_XML_TEXT_NODE_LENGTH) {

@chatgpt-codex-connector chatgpt-codex-connector Bot May 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Apply text-size cap only to tracked XML node content

The new guard runs before checking whether we are inside display-name, title, or desc, so it uses stale currentText from a previous tracked node when handling later text events. This causes false rejections: a title just under 50KB can still fail when a subsequent non-tracked text node (for example <category>) is parsed, because the condition compares that new text against the previous node’s accumulated length. Move the size check inside the same branches that append to currentText (or reset currentText on every text-bearing tag) so the cap is truly per-node.

Useful? React with 👍 / 👎.

reject(new Error(`EPG XML text node exceeds ${MAX_XML_TEXT_NODE_LENGTH} bytes limit`));
stream.destroy();
parser.end();
return;
}

if (currentChannel && currentTag === 'display-name') {
currentText += text;
} else if (currentProgram && (currentTag === 'title' || currentTag === 'desc')) {
currentText += text;
Expand Down
Loading