Security: Fix loop bound injection (CodeQL #2)

[jmaddington]

Description

A loop bound injection vulnerability has been detected in the application.

Location

• File: lib/google_image_charts.js
• Line: 111

Issue

The application iterates over an object using a .length property that could be controlled by a user. If an attacker provides an object with a very large length value, the loop will attempt to run for an extremely large number of iterations, potentially causing the application to hang or run out of memory.

Recommendation

To fix this issue:

1. Verify that the object is an array using Array.isArray() before iterating
2. Enforce a maximum limit on the number of iterations
3. Use array methods like forEach, map, or filter that are safer for arrays
4. Validate and sanitize user input before using it in a loop

References

• CWE-834: Excessive Iteration
• CWE-730: Improper Validation of Array Index