djc / askama

Type-safe, compiled Jinja-like templates for Rust
Apache License 2.0
3.43k stars 218 forks source link

Limit nested filters to avoid stack overflow 2 #1072

Open manunio opened 3 months ago

manunio commented 3 months ago

This will fix: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66029. This pr includes all the work at https://github.com/djc/askama/pull/979 done by @djc as well as updated ui test.

For ui test: I think previous input for filter-recursion ui test was not right as it was not triggering error for recursion itself, for example:

#[test]
fn fuzzed_filter_recursion() {
    const TEMPLATE: &str = include_str!("../tests/filter-recursion.txt");
    if let Err(e) = Ast::from_str(TEMPLATE, None, &Syntax::default()) {
        panic!("{e}");
    }
}
---- tests::fuzzed_filter_recursion stdout ----
thread 'tests::fuzzed_filter_recursion' panicked at askama_parser/src/tests.rs:952:9:
failed to parse template source at row 1, column 255 near:
"|A|AA|A|A|A|A|AA|A|A|A|A|AA|A|A|A|A|AA|A"...
GuillaumeGomez commented 3 months ago

Looks good to me, thanks!