Reject absurdly long duration strings (fix #4175)

Matthew Holt committed Sep 15, 2022 at 14:25 UTC f1f7a2267460c5ed456153a4a04d864fb7865c56

1 file changed +5 -1

caddy.go

+5 -1

@@ -763,8 +763,12 @@ func (d *Duration) UnmarshalJSON(b []byte) error {

763

764 // ParseDuration parses a duration string, adding

765 // support for the "d" unit meaning number of days,

766 -// where a day is assumed to be 24h.

766 +// where a day is assumed to be 24h. The maximum

767 +// input string length is 1024.

768 func ParseDuration(s string) (time.Duration, error) {

769 + if len(s) > 1024 {

770 + return 0, fmt.Errorf("parsing duration: input string too long")

771 + }

772 var inNumber bool

773 var numStart int

774 for i := 0; i < len(s); i++ {