feat(decoder): expose the maximum nesting depth as a configuration option - #77
Merged
Merged
Conversation
…tion
spomky-labs/cbor-php 3.3.3 bounds how deeply nested a decoded data item may be,
so that a small payload of nested arrays can no longer build an object graph deep
enough to crash the process when it is released. That bound is now reachable from
the bundle configuration:
cbor:
max_depth: 1000 # CBOR\Decoder::DEFAULT_MAX_DEPTH
The value is passed to the Decoder service as its $maxDepth argument, while the
tag and other object managers keep being autowired. A much lower value is worth
setting when the decoded data comes from an untrusted source.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Targets the new
3.1.xbranch, cut from3.0.x: this adds a feature, so it does not belong on a patch branch.What
spomky-labs/cbor-php3.3.3 bounds how deeply nested a decoded data item may be — without it, a payload of a few dozen kilobytes made only of nested arrays builds an object graph deep enough to segfault the process when it is released, afterdecode()has already returned. The bundle now exposes that bound:A much lower value is worth setting when the decoded data comes from an untrusted source:
How
The bundle had no configuration at all —
getConfiguration()returnednull. It now returns aConfigurationwith a singlemax_depthinteger node (defaultDecoder::DEFAULT_MAX_DEPTH, minimum 1,info()filled in forconfig:dump-reference). The value lands in thecbor.max_depthcontainer parameter and is passed to theDecoderservice as its$maxDepthargument; the tag and other object managers keep being autowired, so nothing else about the service changes.spomky-labs/cbor-phpmoves from^3.0to^3.3.3, the release that introducesDecoder::DEFAULT_MAX_DEPTH.The PHPStan baseline is regenerated: narrowing
getConfiguration()to a non-nullable return type removes one of its entries.Tests
tests/Functional/MaxDepthTest.phpboots the test kernel withmax_depth: 64and checks the parameter value, that 64 levels decode, and that 65 are rejected with the exact message. Full suite: 32 tests, 35 assertions.Verified locally in
ghcr.io/spomky-labs/phpqa:8.4: PHPStan, ECS, Rector, parallel-lint, Deptrac, licenses, PHPUnit and Infection all pass.