Fix Unrestricted Resource Consumption in Camping

Camping is a micro-framework that stays out of your way, which is great for speed but lethal if you ignore resource bounds. Unrestricted Resource Consumption (CWE-400) occurs when an endpoint allows a client to trigger heavy CPU, memory, or disk usage without limits. In Camping, this usually manifests as uncontrolled loops, massive string allocations, or unbounded database queries based on user-supplied parameters.

The Vulnerable Pattern

module App::Controllers
  class ImageProcessor < R '/process'
    def get
      # Attacker sends ?size=1000000000
      # This triggers a massive memory allocation attempt
      size = input.size.to_i
      @buffer = "0" * size
      render :display
    end
  end
end

The Secure Implementation

The vulnerable code blindly trusts the 'size' parameter. An attacker can pass an astronomical value, forcing the Ruby heap to expand until the OOM killer terminates the process or the system swaps to death. The fix implements a 'Hard Cap' strategy. By using a constant (MAX_SIZE) and clamping the input, we ensure the application never attempts to allocate more memory than the environment can handle. Additionally, for production Camping apps, always layer this with Rack::Attack middleware to rate-limit expensive endpoints and prevent algorithmic complexity attacks.

module App::Controllers
  class ImageProcessor < R '/process'
    # Define strict upper bounds
    MAX_SIZE = 1024 * 1024 # 1MB limit
def get
  # 1. Cast to integer safely
  # 2. Use .clamp or .min to enforce boundaries
  requested_size = input.size.to_i
  size = [0, requested_size, MAX_SIZE].sort[1]

  @buffer = "0" * size
  render :display
end
end
end