Skip to content

Conversation

@Ayoub-Mabrouk
Copy link
Contributor

@Ayoub-Mabrouk Ayoub-Mabrouk commented Oct 29, 2025

The previous implementation used body.split('&') which always processed the entire request body and allocated a full array, regardless of the parameter limit.

The new implementation:

  • Counts '&' characters iteratively without array allocation
  • Exits immediately when the limit is reached
  • Reduces time complexity from O(n) worst-case always to O(min(n, limit))
  • Added test case to verify empty body handling with parameterLimit option.

This particularly improves resilience against malicious requests with thousands of parameters attempting to exhaust server resources.

…iency

The previous implementation used �ody.split('&') which always
processed the entire request body and allocated a full array,
regardless of the parameter limit.

The new implementation:
- Counts '&' characters iteratively without array allocation
- Exits immediately when the limit is reached
- Handles edge case of empty/null body
- Reduces time complexity from O(n) worst-case always to O(min(n, limit))

This particularly improves resilience against malicious requests
with thousands of parameters attempting to exhaust server resources
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant