CVE-2022-4767 (YAML, published 2022-12-27T15:15Z)
Description: value: Denial of Service in GitHub repository usememos/memos prior to 0.9.1.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/usememos/memos
Files changed:
.github/workflows/backend-tests-default.yml
.github/workflows/backend-tests.yml
.github/workflows/frontend-tests-default.yml
.github/workflows/frontend-tests.yml
api/user.go
server/user.go
Commit message: chore: update userinfo validator (#868)

* chore: update userinfo validator

* chore: update actions

* chore: update

Vulnerable code:
  push:
  pull_request:
    branches: [main]
  push:
  pull_request:
    branches: [main]

		if userPatch.Email != nil && *userPatch.Email != "" && !common.ValidateEmail(*userPatch.Email) {
			return echo.NewHTTPError(http.StatusBadRequest, "Invalid email format")

Fixed code:
name: Backend Test

on:
  pull_request:
    branches:
      - main
      - "release/v*.*.*"
    paths:
      - "web/**"

jobs:
  go-static-checks:
    runs-on: ubuntu-latest
    steps:
      - run: 'echo "Not required"'

  go-tests:
    runs-on: ubuntu-latest
    steps:
      - run: 'echo "Not required"'
  pull_request:
name: Frontend Test

on:
  pull_request:
    branches:
      - main
      - "release/v*.*.*"
    paths-ignore:
      - "web/**"

jobs:
  eslint-checks:
    runs-on: ubuntu-latest
    steps:
      - run: 'echo "Not required"'

  jest-tests:
    runs-on: ubuntu-latest
    steps:
      - run: 'echo "Not required"'

  frontend-build:
    runs-on: ubuntu-latest
    steps:
      - run: 'echo "Not required"'
  pull_request:

	"github.com/usememos/memos/common"
	if len(create.Username) > 32 {
		return fmt.Errorf("username is too long, maximum length is 32")
	}
	if len(create.Nickname) > 64 {
		return fmt.Errorf("nickname is too long, maximum length is 64")
	}
	if create.Email != "" {
		if len(create.Email) > 256 {
			return fmt.Errorf("email is too long, maximum length is 256")
		}
		if common.ValidateEmail(create.Email) {
			return fmt.Errorf("invalid email format")
		}
	}
func (patch UserPatch) Validate() error {
	if patch.Username != nil && len(*patch.Username) < 4 {
		return fmt.Errorf("username is too short, minimum length is 4")
	}
	if patch.Username != nil && len(*patch.Username) > 32 {
		return fmt.Errorf("username is too long, maximum length is 32")
	}
	if patch.Password != nil && len(*patch.Password) < 4 {
		return fmt.Errorf("password is too short, minimum length is 4")
	}
	if patch.Nickname != nil && len(*patch.Nickname) > 64 {
		return fmt.Errorf("nickname is too long, maximum length is 64")
	}
	if patch.Email != nil {
		if len(*patch.Email) > 256 {
			return fmt.Errorf("email is too long, maximum length is 256")
		}
		if common.ValidateEmail(*patch.Email) {
			return fmt.Errorf("invalid email format")
		}
	}

	return nil
}

		if err := userPatch.Validate(); err != nil {
			return echo.NewHTTPError(http.StatusBadRequest, "Invalid user patch format.").SetInternal(err)