fix: add hard limit on deref depth to prevent crashes

Redocly · Sep 6, 2022 · ddde105 · ddde105
1 parent bb325d0
commit ddde105
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/src/services/OpenAPIParser.ts b/src/services/OpenAPIParser.ts
@@ -5,6 +5,8 @@ import { JsonPointer } from '../utils/JsonPointer';
 import { RedocNormalizedOptions } from './RedocNormalizedOptions';
 import type { MergedOpenAPISchema } from './types';
 
+const MAX_DEREF_DEPTH = 999; // prevent circular detection crashes by adding hard limit on deref depth
+
 /**
  * Loads and keeps spec. Provides raw spec operations
  */
@@ -103,7 +105,7 @@ export class OpenAPIParser {
       }
 
       let refsStack = baseRefsStack;
-      if (baseRefsStack.includes(obj.$ref)) {
+      if (baseRefsStack.includes(obj.$ref) || baseRefsStack.length > MAX_DEREF_DEPTH) {
         resolved = Object.assign({}, resolved, { 'x-circular-ref': true });
       } else if (this.isRef(resolved)) {
         const res = this.deref(resolved, baseRefsStack, mergeAsAllOf);