Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 12, 18:15 UTC
caddyfile: Reject long heredoc markers (#6098)
Co-authored-by: Mohammed Al Sahaf <msaa1990@gmail.com>
Francis Lavoie committed
Feb 11, 2024 at 13:30 UTC
e7a534d0a311d9fa75b5981879c755281c4c9fba
4 files changed
+42
-12
caddyconfig/caddyfile/formatter.go
+5
@@ -16,6 +16,7 @@ package caddyfile
16
17
import (
18
"bytes"
19
+ "fmt"
20
"io"
21
"unicode"
22
@@ -118,6 +119,10 @@ func Format(input []byte) []byte {
119
heredoc = heredocClosed
120
} else {
121
heredocMarker = append(heredocMarker, ch)
122
+ if len(heredocMarker) > 32 {
123
+ errorString := fmt.Sprintf("heredoc marker too long: <<%s", string(heredocMarker))
124
+ panic(errorString)
125
+ }
126
write(ch)
127
continue
128
}
caddyconfig/caddyfile/formatter_test.go
+33
-12
@@ -15,6 +15,8 @@
15
package caddyfile
16
17
import (
18
+ "fmt"
19
+ "os"
20
"strings"
21
"testing"
22
)
@@ -24,6 +26,7 @@ func TestFormatter(t *testing.T) {
26
description string
27
input string
28
expect string
29
+ panics bool
30
}{
31
{
32
description: "very simple",
@@ -434,18 +437,36 @@ block2 {
437
}
438
`,
439
},
440
+ {
441
+ description: "very long heredoc from fuzzer",
442
+ input: func() string {
443
+ bs, _ := os.ReadFile("testdata/clusterfuzz-testcase-minimized-fuzz-format-5806400649363456")
444
+ return string(bs)
445
+ }(),
446
+ panics: true,
447
+ },
448
} {
438
- // the formatter should output a trailing newline,
439
- // even if the tests aren't written to expect that
440
- if !strings.HasSuffix(tc.expect, "\n") {
441
- tc.expect += "\n"
442
- }
443
-
444
- actual := Format([]byte(tc.input))
445
-
446
- if string(actual) != tc.expect {
447
- t.Errorf("\n[TEST %d: %s]\n====== EXPECTED ======\n%s\n====== ACTUAL ======\n%s^^^^^^^^^^^^^^^^^^^^^",
448
- i, tc.description, string(tc.expect), string(actual))
449
- }
449
+ t.Run(fmt.Sprintf("test case %d: %s", i, tc.description), func(t *testing.T) {
450
+ if tc.panics {
451
+ defer func() {
452
+ if r := recover(); r == nil {
453
+ t.Errorf("[TEST %d: %s] Expected panic, but got none", i, tc.description)
454
+ }
455
+ }()
456
+ }
457
+
458
+ // the formatter should output a trailing newline,
459
+ // even if the tests aren't written to expect that
460
+ if !strings.HasSuffix(tc.expect, "\n") {
461
+ tc.expect += "\n"
462
+ }
463
+
464
+ actual := Format([]byte(tc.input))
465
+
466
+ if !tc.panics && string(actual) != tc.expect {
467
+ t.Errorf("\n[TEST %d: %s]\n====== EXPECTED ======\n%s\n====== ACTUAL ======\n%s^^^^^^^^^^^^^^^^^^^^^",
468
+ i, tc.description, string(tc.expect), string(actual))
469
+ }
470
+ })
471
}
472
}
caddyconfig/caddyfile/lexer.go
+4
@@ -149,6 +149,10 @@ func (l *lexer) next() (bool, error) {
149
continue
150
}
151
152
+ if len(val) > 32 {
153
+ return false, fmt.Errorf("heredoc marker too long on line #%d: %s", l.line, string(val))
154
+ }
155
+
156
// after hitting a newline, we know that the heredoc marker
157
// is the characters after the two << and the newline.
158
// we reset the val because the heredoc is syntax we don't
caddyconfig/caddyfile/testdata/clusterfuzz-testcase-minimized-fuzz-format-5806400649363456
Binary files /dev/null and b/caddyconfig/caddyfile/testdata/clusterfuzz-testcase-minimized-fuzz-format-5806400649363456 differ