1
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2024-12-16 21:56:40 -05:00

caddyfile: Reject long heredoc markers (#6098)

Co-authored-by: Mohammed Al Sahaf <msaa1990@gmail.com>
This commit is contained in:
Francis Lavoie 2024-02-11 13:30:14 -05:00 committed by GitHub
parent c78ebb3d6a
commit e7a534d0a3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 40 additions and 10 deletions

View file

@ -16,6 +16,7 @@ package caddyfile
import ( import (
"bytes" "bytes"
"fmt"
"io" "io"
"unicode" "unicode"
@ -118,6 +119,10 @@ func Format(input []byte) []byte {
heredoc = heredocClosed heredoc = heredocClosed
} else { } else {
heredocMarker = append(heredocMarker, ch) heredocMarker = append(heredocMarker, ch)
if len(heredocMarker) > 32 {
errorString := fmt.Sprintf("heredoc marker too long: <<%s", string(heredocMarker))
panic(errorString)
}
write(ch) write(ch)
continue continue
} }

View file

@ -15,6 +15,8 @@
package caddyfile package caddyfile
import ( import (
"fmt"
"os"
"strings" "strings"
"testing" "testing"
) )
@ -24,6 +26,7 @@ func TestFormatter(t *testing.T) {
description string description string
input string input string
expect string expect string
panics bool
}{ }{
{ {
description: "very simple", description: "very simple",
@ -434,7 +437,24 @@ block2 {
} }
`, `,
}, },
{
description: "very long heredoc from fuzzer",
input: func() string {
bs, _ := os.ReadFile("testdata/clusterfuzz-testcase-minimized-fuzz-format-5806400649363456")
return string(bs)
}(),
panics: true,
},
} { } {
t.Run(fmt.Sprintf("test case %d: %s", i, tc.description), func(t *testing.T) {
if tc.panics {
defer func() {
if r := recover(); r == nil {
t.Errorf("[TEST %d: %s] Expected panic, but got none", i, tc.description)
}
}()
}
// the formatter should output a trailing newline, // the formatter should output a trailing newline,
// even if the tests aren't written to expect that // even if the tests aren't written to expect that
if !strings.HasSuffix(tc.expect, "\n") { if !strings.HasSuffix(tc.expect, "\n") {
@ -443,9 +463,10 @@ block2 {
actual := Format([]byte(tc.input)) actual := Format([]byte(tc.input))
if string(actual) != tc.expect { if !tc.panics && string(actual) != tc.expect {
t.Errorf("\n[TEST %d: %s]\n====== EXPECTED ======\n%s\n====== ACTUAL ======\n%s^^^^^^^^^^^^^^^^^^^^^", t.Errorf("\n[TEST %d: %s]\n====== EXPECTED ======\n%s\n====== ACTUAL ======\n%s^^^^^^^^^^^^^^^^^^^^^",
i, tc.description, string(tc.expect), string(actual)) i, tc.description, string(tc.expect), string(actual))
} }
})
} }
} }

View file

@ -149,6 +149,10 @@ func (l *lexer) next() (bool, error) {
continue continue
} }
if len(val) > 32 {
return false, fmt.Errorf("heredoc marker too long on line #%d: %s", l.line, string(val))
}
// after hitting a newline, we know that the heredoc marker // after hitting a newline, we know that the heredoc marker
// is the characters after the two << and the newline. // is the characters after the two << and the newline.
// we reset the val because the heredoc is syntax we don't // we reset the val because the heredoc is syntax we don't