Update module github.com/gorilla/schema to v1.4.1 [SECURITY] - autoclosed

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/gorilla/schema	`v1.4.0` -> `v1.4.1`

GitHub Vulnerability Alerts

CVE-2024-37298

Details

Running schema.Decoder.Decode() on a struct that has a field of type []struct{...} opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. For instance, in the Proof of Concept written below, someone can specify to set a field of the billionth element and it will allocate all other elements before it in the slice.

In the local environment environment for my project, I was able to call an endpoint like /innocent_endpoint?arr.10000000.X=1 and freeze my system from the memory allocation while parsing r.Form. I think this line is responsible for allocating the slice, although I haven't tested to make sure, so it's just an educated guess.

Proof of Concept

The following proof of concept works on both v1.2.0 and v1.2.1. I have not tested earlier versions.

package main

import (
    "fmt"

    "github.com/gorilla/schema"
)

func main() {
    dec := schema.NewDecoder()
    var result struct {
        Arr []struct{ Val int }
    }
    if err := dec.Decode(&result, map[string][]string{"arr.1000000000.Val": {"1"}}); err != nil {
        panic(err)
    }
    fmt.Printf("%#+v\n", result)
}

Impact

Any use of schema.Decoder.Decode() on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. There seems to be no possible solution that a developer using this library can do to disable this behaviour without fixing it in this project, so all uses of Decode that fall under this umbrella are affected. A fix that doesn't require a major change may also be harder to find, since it could break compatibility with some other intended use-cases.

Release Notes

gorilla/schema (github.com/gorilla/schema)

### [`v1.4.1`](https://togithub.com/gorilla/schema/releases/tag/v1.4.1) [Compare Source](https://togithub.com/gorilla/schema/compare/v1.4.0...v1.4.1) ### Security Release Fixes an issue where sparse slice deserialization can cause memory exhaustion CVE-2024-37298 Thanks to [@AlexVasiluta](https://togithub.com/AlexVasiluta) for the report and following responsible disclosure. **Full Changelog**: https://github.com/gorilla/schema/compare/v1.4.0...v1.4.1

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

Notifiarr / notifiarr