Skip to content

fix: Bound async state serialization so a blocked thread can't freeze or crash - #45

Open
timfish wants to merge 2 commits into
mainfrom
tim/great-archimedes-ljd0xb
Open

timfish wants to merge 2 commits into
mainfrom
tim/great-archimedes-ljd0xb

Conversation

@timfish

@timfish timfish commented Oct 12, 2026

Copy link
Copy Markdown
Collaborator

SanitizeForJSON walked the AsyncLocalStorage state without any limits while the captured thread was interrupted. Shared references were copied once per path, linked structures (e.g. Node timer lists reachable from a Sentry client) recursed once per node with an O(depth) cycle check, and exceptions from the walk escaped into the interrupted JavaScript.

  • Limit depth (10), entries per container (1000), values read (20000) and string length (1 MiB); cut data is replaced by visible markers
  • Copy own enumerable string keys only, into null-prototype containers so inherited toJSON hooks can't bypass the limits
  • Replace Proxies by "[Proxy]" without running traps
  • Catch exceptions during state serialization and keep V8 execution termination

johannespinger and others added 2 commits October 8, 2026 14:50
… or crash

SanitizeForJSON walked the AsyncLocalStorage state without any limits while the captured thread was interrupted. Shared references were copied once per path, linked structures (e.g. Node timer lists reachable from a Sentry client) recursed once per node with an O(depth) cycle check, and exceptions from the walk escaped into the interrupted JavaScript.

- Limit depth (10), entries per container (1000), values read (20000) and string length (1 MiB); cut data is replaced by visible markers
- Copy own enumerable string keys only, into null-prototype containers so inherited toJSON hooks can't bypass the limits
- Replace Proxies by "[Proxy]" without running traps
- Catch exceptions during state serialization and keep V8 execution termination
Node 18 on macOS reports resourceUsage().maxRSS in bytes, so the RSS growth check read about 14 MB as 14 GB.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants