Once the slices parameter feature is used, the website will be suffering from DoS attack.

When we need to get a slice parameter, we may use the following code snippet in our controller.

func (c App) DoS1(name []string) revel.Result {
	return c.RenderText(fmt.Sprint(name))
}

func (c App) DoS2() revel.Result {
	var name []string
	c.Params.Bind(&name, "name")
	return c.RenderText(fmt.Sprint(name))
}

It looks like everything is OK. However, we can exhaust the server's MEM with only one request.
e.g., when simply visit http://localhost:9000/dos1?name[1234567890]=1, the server's CPU and memory usage will soar, and the OOM killer will be triggered eventually.

This vulnerability was caused by the following code:

When the function above is invoked, Revel will calc the maxIndex from user's input, and thus the attacker could make the maxIndex as large as possible. When reflect.MakeSlice is called, Golang will alloc a large memory as the maxIndex needed.

A possible solution for this vuln is to specify the upper bound of the maxIndex in the code or config file.

Before the problem is fixed, plz avoid using the slices parameter feature.