Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

modules: read cue.mod/module.cue in data-only mode #3138

Closed
myitcv opened this issue May 10, 2024 · 0 comments
Closed

modules: read cue.mod/module.cue in data-only mode #3138

myitcv opened this issue May 10, 2024 · 0 comments
Assignees
@rogpeppe
Labels
FeatureRequest New feature or request modules Issues related to CUE modules and the experimental implementation Security

Comments

@myitcv
Copy link
Member

myitcv commented May 10, 2024 •
edited by rogpeppe

Currently module.cue files can contain arbitrary CUE, including references, stdlib imports, comprehensions etc.
As the module.cue file is necessary metadata required before doing any CUE work, this lays open the
tooling to potential DoS attacks and also makes the file less amenable to automatic edits, which is an
importand requirement of module tooling.

We should parse the module.cue file in data-only mode to avoid these potential pitfalls.
@myitcv myitcv added FeatureRequest New feature or request modules Issues related to CUE modules and the experimental implementation labels May 10, 2024
cueckoo pushed a commit that referenced this issue May 13, 2024
@rogpeppe
mod/modfile: parse module.cue in data-only mode
9849be9 
This reduces the surface for denial of service attacks involving
arbitrary computations via the module.cue file.

Fixes #3138.

Signed-off-by: Roger Peppe <rogpeppe@gmail.com>
Change-Id: If58c8d3a7b05a657543909bf9d1ebaaf4296d039
cueckoo pushed a commit that referenced this issue May 13, 2024
@rogpeppe
mod/modfile: parse module.cue in data-only mode
6aa266c 
This reduces the surface for denial of service attacks involving
arbitrary computations via the module.cue file.

Fixes #3138.

Signed-off-by: Roger Peppe <rogpeppe@gmail.com>
Change-Id: If58c8d3a7b05a657543909bf9d1ebaaf4296d039
cueckoo pushed a commit that referenced this issue May 15, 2024
@rogpeppe
mod/modfile: parse module.cue in data-only mode
2838097 
This reduces the surface for denial of service attacks involving
arbitrary computations via the module.cue file.

Note that we never supported non-data CUE in cue.mod/module.cue;
commands like `cue mod tidy` and `cue mod get` assumed plain CUE data so
that they could modify some fields and write the file back to disk.

Fixes #3138.

Signed-off-by: Roger Peppe <rogpeppe@gmail.com>
Change-Id: If58c8d3a7b05a657543909bf9d1ebaaf4296d039
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@rogpeppe rogpeppe

Labels
FeatureRequest New feature or request modules Issues related to CUE modules and the experimental implementation Security
Projects
Modules Roadmap
Status: Done
Release v0.9
Status: v0.9.0-alpha.5
Milestone
No milestone
Development

No branches or pull requests
2 participants
@rogpeppe @myitcv