@@ -126,7 +126,7 @@ Example 2: An `O(n)` callback. This callback will run quickly for small `n` and
126126
127127``` js
128128app .get (' /countToN' , (req , res ) => {
129- let n = req .query .n ;
129+ const n = req .query .n ;
130130
131131 // n iterations before giving someone else a turn
132132 for (let i = 0 ; i < n; i++ ) {
@@ -141,7 +141,7 @@ Example 3: An `O(n^2)` callback. This callback will still run quickly for small
141141
142142``` js
143143app .get (' /countToN2' , (req , res ) => {
144- let n = req .query .n ;
144+ const n = req .query .n ;
145145
146146 // n^2 iterations before giving someone else a turn
147147 for (let i = 0 ; i < n; i++ ) {
@@ -193,7 +193,7 @@ Here is an example vulnerable regexp exposing its server to REDOS:
193193
194194``` js
195195app .get (' /redos-me' , (req , res ) => {
196- let filePath = req .query .filePath ;
196+ const filePath = req .query .filePath ;
197197
198198 // REDOS
199199 if (filePath .match (/ (\/ . + )+ $ / )) {
@@ -272,28 +272,30 @@ Example: JSON blocking. We create an object `obj` of size 2^21 and `JSON.stringi
272272
273273``` js
274274let obj = { a: 1 };
275- let niter = 20 ;
275+ const iterations = 20 ;
276276
277- let before, str, pos, res, took;
278-
279- for (let i = 0 ; i < niter; i++ ) {
280- obj = { obj1: obj, obj2: obj }; // Doubles in size each iter
277+ // Expand the object exponentially by nesting it
278+ for (let i = 0 ; i < iterations; i++ ) {
279+ obj = { obj1: obj, obj2: obj };
281280}
282281
283- before = process .hrtime ();
284- str = JSON .stringify (obj);
285- took = process .hrtime (before);
286- console .log (' JSON.stringify took ' + took);
287-
288- before = process .hrtime ();
289- pos = str .indexOf (' nomatch' );
290- took = process .hrtime (before);
291- console .log (' Pure indexof took ' + took);
292-
293- before = process .hrtime ();
294- res = JSON .parse (str);
295- took = process .hrtime (before);
296- console .log (' JSON.parse took ' + took);
282+ // Measure time to stringify the object
283+ let start = process .hrtime ();
284+ const jsonString = JSON .stringify (obj);
285+ let duration = process .hrtime (start);
286+ console .log (' JSON.stringify took' , duration);
287+
288+ // Measure time to search a string within the JSON
289+ start = process .hrtime ();
290+ const index = jsonString .indexOf (' nomatch' ); // Always -1
291+ duration = process .hrtime (start);
292+ console .log (' String.indexOf took' , duration);
293+
294+ // Measure time to parse the JSON back to an object
295+ start = process .hrtime ();
296+ const parsed = JSON .parse (jsonString);
297+ duration = process .hrtime (start);
298+ console .log (' JSON.parse took' , duration);
297299```
298300
299301There are npm modules that offer asynchronous JSON APIs. See for example:
@@ -317,7 +319,7 @@ Example 1: Un-partitioned average, costs `O(n)`
317319
318320``` js
319321for (let i = 0 ; i < n; i++ ) sum += i;
320- let avg = sum / n;
322+ const avg = sum / n;
321323console .log (' avg: ' + avg);
322324```
323325
@@ -341,7 +343,7 @@ function asyncAvg(n, avgCB) {
341343
342344 // Start the helper, with CB to call avgCB.
343345 help (1 , function (sum ) {
344- let avg = sum / n;
346+ const avg = sum / n;
345347 avgCB (avg);
346348 });
347349}
0 commit comments