{{ message }}
Repository navigation
Tags: getkin/kin-openapi
Tags
Merge commit from fork * go.mod: bump santhosh-tekuri/jsonschema/v6 to v6.0.3 jsonschema/v6 v6.0.2 panicked with a nil-pointer dereference in numValidate when validating math.NaN() or math.Inf() float64 values against numeric constraints (minimum, maximum, exclusiveMinimum, exclusiveMaximum, multipleOf). big.Rat.SetString silently returns nil for those inputs, and the returned *big.Rat is then dereferenced in Rat.Cmp. Version v6.0.3 fixes the panic at the source. This is reachable in kin-openapi via the OAS 3.1 validation path (useJSONSchema2020), which hands the value to jsonschema without the NaN/Inf guard that the built-in visitor (visitJSON) applies. A YAML request body containing .nan, .inf, or -.inf therefore crashes the request-serving goroutine under net/http and the whole process on non-net/http hosts. * go.sum: update jsonschema/v6 checksums for v6.0.3 * openapi3filter: regression test for YAML NaN/Inf request body Verifies that a POST /n with Content-Type: application/yaml and a body of .nan, .inf, or -.inf against an OAS 3.1 spec with a numeric constraint returns a normal validation error rather than panicking.
openapi3filter: fix unbounded allocation in deepObject array decoding… … (C-02) sliceMapToSlice built a []any sized to the largest attacker-supplied array index before schema validation (maxItems) ever ran, letting a ~24-byte deepObject query parameter (e.g. param[items][50000000]=x) force multi-gigabyte heap allocation. Cap the gap between supplied elements and the reconstructed slice size, and reject negative indexes. Signed-off-by: Matías Insaurralde <matias@insaurral.de>
PreviousNext