Bound Resource Use

Operations that scale with input size can exhaust CPU, memory, or stack. Bound every operation that runs over user-controlled input.

If your connector uses regex for parsing or validation, avoid patterns vulnerable to catastrophic backtracking. An attacker-controlled string against a vulnerable pattern can exhaust CPU.

Do: Use simple linear-time patterns with explicit length limits.

Don’t: Use nested-quantifier patterns such as ^(a+)+$, ^(.+)+$, or unbounded repetition.

Vulnerable

Secure

If your connector handles large datasets, groupBy, orderBy, distinctBy, and nested map operations load entire payloads into memory. An attacker-controlled large payload can exhaust memory or CPU.

Do: Cap input size before non-streaming operations.

Don’t: Run groupBy or nested map over unbounded input arrays.

Vulnerable

Secure

Nested map and flatMap operations over the same array produce Cartesian-style work. With attacker-controlled input size, a quadratic transformation can exhaust CPU before the script returns.

Do: Restructure to single-pass mappings where possible. Cap input size when nesting is unavoidable.

Don’t: Use nested map, flatMap, or deep loops on unbounded input.

Vulnerable

Secure

Recursive DataWeave functions have no automatic depth limit. Attacker-controlled recursion depth can overflow the stack or exhaust CPU.

Do: Tie every recursive stop condition to input size. Cap depth explicitly.

Don’t: Call recursive functions without an explicit depth bound.

Vulnerable

Secure