Merge pull request #346 from vdemeester/use-patched-yaml-package

Vincent Demeester · web-flow · commit 2f34b47b3af0 · 2018-08-14T14:50:09.000+02:00
Make docker/app not exposed to yaml bomb
diff --git a/Gopkg.lock b/Gopkg.lock
diff --git a/Gopkg.toml b/Gopkg.toml
@@ -73,6 +73,13 @@ required = ["github.com/wadey/gocovmerge"]
   name = "google.golang.org/grpc"
   revision = "v1.3.0"
 
+# This is using a fork waiting for go-yaml/yaml#375 to be merged
+# This PR allows to set a max decoded value, thus not being exposed to yaml bombs
+[[override]]
+  name = "gopkg.in/yaml.v2"
+  source = "https://github.com/simonferquel/yaml"
+  revision="c86e64ed9581b7588e736f0c3e6ecc02cc22996e"
+
 [[constraint]]
   name = "github.com/spf13/pflag"
   branch = "master"
diff --git a/cmd/docker-app/render.go b/cmd/docker-app/render.go
@@ -6,13 +6,13 @@ import (
 
 	"github.com/docker/app/internal"
 	"github.com/docker/app/internal/packager"
+	"github.com/docker/app/internal/yaml"
 	"github.com/docker/app/render"
 	"github.com/docker/app/types"
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
 	cliopts "github.com/docker/cli/opts"
 	"github.com/spf13/cobra"
-	"gopkg.in/yaml.v2"
 )
 
 var (
diff --git a/e2e/render_test.go b/e2e/render_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"gopkg.in/yaml.v2"
+	"github.com/docker/app/internal/yaml"
 	"gotest.tools/assert"
 )
 
diff --git a/internal/helm/helm.go b/internal/helm/helm.go
@@ -15,6 +15,7 @@ import (
 	"github.com/docker/app/internal/helm/templatev1beta2"
 	"github.com/docker/app/internal/settings"
 	"github.com/docker/app/internal/slices"
+	"github.com/docker/app/internal/yaml"
 	"github.com/docker/app/render"
 	"github.com/docker/app/types"
 	"github.com/docker/app/types/metadata"
@@ -23,7 +24,6 @@ import (
 	"github.com/docker/cli/kubernetes/compose/v1beta1"
 	"github.com/docker/cli/kubernetes/compose/v1beta2"
 	"github.com/pkg/errors"
-	yaml "gopkg.in/yaml.v2"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
diff --git a/internal/inspect/inspect.go b/internal/inspect/inspect.go
@@ -7,10 +7,10 @@ import (
 	"text/tabwriter"
 
 	"github.com/docker/app/internal/settings"
+	"github.com/docker/app/internal/yaml"
 	"github.com/docker/app/types"
 	"github.com/docker/app/types/metadata"
 	"github.com/pkg/errors"
-	yaml "gopkg.in/yaml.v2"
 )
 
 // Inspect dumps the metadata of an app
diff --git a/internal/packager/fork.go b/internal/packager/fork.go
@@ -9,10 +9,10 @@ import (
 	"strings"
 
 	"github.com/docker/app/internal"
+	"github.com/docker/app/internal/yaml"
 	"github.com/docker/app/types/metadata"
 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
-	yaml "gopkg.in/yaml.v2"
 )
 
 // Fork pulls an application and creates a local fork for the user to modify
diff --git a/internal/packager/init.go b/internal/packager/init.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/docker/app/internal"
 	"github.com/docker/app/internal/compose"
+	"github.com/docker/app/internal/yaml"
 	"github.com/docker/app/loader"
 	"github.com/docker/app/render"
 	"github.com/docker/app/types"
@@ -22,7 +23,6 @@ import (
 	"github.com/docker/cli/opts"
 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
-	"gopkg.in/yaml.v2"
 )
 
 func prependToFile(filename, text string) error {
diff --git a/internal/packager/registry.go b/internal/packager/registry.go
@@ -12,11 +12,11 @@ import (
 	"strings"
 
 	"github.com/docker/app/internal"
+	"github.com/docker/app/internal/yaml"
 	"github.com/docker/app/types"
 	"github.com/docker/app/types/metadata"
 	"github.com/docker/distribution/reference"
 	"github.com/pkg/errors"
-	yaml "gopkg.in/yaml.v2"
 )
 
 // Save saves an app to docker and returns the image name.
diff --git a/internal/renderer/yatee/driver.go b/internal/renderer/yatee/driver.go
@@ -6,9 +6,9 @@ import (
 	"strings"
 
 	"github.com/docker/app/internal/renderer"
+	"github.com/docker/app/internal/yaml"
 	"github.com/docker/app/internal/yatee"
 	"github.com/pkg/errors"
-	yaml "gopkg.in/yaml.v2"
 )
 
 func init() {
diff --git a/internal/settings/load.go b/internal/settings/load.go
@@ -6,8 +6,8 @@ import (
 	"io"
 	"io/ioutil"
 
+	"github.com/docker/app/internal/yaml"
 	"github.com/pkg/errors"
-	yaml "gopkg.in/yaml.v2"
 )
 
 // Load loads the given data in settings
diff --git a/internal/settings/settings.go b/internal/settings/settings.go
@@ -6,8 +6,8 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/docker/app/internal/yaml"
 	"github.com/pkg/errors"
-	yaml "gopkg.in/yaml.v2"
 )
 
 // Settings represents a settings map
diff --git a/internal/yaml/yaml.go b/internal/yaml/yaml.go
@@ -0,0 +1,41 @@
+package yaml
+
+import (
+	"bytes"
+	"io"
+
+	"gopkg.in/yaml.v2"
+)
+
+const (
+	maxDecodedValues = 1000000
+)
+
+// Unmarshal decodes the first document found within the in byte slice
+// and assigns decoded values into the out value.
+//
+// See gopkg.in/yaml.v2 documentation
+func Unmarshal(in []byte, out interface{}) error {
+	d := yaml.NewDecoder(bytes.NewBuffer(in), yaml.WithLimitDecodedValuesCount(maxDecodedValues))
+	err := d.Decode(out)
+	if err == io.EOF {
+		return nil
+	}
+	return err
+}
+
+// Marshal serializes the value provided into a YAML document. The structure
+// of the generated document will reflect the structure of the value itself.
+// Maps and pointers (to struct, string, int, etc) are accepted as the in value.
+//
+// See gopkg.in/yaml.v2 documentation
+func Marshal(in interface{}) ([]byte, error) {
+	return yaml.Marshal(in)
+}
+
+// NewDecoder returns a new decoder that reads from r.
+//
+// See gopkg.in/yaml.v2 documentation
+func NewDecoder(r io.Reader) *yaml.Decoder {
+	return yaml.NewDecoder(r, yaml.WithLimitDecodedValuesCount(maxDecodedValues))
+}
diff --git a/internal/yaml/yaml_test.go b/internal/yaml/yaml_test.go
@@ -0,0 +1,41 @@
+package yaml
+
+import (
+	"bytes"
+	"testing"
+
+	"gotest.tools/assert"
+)
+
+func TestDecoderYamlBomb(t *testing.T) {
+	var v map[interface{}]interface{}
+	data := []byte(`version: "3"
+services: &services ["lol","lol","lol","lol","lol","lol","lol","lol","lol"]
+b: &b [*services,*services,*services,*services,*services,*services,*services,*services,*services]
+c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b]
+d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c]
+e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d]
+f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e]
+g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f]
+h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g]
+i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h]`)
+	d := NewDecoder(bytes.NewBuffer(data))
+	err := d.Decode(&v)
+	assert.ErrorContains(t, err, "yaml: exceeded max number of decoded values (1000000)")
+}
+
+func TestUnmarshalYamlBomb(t *testing.T) {
+	var v map[interface{}]interface{}
+	data := []byte(`version: "3"
+services: &services ["lol","lol","lol","lol","lol","lol","lol","lol","lol"]
+b: &b [*services,*services,*services,*services,*services,*services,*services,*services,*services]
+c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b]
+d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c]
+e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d]
+f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e]
+g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f]
+h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g]
+i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h]`)
+	err := Unmarshal(data, &v)
+	assert.ErrorContains(t, err, "yaml: exceeded max number of decoded values (1000000)")
+}
diff --git a/internal/yatee/samples/main.go b/internal/yatee/samples/main.go
@@ -5,8 +5,8 @@ import (
 	"io/ioutil"
 	"os"
 
+	"github.com/docker/app/internal/yaml"
 	"github.com/docker/app/internal/yatee"
-	yaml "gopkg.in/yaml.v2"
 )
 
 func main() {
diff --git a/internal/yatee/yatee.go b/internal/yatee/yatee.go
@@ -7,7 +7,7 @@ import (
 	"strconv"
 	"strings"
 
-	yaml "gopkg.in/yaml.v2"
+	"github.com/docker/app/internal/yaml"
 )
 
 const (
diff --git a/internal/yatee/yatee_test.go b/internal/yatee/yatee_test.go
@@ -3,7 +3,7 @@ package yatee
 import (
 	"testing"
 
-	yaml "gopkg.in/yaml.v2"
+	"github.com/docker/app/internal/yaml"
 	"gotest.tools/assert"
 )
 
diff --git a/vendor/gopkg.in/yaml.v2/decode.go b/vendor/gopkg.in/yaml.v2/decode.go
diff --git a/vendor/gopkg.in/yaml.v2/yaml.go b/vendor/gopkg.in/yaml.v2/yaml.go

Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,7 @@ import (`
`7`	`7`	`"strings"`
`8`	`8`	`"testing"`
`9`	`9`
`10`		`- "gopkg.in/yaml.v2"`
	`10`	`+ "github.com/docker/app/internal/yaml"`
`11`	`11`	`"gotest.tools/assert"`
`12`	`12`	`)`
`13`	`13`
Original file line number	Diff line number	Diff line change
`@@ -6,9 +6,9 @@ import (`
`6`	`6`	`"strings"`
`7`	`7`
`8`	`8`	`"github.com/docker/app/internal/renderer"`
	`9`	`+ "github.com/docker/app/internal/yaml"`
`9`	`10`	`"github.com/docker/app/internal/yatee"`
`10`	`11`	`"github.com/pkg/errors"`
`11`		`- yaml "gopkg.in/yaml.v2"`
`12`	`12`	`)`
`13`	`13`
`14`	`14`	`func init() {`