DoS via for loop

[ilx]

Simple expression for i in 1..1000000000 return i * ican cause performance issue or even bring service down.
Is there a way/plan to limit memory that can be allocated via expressions?

Spring SPEL had similar issues (related to collection growth etc):

• Make maximum SpEL expression length configurable spring-projects/spring-framework#30380
• Spring-context optimization: LinkedMultiValueMap and ArrayList should be initialized with specified capacity for preventing collections from resizing [SPR-17079] spring-projects/spring-framework#21616
• Limit string concatenation in SpEL expressions spring-projects/spring-framework#30332
• Increase max regex length in SpEL expressions spring-projects/spring-framework#30265

I guess similar restrictions should apply to FEEL.

[saig0]

Thank you for raising this. Currently, we don't see a need to implement such a limit.

Some options to avoid the issue:

• Monitor the evaluation and interrupt the thread if needed (I can't interrupt an expression evaluation #823)
• Analyze the parsed expression before evaluating it

---

@ilx do you currently face this issue, or is it theoretical?
In which context do you use the FEEL engine?