㊙️ Security update

- Parser bounds: Added Math.min() caps on all loop counts: offers (1000), products (200), front page items (100), localization images/texts (100), node children (500)

- Recursion depth limit: Added static depth counter to NodeData with max depth of 20 to prevent stack overflow from deeply nested catalog trees

packages/communication/src/messages/parser/catalog/CatalogLocalizationData.ts

@@ -10,7 +10,7 @@ export class CatalogLocalizationData
         this._images = [];
         this._texts = [];
 
-        let totalImages = wrapper.readInt();
+        let totalImages = Math.min(wrapper.readInt(), 100);
 
         while(totalImages > 0)
         {
@@ -19,7 +19,7 @@ export class CatalogLocalizationData
             totalImages--;
         }
 
-        let totalTexts = wrapper.readInt();
+        let totalTexts = Math.min(wrapper.readInt(), 100);
 
         while(totalTexts > 0)
         {

packages/communication/src/messages/parser/catalog/CatalogPageMessageOfferData.ts

@@ -28,7 +28,7 @@ export class CatalogPageMessageOfferData
 
         this._products = [];
 
-        let totalProducts = wrapper.readInt();
+        let totalProducts = Math.min(wrapper.readInt(), 200);
 
         while(totalProducts > 0)
         {

packages/communication/src/messages/parser/catalog/CatalogPageMessageParser.ts

@@ -37,7 +37,7 @@ export class CatalogPageMessageParser implements IMessageParser
         this._layoutCode = wrapper.readString();
         this._localization = new CatalogLocalizationData(wrapper);
 
-        let totalOffers = wrapper.readInt();
+        let totalOffers = Math.min(wrapper.readInt(), 1000);
 
         while(totalOffers > 0)
         {
@@ -51,7 +51,7 @@ export class CatalogPageMessageParser implements IMessageParser
 
         if(wrapper.bytesAvailable)
         {
-            let totalFrontPageItems = wrapper.readInt();
+            let totalFrontPageItems = Math.min(wrapper.readInt(), 100);
 
             while(totalFrontPageItems > 0)
             {

packages/communication/src/messages/parser/catalog/NodeData.ts

@@ -31,6 +31,11 @@ export class NodeData
         return true;
     }
 
+    private static readonly MAX_OFFERS: number = 1000;
+    private static readonly MAX_CHILDREN: number = 500;
+    private static _parseDepth: number = 0;
+    private static readonly MAX_DEPTH: number = 20;
+
     public parse(wrapper: IMessageDataWrapper): boolean
     {
         if(!wrapper) return false;
@@ -41,7 +46,7 @@ export class NodeData
         this._pageName = wrapper.readString();
         this._localization = wrapper.readString();
 
-        let totalOffers = wrapper.readInt();
+        let totalOffers = Math.min(wrapper.readInt(), NodeData.MAX_OFFERS);
 
         while(totalOffers > 0)
         {
@@ -50,7 +55,15 @@ export class NodeData
             totalOffers--;
         }
 
-        let totalChildren = wrapper.readInt();
+        let totalChildren = Math.min(wrapper.readInt(), NodeData.MAX_CHILDREN);
+
+        NodeData._parseDepth++;
+
+        if(NodeData._parseDepth > NodeData.MAX_DEPTH)
+        {
+            NodeData._parseDepth--;
+            return true;
+        }
 
         while(totalChildren > 0)
         {
@@ -59,6 +72,8 @@ export class NodeData
             totalChildren--;
         }
 
+        NodeData._parseDepth--;
+
         return true;
     }