Add support for the concept of `fuel`. Limit execution of expressions to be constrained by this `fuel`.

Open
#975 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
go
Domain
compilers, security

Research direction

Start by tracing the expression evaluation and compilation entry points described in the issue, then review how execution cycles could be measured during both static and dynamic analysis. Define how a fuel parameter is passed and enforced, and verify that malicious expressions cannot exceed the configured execution window without breaking normal evaluation.

Written by the indexing model from the issue text.

Description

This would require some static analysis and dynamic analysis to build.
I can tackle this.

This issue is to add support for a fuel parameter when evaluating or compiling expressions. This fuel parameter can then be used to limit the execution window of an expression.

Currently expr cannot be used in outward facing code since we can't really "sanitize" expressions. So in order to prevent DOS attacks via malicious expressions, we should be able to limit the amount of cycles afforded to evaluating an expression.

Happy to tackle this if I get the go ahead that this will be accepted after it's implementation.

Dominant language
Go
Stars
8k
Forks
529
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from expr-lang/expr

All issues in expr-lang/expr

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.