SystemSh0cker/gocsaf
1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 05:40:11 +01:00
Code Issues Releases Activity Actions

Make json parsing more strict
Some checks are pending
Go / build (push) Waiting to run
Details
Go / run_modver (push) Blocked by required conditions
Details

Browse source
This commit is contained in:
koplas 2025-07-02 17:06:25 +02:00
parent c833c00f84
commit fc3837d655
No known key found for this signature in database
13 changed files with 68 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

4
cmd/csaf_aggregator/interim.go
View file

@ -13,7 +13,6 @@ import (
"crypto/sha256"
"crypto/sha512"
"encoding/csv"
"encoding/json"
"errors"
"fmt"
"io"
@ -25,6 +24,7 @@ import (
"time"
"github.com/gocsaf/csaf/v3/csaf"
"github.com/gocsaf/csaf/v3/internal/misc"
"github.com/gocsaf/csaf/v3/util"
)
@ -81,7 +81,7 @@ func (w *worker) checkInterims(
if err := func() error {
defer res.Body.Close()
tee := io.TeeReader(res.Body, hasher)
return json.NewDecoder(tee).Decode(&doc)
return misc.StrictJSONParse(tee, &doc)
}(); err != nil {
return nil, err
}

5
cmd/csaf_aggregator/mirror.go
View file

@ -13,7 +13,6 @@ import (
"crypto/sha256"
"crypto/sha512"
"encoding/hex"
"encoding/json"
"fmt"
"io"
"log/slog"
@ -31,6 +30,7 @@ import (
"github.com/ProtonMail/gopenpgp/v2/crypto"
"github.com/gocsaf/csaf/v3/csaf"
"github.com/gocsaf/csaf/v3/internal/misc"
"github.com/gocsaf/csaf/v3/util"
)
@ -538,7 +538,7 @@ func (w *worker) mirrorFiles(tlpLabel csaf.TLPLabel, files []csaf.AdvisoryFile)
download := func(r io.Reader) error {
tee := io.TeeReader(r, hasher)
return json.NewDecoder(tee).Decode(&advisory)
return misc.StrictJSONParse(tee, &advisory)
}
if err := downloadJSON(w.client, file.URL(), download); err != nil {
@ -627,7 +627,6 @@ func (w *worker) mirrorFiles(tlpLabel csaf.TLPLabel, files []csaf.AdvisoryFile)
// If this fails it creates a signature itself with the configured key.
func (w *worker) downloadSignatureOrSign(url, fname string, data []byte) error {
sig, err := w.downloadSignature(url)
if err != nil {
if err != errNotFound {
w.log.Error("Could not find signature URL", "url", url, "err", err)

11
cmd/csaf_checker/processor.go
View file

@ -15,10 +15,8 @@ import (
"crypto/sha512"
"crypto/tls"
"encoding/csv"
"encoding/json"
"errors"
"fmt"
"github.com/gocsaf/csaf/v3/internal/misc"
"io"
"log"
"net/http"
@ -30,6 +28,8 @@ import (
"strings"
"time"
"github.com/gocsaf/csaf/v3/internal/misc"
"github.com/ProtonMail/gopenpgp/v2/crypto"
"golang.org/x/time/rate"
@ -518,7 +518,7 @@ func (p *processor) rolieFeedEntries(feed string) ([]csaf.AdvisoryFile, error) {
return nil, nil, fmt.Errorf("%s: %v", feed, err)
}
var rolieDoc any
err = json.NewDecoder(bytes.NewReader(all)).Decode(&rolieDoc)
err = misc.StrictJSONParse(bytes.NewReader(all), &rolieDoc)
return rfeed, rolieDoc, err
}()
if err != nil {
@ -702,7 +702,7 @@ func (p *processor) integrity(
if err := func() error {
defer res.Body.Close()
tee := io.TeeReader(res.Body, hasher)
return json.NewDecoder(tee).Decode(&doc)
return misc.StrictJSONParse(tee, &doc)
}(); err != nil {
lg(ErrorType, "Reading %s failed: %v", u, err)
continue
@ -1035,8 +1035,7 @@ func (p *processor) checkChanges(base string, mask whereType) error {
}
path := r[pathColumn]
times, files =
append(times, t),
times, files = append(times, t),
append(files, csaf.DirectoryAdvisoryFile{Path: path})
p.timesChanges[path] = t
}

3
cmd/csaf_downloader/downloader.go
View file

@ -35,6 +35,7 @@ import (
"golang.org/x/time/rate"
"github.com/gocsaf/csaf/v3/csaf"
"github.com/gocsaf/csaf/v3/internal/misc"
"github.com/gocsaf/csaf/v3/util"
)
@ -551,7 +552,7 @@ func (dc *downloadContext) downloadAdvisory(
tee := io.TeeReader(resp.Body, hasher)
if err := json.NewDecoder(tee).Decode(&doc); err != nil {
if err := misc.StrictJSONParse(tee, &doc); err != nil {
dc.stats.downloadFailed++
slog.Warn("Downloading failed",
"url", file.URL(),

7
cmd/csaf_uploader/processor.go
View file

@ -11,7 +11,6 @@ package main
import (
"bytes"
"crypto/tls"
"encoding/json"
"errors"
"fmt"
"io"
@ -91,7 +90,7 @@ func (p *processor) create() error {
Errors []string `json:"errors"`
}
if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
if err := misc.StrictJSONParse(resp.Body, &result); err != nil {
return err
}
@ -115,7 +114,7 @@ func (p *processor) uploadRequest(filename string) (*http.Request, error) {
if !p.cfg.NoSchemaCheck {
var doc any
if err := json.NewDecoder(bytes.NewReader(data)).Decode(&doc); err != nil {
if err := misc.StrictJSONParse(bytes.NewReader(data), &doc); err != nil {
return nil, err
}
errs, err := csaf.ValidateCSAF(doc)
@ -239,7 +238,7 @@ func (p *processor) process(filename string) error {
Errors []string `json:"errors"`
}
if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
if err := misc.StrictJSONParse(resp.Body, &result); err != nil {
return err
}

4
cmd/csaf_validator/main.go
View file

@ -10,7 +10,6 @@
package main
import (
"encoding/json"
"fmt"
"log"
"os"
@ -19,6 +18,7 @@ import (
"github.com/jessevdk/go-flags"
"github.com/gocsaf/csaf/v3/csaf"
"github.com/gocsaf/csaf/v3/internal/misc"
"github.com/gocsaf/csaf/v3/util"
)
@ -301,7 +301,7 @@ func loadJSONFromFile(fname string) (any, error) {
}
defer f.Close()
var doc any
if err = json.NewDecoder(f).Decode(&doc); err != nil {
if err = misc.StrictJSONParse(f, &doc); err != nil {
return nil, err
}
return doc, err

5
csaf/advisory.go
View file

@ -14,6 +14,8 @@ import (
"fmt"
"io"
"os"
"github.com/gocsaf/csaf/v3/internal/misc"
)
// Acknowledgement reflects the 'acknowledgement' object in the list of acknowledgements.
@ -383,7 +385,6 @@ type Relationship struct {
FullProductName *FullProductName `json:"full_product_name"` // required
ProductReference *ProductID `json:"product_reference"` // required
RelatesToProductReference *ProductID `json:"relates_to_product_reference"` // required
}
// Relationships is a list of Relationship.
@ -1391,7 +1392,7 @@ func LoadAdvisory(fname string) (*Advisory, error) {
}
defer f.Close()
var advisory Advisory
if err := json.NewDecoder(f).Decode(&advisory); err != nil {
if err := misc.StrictJSONParse(f, &advisory); err != nil {
return nil, err
}
if err := advisory.Validate(); err != nil {

5
csaf/generate_cvss_enums.go
View file

@ -12,7 +12,6 @@ package main
import (
"bytes"
"encoding/json"
"flag"
"fmt"
"go/format"
@ -22,6 +21,8 @@ import (
"sort"
"strings"
"text/template"
"github.com/gocsaf/csaf/v3/internal/misc"
)
// We from Intevation consider the source code parts in the following
@ -98,7 +99,7 @@ func loadSchema(filename string) (*schema, error) {
}
defer f.Close()
var s schema
if err := json.NewDecoder(f).Decode(&s); err != nil {
if err := misc.StrictJSONParse(f, &s); err != nil {
return nil, err
}
return &s, nil

5
csaf/models.go
View file

@ -17,6 +17,7 @@ import (
"strings"
"time"
"github.com/gocsaf/csaf/v3/internal/misc"
"github.com/gocsaf/csaf/v3/util"
)
@ -575,7 +576,6 @@ func (d *Distribution) Validate() error {
// Validate checks if the provider metadata is valid.
// Returns an error if the validation fails otherwise nil.
func (pmd *ProviderMetadata) Validate() error {
switch {
case pmd.CanonicalURL == nil:
return errors.New("canonical_url is mandatory")
@ -695,8 +695,7 @@ func (pmd *ProviderMetadata) WriteTo(w io.Writer) (int64, error) {
func LoadProviderMetadata(r io.Reader) (*ProviderMetadata, error) {
var pmd ProviderMetadata
dec := json.NewDecoder(r)
if err := dec.Decode(&pmd); err != nil {
if err := misc.StrictJSONParse(r, &pmd); err != nil {
return nil, err
}

5
csaf/providermetaloader.go
View file

@ -11,13 +11,13 @@ package csaf
import (
"bytes"
"crypto/sha256"
"encoding/json"
"fmt"
"io"
"log/slog"
"net/http"
"strings"
"github.com/gocsaf/csaf/v3/internal/misc"
"github.com/gocsaf/csaf/v3/util"
)
@ -149,7 +149,6 @@ func (pmdl *ProviderMetadataLoader) Enumerate(domain string) []*LoadedProviderMe
}
dnsURL := "https://csaf.data.security." + domain
return []*LoadedProviderMetadata{pmdl.loadFromURL(dnsURL)}
}
// Load loads one valid provider metadata for a given path.
@ -323,7 +322,7 @@ func (pmdl *ProviderMetadataLoader) loadFromURL(path string) *LoadedProviderMeta
var doc any
if err := json.NewDecoder(tee).Decode(&doc); err != nil {
if err := misc.StrictJSONParse(tee, &doc); err != nil {
result.Messages.Add(
JSONDecodingFailed,
fmt.Sprintf("JSON decoding failed: %v", err))

6
csaf/remotevalidation.go
View file

@ -18,6 +18,7 @@ import (
"net/http"
"sync"
"github.com/gocsaf/csaf/v3/internal/misc"
bolt "go.etcd.io/bbolt"
)
@ -180,7 +181,6 @@ func prepareCache(config string) (cache, error) {
return create()
}
return nil
}); err != nil {
db.Close()
return nil, err
@ -256,7 +256,7 @@ func deserialize(value []byte) (*RemoteValidationResult, error) {
}
defer r.Close()
var rvr RemoteValidationResult
if err := json.NewDecoder(r).Decode(&rvr); err != nil {
if err := misc.StrictJSONParse(r, &rvr); err != nil {
return nil, err
}
return &rvr, nil
@ -323,7 +323,7 @@ func (v *remoteValidator) Validate(doc any) (*RemoteValidationResult, error) {
// no cache -> process directly.
in = resp.Body
}
return json.NewDecoder(in).Decode(&rvr)
return misc.StrictJSONParse(in, &rvr)
}(); err != nil {
return nil, err
}

8
csaf/rolie.go
View file

@ -14,6 +14,7 @@ import (
"sort"
"time"
"github.com/gocsaf/csaf/v3/internal/misc"
"github.com/gocsaf/csaf/v3/util"
)
@ -54,7 +55,7 @@ type ROLIEServiceDocument struct {
// LoadROLIEServiceDocument loads a ROLIE service document from a reader.
func LoadROLIEServiceDocument(r io.Reader) (*ROLIEServiceDocument, error) {
var rsd ROLIEServiceDocument
if err := json.NewDecoder(r).Decode(&rsd); err != nil {
if err := misc.StrictJSONParse(r, &rsd); err != nil {
return nil, err
}
return &rsd, nil
@ -122,7 +123,7 @@ func (rcd *ROLIECategoryDocument) Merge(categories ...string) bool {
// LoadROLIECategoryDocument loads a ROLIE category document from a reader.
func LoadROLIECategoryDocument(r io.Reader) (*ROLIECategoryDocument, error) {
var rcd ROLIECategoryDocument
if err := json.NewDecoder(r).Decode(&rcd); err != nil {
if err := misc.StrictJSONParse(r, &rcd); err != nil {
return nil, err
}
return &rcd, nil
@ -195,9 +196,8 @@ type ROLIEFeed struct {
// LoadROLIEFeed loads a ROLIE feed from a reader.
func LoadROLIEFeed(r io.Reader) (*ROLIEFeed, error) {
dec := json.NewDecoder(r)
var rf ROLIEFeed
if err := dec.Decode(&rf); err != nil {
if err := misc.StrictJSONParse(r, &rf); err != nil {
return nil, err
}
return &rf, nil

34
internal/misc/json.go Normal file
View file

@ -0,0 +1,34 @@
// This file is Free Software under the Apache-2.0 License
// without warranty, see README.md and LICENSES/Apache-2.0.txt for details.
//
// SPDX-License-Identifier: Apache-2.0
//
// SPDX-FileCopyrightText: 2023 German Federal Office for Information Security (BSI) <https://www.bsi.bund.de>
// Software-Engineering: 2023 Intevation GmbH <https://intevation.de>
package misc
import (
"encoding/json"
"fmt"
"io"
)
// StrictJSONParse provides JSON parsing with stronger validation.
func StrictJSONParse(jsonData io.Reader, target interface{}) error {
decoder := json.NewDecoder(jsonData)
decoder.DisallowUnknownFields()
err := decoder.Decode(target)
if err != nil {
return fmt.Errorf("strictJSONParse: %w", err)
}
token, err := decoder.Token()
if err != io.EOF {
return fmt.Errorf("strictJSONParse: unexpected trailing data after JSON: token: %v, err: %v", token, err)
}
return nil
}