# Missing size validation on parsed input

Size guards that don't short-circuit, or fields with no length cap, on attacker-controlled input

_Area: Web business logic and race conditions. Seen in 3 disclosed reports; one confirmed bounty: $250; latest 2026-09-29. Updated 2026-10-24._

## How it works
A size limit only protects you if it stops work. Two assumptions break. First, a schema guard like `maxItems`/`maxLength` is assumed to reject oversized input cheaply, but if the validator is configured to collect all errors it keeps traversing the whole oversized value before reporting. Second, a field is assumed to be bounded because some sibling field or the fronting proxy is bounded, but the specific field has no cap at all. In both cases the attacker controls how much work the server does per request, and the cost is paid before any rejection.

## Where it shows up
- Validator defaults that continue after the first error (`allErrors: true` in ajv, similar collect-all modes elsewhere) combined with schemas that rely on `maxItems`/`maxLength` for protection [E1](https://bugbountylibrary.com/r/h1%3A903521.md)
- Asymmetric parse/serialize pairs: input accepted by `JSON.parse` (deep nesting) that later throws in `JSON.stringify` [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-m8vh-jmq9-5rjg.md)
- Rejections from such calls left unhandled, so a thrown error terminates the process [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-m8vh-jmq9-5rjg.md)
- User-editable template, summary or description fields on workflow/plugin APIs with no length cap, bounded only by the proxy body limit [E3](https://bugbountylibrary.com/r/h1%3A1685979.md)
- Fields rendered or processed on a later action (running a playbook) rather than at write time [E3](https://bugbountylibrary.com/r/h1%3A1685979.md)

## How to review
Identify every attacker-controlled value and ask: what is the maximum work done on it before rejection? The invariant: a size or depth guard must short-circuit, and every stored field must have an explicit cap independent of proxy limits. Check the validator configuration, not just the schema. For each parse, find the matching serialize and confirm the input domain of the parser is within what the serializer accepts. Confirm rejections are handled so they cannot crash the process. For stored fields, check the cap at write time and the cost at render time.

## Variants seen
- Framework default validator config defeats schema-level size guards [E1](https://bugbountylibrary.com/r/h1%3A903521.md)
- Deep nesting accepted by parser, crashes serializer, unhandled rejection kills process [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-m8vh-jmq9-5rjg.md)
- Uncapped stored template fields exhaust resources when the workflow runs [E3](https://bugbountylibrary.com/r/h1%3A1685979.md)

## Impact and severity
CPU exhaustion and full process termination, taking the instance down for all users [E1](https://bugbountylibrary.com/r/h1%3A903521.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-m8vh-jmq9-5rjg.md)[E3](https://bugbountylibrary.com/r/h1%3A1685979.md). Severity rises when the crash is remote and unauthenticated [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-m8vh-jmq9-5rjg.md), or when a normal low-privilege user can trigger it repeatedly [E3](https://bugbountylibrary.com/r/h1%3A1685979.md). Proxy body limits (e.g. nginx 50MB) set the ceiling but do not prevent the attack [E3](https://bugbountylibrary.com/r/h1%3A1685979.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A903521.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-m8vh-jmq9-5rjg.md
- E3: https://bugbountylibrary.com/r/h1%3A1685979.md