Resource Exhaustion Pattern Detection

Why this rule exists

Resource exhaustion attacks rely on removing the safeguards that bound resource use. Timeouts, iteration limits, and cleanup code are the first things an attacker removes. Catching their removal stops denial-of-service attacks before deployment.

Code example

  try { await ProcessAsync(order); }
- catch (TimeoutException) { }
  // OR
- using var conn = new SqlConnection(cs);

  try { await ProcessAsync(order, TimeSpan.FromSeconds(30)); }
+ catch (TimeoutException ex) { _logger.LogError(ex); throw; }

Configuration

Disable or adjust the severity of this rule in .gauntletci.json:

{
  "rules": {
    "GCI0020": { "enabled": true, "severity": "Block" }
  }
}

See Configuration for the full schema.

Related rules