|
| 1 | +From cd59f2f12cbdfa9c06aa63e425d1fe4a806967ff Mon Sep 17 00:00:00 2001 |
| 2 | +From: Bharat Rajani <bharat.ramrajani@gmail.com> |
| 3 | +Date: Sun, 30 Jun 2024 02:04:06 +0530 |
| 4 | +Subject: [PATCH] Merge pull request from GHSA-3669-72x9-r9p3 |
| 5 | + |
| 6 | +* fixes the security advisory by limiting the slice creation based on configurable maxSize |
| 7 | + |
| 8 | +* address review comment |
| 9 | +--- |
| 10 | + decoder.go | 18 ++++++- |
| 11 | + 1 file changed, 18 insertions(+), 1 deletion(-) |
| 12 | + |
| 13 | +diff --git a/vendor/github.com/gorilla/schema/decoder.go b/vendor/github.com/gorilla/schema/decoder.go |
| 14 | +index ed85641..54c88ec 100644 |
| 15 | +--- a/vendor/github.com/gorilla/schema/decoder.go |
| 16 | ++++ b/vendor/github.com/gorilla/schema/decoder.go |
| 17 | +@@ -12,9 +12,13 @@ import ( |
| 18 | + "strings" |
| 19 | + ) |
| 20 | + |
| 21 | ++const ( |
| 22 | ++ defaultMaxSize = 16000 |
| 23 | ++) |
| 24 | ++ |
| 25 | + // NewDecoder returns a new Decoder. |
| 26 | + func NewDecoder() *Decoder { |
| 27 | +- return &Decoder{cache: newCache()} |
| 28 | ++ return &Decoder{cache: newCache(), maxSize: defaultMaxSize} |
| 29 | + } |
| 30 | + |
| 31 | + // Decoder decodes values from a map[string][]string to a struct. |
| 32 | +@@ -22,6 +26,7 @@ type Decoder struct { |
| 33 | + cache *cache |
| 34 | + zeroEmpty bool |
| 35 | + ignoreUnknownKeys bool |
| 36 | ++ maxSize int |
| 37 | + } |
| 38 | + |
| 39 | + // SetAliasTag changes the tag used to locate custom field aliases. |
| 40 | +@@ -54,6 +59,13 @@ func (d *Decoder) IgnoreUnknownKeys(i bool) { |
| 41 | + d.ignoreUnknownKeys = i |
| 42 | + } |
| 43 | + |
| 44 | ++// MaxSize limits the size of slices for URL nested arrays or object arrays. |
| 45 | ++// Choose MaxSize carefully; large values may create many zero-value slice elements. |
| 46 | ++// Example: "items.100000=apple" would create a slice with 100,000 empty strings. |
| 47 | ++func (d *Decoder) MaxSize(size int) { |
| 48 | ++ d.maxSize = size |
| 49 | ++} |
| 50 | ++ |
| 51 | + // RegisterConverter registers a converter function for a custom type. |
| 52 | + func (d *Decoder) RegisterConverter(value interface{}, converterFunc Converter) { |
| 53 | + d.cache.registerConverter(value, converterFunc) |
| 54 | +@@ -302,6 +314,10 @@ func (d *Decoder) decode(v reflect.Value, path string, parts []pathPart, values |
| 55 | + // Slice of structs. Let's go recursive. |
| 56 | + if len(parts) > 1 { |
| 57 | + idx := parts[0].index |
| 58 | ++ // a defensive check to avoid creating a large slice based on user input index |
| 59 | ++ if idx > d.maxSize { |
| 60 | ++ return fmt.Errorf("%v index %d is larger than the configured maxSize %d", v.Kind(), idx, d.maxSize) |
| 61 | ++ } |
| 62 | + if v.IsNil() || v.Len() < idx+1 { |
| 63 | + value := reflect.MakeSlice(t, idx+1, idx+1) |
| 64 | + if v.Len() < idx+1 { |
0 commit comments