8000 [19.03 backport] vendor: Bump gopkg.in/yaml.v2 by thaJeztah · Pull Request #2119 · docker/cli · GitHub
[go: up one dir, main page]

Skip to content

Conversation

thaJeztah
Copy link
Member
@thaJeztah thaJeztah commented Oct 1, 2019

backport of #2117

To mitigate against malicious YAML (kubernetes/kubernetes#83253), we had implemented our own patch to the yams.v2 library. Now that there's an upstream fix, this PR brings us back to using the upstream library.

Description for the changelog

  • cli: Mitigate against YAML files that has excessive aliasing

Signed-off-by: Christopher Crone <christopher.crone@docker.com>
(cherry picked from commit 91cf8b0)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah
Copy link
Member Author

ping @silvin-lubecki @chris-crone @vdemeester PTAL

Copy link
Member
@chris-crone chris-crone left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@kolyshkin
Copy link
Contributor

Do we need this for 19.03.3?

}

func (d *decoder) unmarshal(n *node, out reflect.Value) (good bool) {
d.decodeCount++
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kolyshkin not critical, but it probably won't hurt to have; the beef of the change is in this file (although their fix is a bit weird)

Copy link
Contributor
@silvin-lubecki silvin-lubecki left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@andrewhsu andrewhsu merged commit 2355349 into docker:19.03 Oct 3, 2019
@thaJeztah thaJeztah deleted the 19.03_backport_bump_yaml.v2_2.2.3 branch October 4, 2019 08:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants
0