8000 update velocypack (#8073) · arangodb/arangodb@7991b4c · GitHub
[go: up one dir, main page]
Skip to content

Commit 7991b4c

Browse files
fcellerfceller
authored
update velocypack (#8073)
1 parent fc8afa9 commit 7991b4c

File tree

11 files changed

+257
-100
lines changed

11 files changed

+257
-100
lines changed

‎3rdParty/velocypack/include/velocypack/Builder.h

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -385,7 +385,7 @@ class Builder {
385385
}
386386
}
387387
try {
388-
checkKeyIsString(Slice(sub).isString());
388+
checkKeyIsString(Slice(sub));
389389
auto oldPos = _pos;
390390
reserveSpace(1 + sizeof(void*));
391391
// store pointer. this doesn't need to be portable
@@ -576,6 +576,18 @@ class Builder {
576576
}
577577
}
578578

579+
inline void checkKeyIsString(Slice const& item) {
580+
if (!_stack.empty()) {
581+
ValueLength const& tos = _stack.back();
582+
if (_start[tos] == 0x0b || _start[tos] == 0x14) {
583+
if (!_keyWritten && !item.isString()) {
584+
throw Exception(Exception::BuilderKeyMustBeString);
585+
}
586+
_keyWritten = !_keyWritten;
587+
}
588+
}
589+
}
590+
579591
inline void addArray(bool unindexed = false) {
580592
addCompoundValue(unindexed ? 0x13 : 0x06);
581593
}

‎3rdParty/velocypack/include/velocypack/Exception.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ struct Exception : std::exception {
6767
BuilderExternalsDisallowed = 37,
6868
BuilderKeyAlreadyWritten = 38,
6969
BuilderKeyMustBeString = 39,
70+
BuilderCustomDisallowed = 40,
7071

7172
ValidatorInvalidLength = 50,
7273
ValidatorInvalidType = 51,
@@ -142,6 +143,8 @@ struct Exception : std::exception {
142143
return "The key of the next key/value pair is already written";
143144
case BuilderKeyMustBeString:
144145
return "The key of the next key/value pair must be a string";
146+
case BuilderCustomDisallowed:
147+
return "Custom types are not allowed in this configuration";
145148

146149
case ValidatorInvalidType:
147150
return "Invalid type found in binary data";

‎3rdParty/velocypack/include/velocypack/Options.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,10 @@ struct Options {
115115
// values as a security precaution)
116116
bool disallowExternals = false;
117117

118+
// disallow using type Custom (to prevent injection of arbitrary opaque
119+
8000 // values as a security precaution)
120+
bool disallowCustom = false;
121+
118122
// default options with the above settings
119123
static Options Defaults;
120124
};

‎3rdParty/velocypack/include/velocypack/Validator.h

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ class Validator {
3939

4040
public:
4141
explicit Validator(Options const* options = &Options::Defaults)
42-
: options(options) {
42+
: options(options), _level(0) {
4343
if (options == nullptr) {
4444
throw Exception(Exception::InternalError, "Options cannot be a nullptr");
4545
}
@@ -50,28 +50,31 @@ class Validator {
5050
public:
5151
// validates a VelocyPack Slice value starting at ptr, with length bytes length
5252
// throws if the data is invalid
53-
bool validate(char const* ptr, size_t length, bool isSubPart = false) const {
53+
bool validate(char const* ptr, size_t length, bool isSubPart = false) {
5454
return validate(reinterpret_cast<uint8_t const*>(ptr), length, isSubPart);
5555
}
5656

5757
// validates a VelocyPack Slice value starting at ptr, with length bytes length
5858
// throws if the data is invalid
59-
bool validate(uint8_t const* ptr, size_t length, bool isSubPart = false) const;
59+
bool validate(uint8_t const* ptr, size_t length, bool isSubPart = false);
6060

6161
private:
62-
void validateArray(uint8_t const* ptr, size_t length) const;
63-
void validateCompactArray(uint8_t const* ptr, size_t length) const;
64-
void validateUnindexedArray(uint8_t const* ptr, size_t length) const;
65-
void validateIndexedArray(uint8_t const* ptr, size_t length) const;
66-
void validateObject(uint8_t const* ptr, size_t length) const;
67-
void validateCompactObject(uint8_t const* ptr, size_t length) const;
68-
void validateIndexedObject(uint8_t const* ptr, size_t length) const;
69-
void validateBufferLength(size_t expected, size_t actual, bool isSubPart) const;
70-
void validateSliceLength(uint8_t const* ptr, size_t length, bool isSubPart) const;
71-
ValueLength readByteSize(uint8_t const*& ptr, uint8_t const* end) const;
62+
void validateArray(uint8_t const* ptr, size_t length);
63+
void validateCompactArray(uint8_t const* ptr, size_t length);
64+
void validateUnindexedArray(uint8_t const* ptr, size_t length);
65+
void validateIndexedArray(uint8_t const* ptr, size_t length);
66+
void validateObject(uint8_t const* ptr, size_t length);
67+
void validateCompactObject(uint8_t const* ptr, size_t length);
68+
void validateIndexedObject(uint8_t const* ptr, size_t length);
69+
void validateBufferLength(size_t expected, size_t actual, bool isSubPart);
70+
void validateSliceLength(uint8_t const* ptr, size_t length, bool isSubPart);
71+
ValueLength readByteSize(uint8_t const*& ptr, uint8_t const* end);
7272

7373
public:
7474
Options const* options;
75+
76+
private:
77+
int _level;
7578
};
7679

7780
} // namespace arangodb::velocypack

‎3rdParty/velocypack/src/Builder.cpp

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -795,6 +795,10 @@ uint8_t* Builder::set(Value const& FA4C amp; item) {
795795
throw Exception(Exception::NotImplemented);
796796
}
797797
case ValueType::Custom: {
798+
if (options->disallowCustom) {
799+
// Custom values explicitly disallowed as a security precaution
800+
throw Exception(Exception::BuilderCustomDisallowed);
801+
}
798802
throw Exception(Exception::BuilderUnexpectedType,
799803
"Cannot set a ValueType::Custom with this method");
800804
}
@@ -803,7 +807,12 @@ uint8_t* Builder::set(Value const& item) {
803807
}
804808

805809
uint8_t* Builder::set(Slice const& item) {
806-
checkKeyIsString(item.isString());
810+
checkKeyIsString(item);
811+
812+
if (options->disallowCustom && item.isCustom()) {
813+
// Custom values explicitly disallowed as a security precaution
814+
throw Exception(Exception::BuilderCustomDisallowed);
815+
}
807816

808817
ValueLength const l = item.byteSize();
809818
reserveSpace(l);
@@ -847,6 +856,10 @@ uint8_t* Builder::set(ValuePair const& pair) {
847856
}
848857
return _start + oldPos;
849858
} else if (pair.valueType() == ValueType::Custom) {
859+
if (options->disallowCustom) {
860+
// Custom values explicitly disallowed as a security precaution
861+
throw Exception(Exception::BuilderCustomDisallowed);
862+
}
850863
// We only reserve space here, the caller has to fill in the custom type
851864
uint64_t size = pair.getSize();
852865
reserveSpace(size);

0 commit comments

Comments
 (0)
0