Argus.Analyses.UnboundedDynamicChildren (Panoptes v0.13.0)

Copy Markdown View Source

Processes an outside party can create without limit.

DynamicSupervisor defaults to max_children: :infinity, and the default is what everyone uses — eight DynamicSupervisors across the projects swept for this, none of which set a cap. On its own that is fine: most dynamic supervisors are driven by trusted callers.

The finding is the pairing, and it is a question about the call graph rather than about any one line: can start_child be reached from a request handler? If it can, an unauthenticated request creates a process and nothing bounds how many. Each costs a PID, a mailbox and a heap, and the node dies of memory exhaustion rather than of anything that looks like an attack.

No single line is wrong, which is why reading the supervisor or the handler alone shows nothing.