|
| 1 | +From 434eadcdbc3b0256971992e8c70027278364c72c Mon Sep 17 00:00:00 2001 |
| 2 | +From: Roland Shoemaker <bracewell@google.com> |
| 3 | +Date: Fri, 2 Sep 2022 09:35:37 -0700 |
| 4 | +Subject: [PATCH] language: reject excessively large Accept-Language strings |
| 5 | + |
| 6 | +The BCP 47 tag parser has quadratic time complexity due to inherent |
| 7 | +aspects of its design. Since the parser is, by design, exposed to |
| 8 | +untrusted user input, this can be leveraged to force a program to |
| 9 | +consume significant time parsing Accept-Language headers. |
| 10 | + |
| 11 | +The parser cannot be easily rewritten to fix this behavior for |
| 12 | +various reasons. Instead the solution implemented in this CL is to |
| 13 | +limit the total complexity of tags passed into ParseAcceptLanguage |
| 14 | +by limiting the number of dashes in the string to 1000. This should |
| 15 | +be more than enough for the majority of real world use cases, where |
| 16 | +the number of tags being sent is likely to be in the single digits. |
| 17 | + |
| 18 | +Thanks to the OSS-Fuzz project for discovering this issue and to Adam |
| 19 | +Korczynski (ADA Logics) for writing the fuzz case and for reporting the |
| 20 | +issue. |
| 21 | + |
| 22 | +Fixes CVE-2022-32149 |
| 23 | +Fixes golang/go#56152 |
| 24 | + |
| 25 | +Change-Id: I7bda1d84cee2b945039c203f26869d58ee9374ae |
| 26 | +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1565112 |
| 27 | +Reviewed-by: Damien Neil <dneil@google.com> |
| 28 | +Reviewed-by: Tatiana Bradley <tatianabradley@google.com> |
| 29 | +Reviewed-on: https://go-review.googlesource.com/c/text/+/442235 |
| 30 | +TryBot-Result: Gopher Robot <gobot@golang.org> |
| 31 | +Auto-Submit: Roland Shoemaker <roland@golang.org> |
| 32 | +Run-TryBot: Roland Shoemaker <roland@golang.org> |
| 33 | + |
| 34 | +Modified to apply to vendored code by: Jiri Appl <jiria@microsoft.com> |
| 35 | + - Adjusted paths |
| 36 | + - Removed reference to parse_test.go |
| 37 | +--- |
| 38 | + vendor/golang.org/x/text/language/parse.go | 5 +++++ |
| 39 | + 1 files changed, 18 insertions(+) |
| 40 | + |
| 41 | +diff --git a/vendor/golang.org/x/text/language/parse.go b/vendor/golang.org/x/text/language/parse.go |
| 42 | +index 59b0410..b982d9e 100644 |
| 43 | +--- a/vendor/golang.org/x/text/language/parse.go |
| 44 | ++++ b/vendor/golang.org/x/text/language/parse.go |
| 45 | +@@ -147,6 +147,7 @@ func update(b *language.Builder, part ...interface{}) (err error) { |
| 46 | + } |
| 47 | + |
| 48 | + var errInvalidWeight = errors.New("ParseAcceptLanguage: invalid weight") |
| 49 | ++var errTagListTooLarge = errors.New("tag list exceeds max length") |
| 50 | + |
| 51 | + // ParseAcceptLanguage parses the contents of an Accept-Language header as |
| 52 | + // defined in http://www.ietf.org/rfc/rfc2616.txt and returns a list of Tags and |
| 53 | +@@ -164,6 +165,10 @@ func ParseAcceptLanguage(s string) (tag []Tag, q []float32, err error) { |
| 54 | + } |
| 55 | + }() |
| 56 | + |
| 57 | ++ if strings.Count(s, "-") > 1000 { |
| 58 | ++ return nil, nil, errTagListTooLarge |
| 59 | ++ } |
| 60 | ++ |
| 61 | + var entry string |
| 62 | + for s != "" { |
| 63 | + if entry, s = split(s, ','); entry == "" { |
| 64 | +-- |
| 65 | +2.34.1 |
| 66 | + |
0 commit comments