mirror of
https://github.com/gohugoio/hugo.git
synced 2026-08-24 07:18:54 +00:00
Bjørn Erik Pedersen
a3d9548469
This commit also adds validation to prevent the "Billion Laughs" attack (see https://github.com/goccy/go-yaml/issues/461). The limit of non-scalar aliases to the same node is set to 10,000. See benchmarks below. ``` │ sec/op │ UnmarshalBillionLaughs/Billion_Laughs_no_validation-10 125.2µ ± ∞ ¹ UnmarshalBillionLaughs/Billion_Laughs_with_validation-10 655.8µ ± ∞ ¹ UnmarshalBillionLaughs/YAML_Front_Matter_no_validation-10 9.223µ ± ∞ ¹ UnmarshalBillionLaughs/YAML_Front_Matter_with_validation-10 9.443µ ± ∞ ¹ geomean 51.71µ ¹ need >= 6 samples for confidence interval at level 0.95 │ fix-goyaml-8822.bench │ │ B/op │ UnmarshalBillionLaughs/Billion_Laughs_no_validation-10 177.0Ki ± ∞ ¹ UnmarshalBillionLaughs/Billion_Laughs_with_validation-10 177.0Ki ± ∞ ¹ UnmarshalBillionLaughs/YAML_Front_Matter_no_validation-10 11.67Ki ± ∞ ¹ UnmarshalBillionLaughs/YAML_Front_Matter_with_validation-10 11.67Ki ± ∞ ¹ geomean 45.45Ki ¹ need >= 6 samples for confidence interval at level 0.95 │ fix-goyaml-8822.bench │ │ allocs/op │ UnmarshalBillionLaughs/Billion_Laughs_no_validation-10 3.302k ± ∞ ¹ UnmarshalBillionLaughs/Billion_Laughs_with_validation-10 3.305k ± ∞ ¹ UnmarshalBillionLaughs/YAML_Front_Matter_no_validation-10 253.0 ± ∞ ¹ UnmarshalBillionLaughs/YAML_Front_Matter_with_validation-10 253.0 ± ∞ ¹ ```` Fixes #8822 Fixes #13043 Fixes #14053 Fixes ##8427
74 lines
1.7 KiB
Go
74 lines
1.7 KiB
Go
// Copyright 2018 The Hugo Authors. All rights reserved.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package herrors
|
|
|
|
import (
|
|
"regexp"
|
|
"strconv"
|
|
)
|
|
|
|
var lineNumberExtractors = []lineNumberExtractor{
|
|
// YAML parse errors.
|
|
newLineNumberErrHandlerFromRegexp(`\[(\d+):(\d+)\]`),
|
|
|
|
// Template/shortcode parse errors
|
|
newLineNumberErrHandlerFromRegexp(`:(\d+):(\d*):`),
|
|
newLineNumberErrHandlerFromRegexp(`:(\d+):`),
|
|
|
|
// i18n bundle errors
|
|
newLineNumberErrHandlerFromRegexp(`\((\d+),\s(\d*)`),
|
|
}
|
|
|
|
func commonLineNumberExtractor(e error) (int, int) {
|
|
for _, handler := range lineNumberExtractors {
|
|
lno, col := handler(e)
|
|
if lno > 0 {
|
|
return lno, col
|
|
}
|
|
}
|
|
return 0, 0
|
|
}
|
|
|
|
type lineNumberExtractor func(e error) (int, int)
|
|
|
|
func newLineNumberErrHandlerFromRegexp(expression string) lineNumberExtractor {
|
|
re := regexp.MustCompile(expression)
|
|
return extractLineNo(re)
|
|
}
|
|
|
|
func extractLineNo(re *regexp.Regexp) lineNumberExtractor {
|
|
return func(e error) (int, int) {
|
|
if e == nil {
|
|
panic("no error")
|
|
}
|
|
col := 1
|
|
s := e.Error()
|
|
m := re.FindStringSubmatch(s)
|
|
if len(m) >= 2 {
|
|
lno, _ := strconv.Atoi(m[1])
|
|
if len(m) > 2 {
|
|
col, _ = strconv.Atoi(m[2])
|
|
}
|
|
|
|
if col <= 0 {
|
|
col = 1
|
|
}
|
|
|
|
return lno, col
|
|
}
|
|
|
|
return 0, col
|
|
}
|
|
}
|