Security Advisory: Event-loop denial of service in SourceNode via unvalidated section offset line #76

Summary

Description

An indexed source map ({ "sections": [...] }) carries a per-section offset.line. When such a
consumer is fed to SourceNode.fromStringWithSourceMap, the section offset is applied by a
line-padding loop in source-node.js that pushes one newline per line up to the mapping's generated
line. offset.line is never validated to be a bounded, non-negative integer against the actual
generated content. A crafted offset.line of 1e999 (which JSON.parse yields as Infinity), or a
merely very large finite value, forces this loop to run for an attacker-chosen number of iterations.
A large finite value blocks the Node event loop for that entire duration (a synchronous freeze); an
Infinity value drives the internal array length past the engine's limit and throws
RangeError: Invalid array length. The attacker converts a tiny indexed-map document into a
process-level stall or crash of any service that re-emits the map.

Impact

A service that re-emits untrusted indexed source maps (bundler merge step, symbolication worker)
freezes its event loop for an attacker-chosen duration or crashes with an uncatchable-in-place array
error. On a shared multi-tenant symbolication or build service, one crafted map denies service to the
other tenants whose work that process also serves.

Remediation

Recommended Fix

Validate offset.line and offset.column at section-intake time: require finite, non-negative
integers within a sane bound relative to the generated content, and throw a typed error otherwise.
Independently, cap or guard the line-padding loop in source-node.js so it cannot iterate beyond the
real generated-line count.

Workaround

Run re-emit in a child process with a wall-clock timeout and restart policy; reject indexed maps whose
sections[].offset.line is non-integer or exceeds a small bound.

References

• CWE-1287: https://cwe.mitre.org/data/definitions/1287.html
• CWE-835: https://cwe.mitre.org/data/definitions/835.html
• Affected source: lib/source-node.js:112-118, indexed-map section intake in lib/source-map-consumer.js (source-map-js 1.2.1)