15-Year-Old JavaScript Color Library Harbored Hidden Heap-Crash Bug in Two Functions

·1 views

A developer discovered a heap-exhaustion vulnerability in TinyColor2, a widely used JavaScript color library with over 5,200 GitHub stars, while porting it to Rust. The bug exists in the analogous() and monochromatic() functions, which loop indefinitely and crash the process when passed negative or fractional count arguments such as -1, 0.5, or 1.5. The flaw went undetected for roughly 15 years because a default assignment — results = results || 6 — silently catches all falsy inputs like null, NaN, and undefined, making the functions appear safe during casual testing. Only specific truthy invalid values bypass this default and trigger infinite loops that exhaust available memory with exit code 134. The reporter proposed input validation guards similar to those already present in the library's polyad() function, which correctly rejects non-integer or out-of-range arguments.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Prevent Duplicate SMS Password-Reset Alerts Under Timeout and Retry Conditions

Duplicate SMS password-reset notifications can occur when developers treat a timed-out request as a failed send and immediately retry, rather than as an unknown outcome. A robust approach requires persisting an idempotency key and expiry before dispatch, then delegating retries to a background worker that can reconcile the original attempt's status. Status polling and retry logic must be kept strictly separate, as combining them in a single function is a common source of duplicate messages. Every dispatch attempt should also check the current time against the token's expiry, halting sends once delivery would no longer be meaningful. The guiding contract is to admit each password-reset notification exactly once, retain evidence of every state transition, and never allow callers to trigger new work simply by querying the current status.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Rails Routing Explained: How URLs Map to Controllers in RESTful APIs

A developer revisited Rails routing fundamentals after realizing they could build APIs but struggled to explain the underlying mechanics. Rails uses a routes.rb file to connect incoming HTTP requests to specific controller actions, with the 'resources' helper auto-generating standard CRUD routes. Key distinctions include 'resource' versus 'resources', and the 'member' versus 'collection' blocks for non-standard actions on single or multiple records respectively. Nested resources help express relationships between models in URLs, though deep nesting is discouraged for maintainability. Namespacing, such as '/api/v1/', keeps API controllers logically separated from regular web controllers within the application.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Photo Essay Captures Isolated Workers Living at the Edge of Patagonia

A New Yorker photo essay documents the lives of men who live and work in the remote reaches of Patagonia, one of the world's most isolated regions. The piece explores themes of solitude and the unique human experience of inhabiting such an extreme environment. Published in the magazine's culture and photo section, the essay uses imagery to convey the emotional and physical isolation of these workers. The feature has drawn attention on Hacker News, sparking discussion about life at the margins of the inhabited world.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

How to Integrate Claude or GPT into a Python App: A Developer Guide

A technical guide published on DEV Community explains how to integrate large language models (LLMs) such as Anthropic's Claude, OpenAI's GPT, and Google's Gemini into Python applications. All three providers offer official Python SDKs and HTTP APIs that follow a similar pattern: sending a list of messages and receiving a generated response. The guide covers key implementation topics including streaming output token by token, requesting structured JSON responses to avoid parsing errors, and managing API costs through token limits and prompt caching. Developers are advised to store API keys in environment variables rather than hardcoding them, and to handle errors using typed exceptions since official SDKs automatically retry rate-limit and server errors. The article recommends choosing model size based on task complexity, using larger models for reasoning and smaller ones for high-volume classification.

0 comments Read more at DEV Community