Skip to content

Conversation

@deepak0x
Copy link
Contributor

@deepak0x deepak0x commented Jan 30, 2026

This PR fixes a critical Denial of Service (DoS) vulnerability caused by a busy-wait infinite loop in handleTypingEvent, which could permanently freeze the UI or Node.js process.


What I did in thie code

  • Removed dangerous busy-wait loop

    • Eliminated while (typingHandlerLock) {} which blocked the JavaScript main thread.
  • Removed redundant manual locking logic

    • Deleted typingHandlerLock and the related setTimeout-based reset mechanism.
  • Safe sequential processing

    • Typing events now rely on the native JavaScript Event Loop, ensuring ordered and safe execution without explicit locks.
  • Resilience to internal errors

    • Even if an error occurs during event handling, the thread is immediately freed and subsequent events continue normally.

Closes #1129

Behavior Comparison

Scenario Behavior Before Fix Behavior After Fix
Internal Error during Event Permanent freeze. Lock remains held; subsequent events trigger an infinite loop, blocking UI/Node process (100% CPU). Resilient. Error is thrown/logged and execution continues; next events are processed normally.
Normal Events Prone to race conditions and deadlocks due to manual lock management. Safe and predictable. Native sequential execution preserves order without blocking.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Infinite Busy-Wait Loop in handleTypingEvent Freezes Application

1 participant