On Sat, 27 Jan 2001, Robin Becker wrote:
There seems to be some attempts to avoid DOS attacks by eliminating excessive resource usage. Might I point out that the first script I tried out
m=range(99) m=[m,m[:],m[:],m[:],m[:],m[:],m[:]] m=[m,m[:],m[:],m[:],m[:],m[:],m[:]] m=[m,m[:],m[:],m[:],m[:],m[:],m[:]] m=[m,m[:],m[:],m[:],m[:],m[:],m[:]] m=[m,m[:],m[:],m[:],m[:],m[:],m[:]] m=[m,m[:],m[:],m[:],m[:],m[:],m[:]] return m
seems to be taking an awful lot of my machine's resources
The saftey restraints in through the web code try to catch only the most naive programmer errors (like obvious infinite loops ie "while 1:"), *not* DOS attacks. If you are worried about that, do not give untrusted users the ability to write scripts or methods. DTML and Perl are just as susceptible to this problem. For example, all executable code is limited to a finite number of iterations, but this is trivial to defeat: <dtml-in "_.range(10000)"> <dtml-in "_.range(10000)"> <dtml-in "_.range(10000)"> ... you get the idea. Only allow trusted users to create executable content. If you feel the restraints placed on you by through the web scripts to be too much, use an external method. -Michel