io7m | single-page | multi-page | epub | Cardant User Manual 0.0.2
9.2. Security
Previous
9. Security
Up
10. Appendix: Schema: Type Package 1.0
Next

# 9.3. General

- 9.3.1. Potential Attack: API Resource Exhaustion
  - 9.3.1.1. Description
  - 9.3.1.2. Mitigation

## 9.3.1. Potential Attack: API Resource Exhaustion

## 9.3.1.1. Description

1
An attacker with access to the APIs could send specially crafted messages designed to exhaust server resources during parsing/validation of the messages.

## 9.3.1.2. Mitigation

1
All APIs exposed by the idstore server are defined using the Cedarbridge protocol. Cedarbridge-based protocols have the following properties:

### 9.3.1.2.2. Cedarbridge Properties

- Parsing and validation complexity is linear in the size of the parsed message. It is not possible to specify a message that will result in an exponentially complex parse.
- Cedarbridge protocols are very strongly-typed, operate under a closed-world assumption, and are immune to any kind of reflection-based deserialization vulnerabilities. Deserialization of messages cannot under any circumstances result in the deserialization of arbitrary objects.
- Cedarbridge protocols have a structure that is known ahead of time by both peers. Neither side gets to decide the structure of messages during communication. This is a common source of vulnerabilities in other protocols, where message types are self-describing on the wire and therefore a hostile client is able to transmit the description of a message that will cause the server to do an unbounded amount of work to parse and/or validate the message.
- Parsing code generated by the Cedarbridge compiler does not preallocate any structures. It is not possible, therefore, for a specially-crafted message to result in the server performing a huge allocation based on an attacker-provided size value. If a message claims to provide a string that is 4294967295 octets long, the parser will attempt to consume 4294967295 octets one at a time. This requires an attacker to actually provide 4294967295 octets over the network, and the attacker will run into a hard request size limit before this completes.

9.2. Security
Previous
9. Security
Up
10. Appendix: Schema: Type Package 1.0
Next
io7m | single-page | multi-page | epub | Cardant User Manual 0.0.2