Skip to content

Refactor: guard against unbounded braces parsing#9039

Open
Copilot wants to merge 2 commits intomasterfrom
copilot/refactor-braces-resource-consumption
Open

Refactor: guard against unbounded braces parsing#9039
Copilot wants to merge 2 commits intomasterfrom
copilot/refactor-braces-resource-consumption

Conversation

Copy link
Contributor

Copilot AI commented Jan 26, 2026

The braces dependency could loop on imbalanced input and exhaust memory. Updated to the patched release and aligned Jest tooling to keep the workspace consistent.

How the feature works? / How did you fix the issue?

  • Dependency refresh: regenerated lockfiles to pull the latest patched braces, eliminating the uncontrolled parse loop exposure.
  • Tooling alignment: bumped Jest-related dev dependency ranges across workspaces to match the refreshed lock context.

Example:

// packages/ketcher-core/package.json
"jest": "^27.4.5",
"ts-jest": "^27.1.2",
"babel-jest": "^27.4.5"

Check list

  • unit-tests written
  • e2e-tests written
  • documentation updated
  • PR name follows the pattern #1234 – issue name
  • branch name doesn't contain '#'
  • PR is linked with the issue
  • base branch (master or release/xx) is correct
  • task status changed to "Code review"
  • reviewers are notified about the pull request
Original prompt

This section details on the original issue you should resolve

<issue_title>Refactor: Uncontrolled resource consumption in braces</issue_title>
<issue_description>The NPM package braces fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

Update braces package to latest version without overriding, update root dependencies</issue_description>

Comments on the Issue (you are @copilot in this section)


💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Co-authored-by: AlexeyGirin <26869421+AlexeyGirin@users.noreply.github.com>
Copilot AI changed the title [WIP] Refactor uncontrolled resource consumption in braces package Refactor: guard against unbounded braces parsing Jan 26, 2026
Copilot AI requested a review from AlexeyGirin January 26, 2026 21:50
@AlexeyGirin AlexeyGirin marked this pull request as ready for review January 26, 2026 21:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Refactor: Uncontrolled resource consumption in braces

2 participants