Skip to content

Bug: Loop protection bypassed in for...of statements (Missing ForOfStatement AST target) #744

Description

@eslam0ebrahem

Description
RunJS fails to apply loop protection to for...of loops. This allows unchecked infinite loops to completely freeze the application, even when "Protect against long running loops" is enabled in Advanced Settings.

Expected Behavior
The infinite for...of loop should terminate after the threshold and throw RangeError: Potential infinite loop: exceeded 2000 iterations., mirroring the standard for loop behavior.

Actual Behavior
Loop protection is completely bypassed. The application hangs, consumes excess resources, and requires a process force-quit.

Root Cause
The application's AST parser/Babel loop-protection plugin fails to target ForOfStatement nodes. Because this node type is ignored, the loop-counting logic is never injected into the for...of block. (Note: Ensure ForInStatement is also verified).

Steps to Reproduce

  1. Ensure "Protect against long running loops" is enabled in Advanced Settings.
  2. Execute the following code, which mutates the array during iteration:
let arr = [4, 5, 3, 4, 5, 3, 4];
for (let x of arr) {
    arr.push(x);
    console.log(x);
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions