mirror of
https://github.com/gohugoio/hugo.git
synced 2025-12-13 20:36:04 +01:00
a3d9548469
This commit also adds validation to prevent the "Billion Laughs" attack (see https://github.com/goccy/go-yaml/issues/461). The limit of non-scalar aliases to the same node is set to 10,000. See benchmarks below. ``` │ sec/op │ UnmarshalBillionLaughs/Billion_Laughs_no_validation-10 125.2µ ± ∞ ¹ UnmarshalBillionLaughs/Billion_Laughs_with_validation-10 655.8µ ± ∞ ¹ UnmarshalBillionLaughs/YAML_Front_Matter_no_validation-10 9.223µ ± ∞ ¹ UnmarshalBillionLaughs/YAML_Front_Matter_with_validation-10 9.443µ ± ∞ ¹ geomean 51.71µ ¹ need >= 6 samples for confidence interval at level 0.95 │ fix-goyaml-8822.bench │ │ B/op │ UnmarshalBillionLaughs/Billion_Laughs_no_validation-10 177.0Ki ± ∞ ¹ UnmarshalBillionLaughs/Billion_Laughs_with_validation-10 177.0Ki ± ∞ ¹ UnmarshalBillionLaughs/YAML_Front_Matter_no_validation-10 11.67Ki ± ∞ ¹ UnmarshalBillionLaughs/YAML_Front_Matter_with_validation-10 11.67Ki ± ∞ ¹ geomean 45.45Ki ¹ need >= 6 samples for confidence interval at level 0.95 │ fix-goyaml-8822.bench │ │ allocs/op │ UnmarshalBillionLaughs/Billion_Laughs_no_validation-10 3.302k ± ∞ ¹ UnmarshalBillionLaughs/Billion_Laughs_with_validation-10 3.305k ± ∞ ¹ UnmarshalBillionLaughs/YAML_Front_Matter_no_validation-10 253.0 ± ∞ ¹ UnmarshalBillionLaughs/YAML_Front_Matter_with_validation-10 253.0 ± ∞ ¹ ```` Fixes #8822 Fixes #13043 Fixes #14053 Fixes ##8427
116 lines
2.3 KiB
Go
116 lines
2.3 KiB
Go
// Copyright 2015 The Hugo Authors. All rights reserved.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package parser
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"io"
|
|
|
|
"github.com/gohugoio/hugo/parser/metadecoders"
|
|
|
|
toml "github.com/pelletier/go-toml/v2"
|
|
|
|
xml "github.com/clbanning/mxj/v2"
|
|
)
|
|
|
|
const (
|
|
yamlDelimLf = "---\n"
|
|
tomlDelimLf = "+++\n"
|
|
)
|
|
|
|
func InterfaceToConfig(in any, format metadecoders.Format, w io.Writer) error {
|
|
if in == nil {
|
|
return errors.New("input was nil")
|
|
}
|
|
|
|
switch format {
|
|
case metadecoders.YAML:
|
|
b, err := metadecoders.MarshalYAML(in)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
_, err = w.Write(b)
|
|
return err
|
|
|
|
case metadecoders.TOML:
|
|
enc := toml.NewEncoder(w)
|
|
enc.SetIndentTables(true)
|
|
return enc.Encode(in)
|
|
case metadecoders.JSON:
|
|
b, err := json.MarshalIndent(in, "", " ")
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
_, err = w.Write(b)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
_, err = w.Write([]byte{'\n'})
|
|
return err
|
|
case metadecoders.XML:
|
|
b, err := xml.AnyXmlIndent(in, "", "\t", "root")
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
_, err = w.Write(b)
|
|
return err
|
|
default:
|
|
return errors.New("unsupported Format provided")
|
|
}
|
|
}
|
|
|
|
func InterfaceToFrontMatter(in any, format metadecoders.Format, w io.Writer) error {
|
|
if in == nil {
|
|
return errors.New("input was nil")
|
|
}
|
|
|
|
switch format {
|
|
case metadecoders.YAML:
|
|
_, err := w.Write([]byte(yamlDelimLf))
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
err = InterfaceToConfig(in, format, w)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
_, err = w.Write([]byte(yamlDelimLf))
|
|
return err
|
|
|
|
case metadecoders.TOML:
|
|
_, err := w.Write([]byte(tomlDelimLf))
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
err = InterfaceToConfig(in, format, w)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
_, err = w.Write([]byte(tomlDelimLf))
|
|
return err
|
|
|
|
default:
|
|
return InterfaceToConfig(in, format, w)
|
|
}
|
|
}
|