CVE-2024-37298 (Go, published 2024-07-01T19:15Z)
Description: value: gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/gorilla/schema
Files changed:
decoder.go
decoder_test.go
Commit message: Merge pull request from GHSA-3669-72x9-r9p3

* fixes the security advisory by limiting the slice creation based on configurable maxSize

* address review comment

Vulnerable code:
	return &Decoder{cache: newCache()}
	F2 string `schema:"F2"`	
	err := decoder.Decode(s, data);
	
func TestDoubleEmbedded(t *testing.T){
	

Fixed code:
const (
	defaultMaxSize = 16000
)

	return &Decoder{cache: newCache(), maxSize: defaultMaxSize}
	maxSize           int
// MaxSize limits the size of slices for URL nested arrays or object arrays.
// Choose MaxSize carefully; large values may create many zero-value slice elements.
// Example: "items.100000=apple" would create a slice with 100,000 empty strings.
func (d *Decoder) MaxSize(size int) {
	d.maxSize = size
}

		// a defensive check to avoid creating a large slice based on user input index
		if idx > d.maxSize {
			return fmt.Errorf("%v index %d is larger than the configured maxSize %d", v.Kind(), idx, d.maxSize)
		}
	F2 string `schema:"F2"`
	err := decoder.Decode(s, data)


func TestDoubleEmbedded(t *testing.T) {

func TestDecoder_MaxSize(t *testing.T) {
	t.Parallel()

	type Nested struct {
		Val          int
		NestedValues []struct {
			NVal int
		}
	}
	type NestedSlices struct {
		Values []Nested
	}

	testcases := []struct {
		name            string
		maxSize         int
		decoderInput    func() (dst NestedSlices, src map[string][]string)
		expectedDecoded NestedSlices
		expectedErr     MultiError
	}{
		{
			name:    "no error on decoding under max size",
			maxSize: 10,
			decoderInput: func() (dst NestedSlices, src map[string][]string) {
				return dst, map[string][]string{
					"Values.1.Val":                 {"132"},
					"Values.1.NestedValues.1.NVal": {"1"},
					"Values.1.NestedValues.2.NVal": {"2"},
					"Values.1.NestedValues.3.NVal": {"3"},
				}
			},
			expectedDecoded: NestedSlices{
				Values: []Nested{
					{
						Val:          0,
						NestedValues: nil,
					},
					{
						Val: 132, NestedValues: []struct{ NVal int }{
							{NVal: 0},
							{NVal: 1},
							{NVal: 2},
							{NVal: 3},
						},
					},
				},
			},
			expectedErr: nil,
		},
		{
			name:    "error on decoding above max size",
			maxSize: 1,
			decoderInput: func() (dst NestedSlices, src map[string][]string) {
				return dst, map[string][]string{
					"Values.1.Val":                 {"132"},
					"Values.1.NestedValues.1.NVal": {"1"},
					"Values.1.NestedValues.2.NVal": {"2"},
					"Values.1.NestedValues.3.NVal": {"3"},
				}
			},
			expectedErr: MultiError{
				"Values.1.NestedValues.2.NVal": errors.New("slice index 2 is larger than the configured maxSize 1"),
				"Values.1.NestedValues.3.NVal": errors.New("slice index 3 is larger than the configured maxSize 1"),
			},
		},
	}

	for _, tc := range testcases {
		tc := tc
		t.Run(tc.name, func(t *testing.T) {
			t.Parallel()
			dec := NewDecoder()
			dec.MaxSize(tc.maxSize)
			dst, src := tc.decoderInput()
			err := dec.Decode(&dst, src)

			if tc.expectedErr != nil {
				var gotErr MultiError
				if !errors.As(err, &gotErr) {
					t.Errorf("decoder error is not of type %T", gotErr)
				}
				if !reflect.DeepEqual(gotErr, tc.expectedErr) {
					t.Errorf("expected %v, got %v", tc.expectedErr, gotErr)
				}
			} else {
				if !reflect.DeepEqual(dst, tc.expectedDecoded) {
					t.Errorf("expected %v, got %v", tc.expectedDecoded, dst)
				}
			}
		})
	}
}

func TestDecoder_SetMaxSize(t *testing.T) {

	t.Run("default maxsize should be equal to given constant", func(t *testing.T) {
		t.Parallel()
		dec := NewDecoder()
		if !reflect.DeepEqual(dec.maxSize, defaultMaxSize) {
			t.Errorf("unexpected default max size")
		}
	})

	t.Run("configured maxsize should be set properly", func(t *testing.T) {
		t.Parallel()
		configuredMaxSize := 50
		limitedMaxSizeDecoder := NewDecoder()
		limitedMaxSizeDecoder.MaxSize(configuredMaxSize)
		if !reflect.DeepEqual(limitedMaxSizeDecoder.maxSize, configuredMaxSize) {
			t.Errorf("invalid decoder maxsize, expected: %d, got: %d",
				configuredMaxSize, limitedMaxSizeDecoder.maxSize)
		}
	})
}