Skip to content

Commit e6943a5

Browse files
rorydbainrorydbain
authored
Fix panic when decoding nested brakcets for map definitions (#3746)
1 parent f708c97 commit e6943a5

3 files changed

Lines changed: 60 additions & 60 deletions

File tree

‎http/codegen/templates/partial/query_map_conversion.go.tpl‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
{
66
openIdx := strings.IndexRune(keyRaw, '[')
77
closeIdx := strings.IndexRune(keyRaw, ']')
8-
if closeIdx == -1 {
9-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
8+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
9+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
1010
} else {
1111
{{- if eq .Type.KeyType.Type.Name "string" }}
1212
key{{ .Loop }} = keyRaw[openIdx+1 : closeIdx]

‎http/codegen/testdata/multipart_code.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -161,8 +161,8 @@ func NewServiceMultipartWithParamMethodMultipartWithParamDecoder(mux goahttp.Mux
161161
{
162162
openIdx := strings.IndexRune(keyRaw, '[')
163163
closeIdx := strings.IndexRune(keyRaw, ']')
164-
if closeIdx == -1 {
165-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
164+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
165+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
166166
} else {
167167
keyaRaw := keyRaw[openIdx+1 : closeIdx]
168168
v, err2 := strconv.ParseInt(keyaRaw, 10, strconv.IntSize)
@@ -225,8 +225,8 @@ func NewServiceMultipartWithParamsAndHeadersMethodMultipartWithParamsAndHeadersD
225225
{
226226
openIdx := strings.IndexRune(keyRaw, '[')
227227
closeIdx := strings.IndexRune(keyRaw, ']')
228-
if closeIdx == -1 {
229-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
228+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
229+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
230230
} else {
231231
keyaRaw := keyRaw[openIdx+1 : closeIdx]
232232
v, err2 := strconv.ParseInt(keyaRaw, 10, strconv.IntSize)

‎http/codegen/testdata/payload_decode_functions.go‎

Lines changed: 54 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -1539,8 +1539,8 @@ func DecodeMethodQueryMapStringStringRequest(mux goahttp.Muxer, decoder func(*ht
15391539
{
15401540
openIdx := strings.IndexRune(keyRaw, '[')
15411541
closeIdx := strings.IndexRune(keyRaw, ']')
1542-
if closeIdx == -1 {
1543-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
1542+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
1543+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
15441544
} else {
15451545
keya = keyRaw[openIdx+1 : closeIdx]
15461546
}
@@ -1583,8 +1583,8 @@ func DecodeMethodQueryMapStringStringValidateRequest(mux goahttp.Muxer, decoder
15831583
{
15841584
openIdx := strings.IndexRune(keyRaw, '[')
15851585
closeIdx := strings.IndexRune(keyRaw, ']')
1586-
if closeIdx == -1 {
1587-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
1586+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
1587+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
15881588
} else {
15891589
keya = keyRaw[openIdx+1 : closeIdx]
15901590
}
@@ -1634,8 +1634,8 @@ func DecodeMethodQueryMapStringBoolRequest(mux goahttp.Muxer, decoder func(*http
16341634
{
16351635
openIdx := strings.IndexRune(keyRaw, '[')
16361636
closeIdx := strings.IndexRune(keyRaw, ']')
1637-
if closeIdx == -1 {
1638-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
1637+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
1638+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
16391639
} else {
16401640
keya = keyRaw[openIdx+1 : closeIdx]
16411641
}
@@ -1687,8 +1687,8 @@ func DecodeMethodQueryMapStringBoolValidateRequest(mux goahttp.Muxer, decoder fu
16871687
{
16881688
openIdx := strings.IndexRune(keyRaw, '[')
16891689
closeIdx := strings.IndexRune(keyRaw, ']')
1690-
if closeIdx == -1 {
1691-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
1690+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
1691+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
16921692
} else {
16931693
keya = keyRaw[openIdx+1 : closeIdx]
16941694
}
@@ -1747,8 +1747,8 @@ func DecodeMethodQueryMapBoolStringRequest(mux goahttp.Muxer, decoder func(*http
17471747
{
17481748
openIdx := strings.IndexRune(keyRaw, '[')
17491749
closeIdx := strings.IndexRune(keyRaw, ']')
1750-
if closeIdx == -1 {
1751-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
1750+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
1751+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
17521752
} else {
17531753
keyaRaw := keyRaw[openIdx+1 : closeIdx]
17541754
v, err2 := strconv.ParseBool(keyaRaw)
@@ -1796,8 +1796,8 @@ func DecodeMethodQueryMapBoolStringValidateRequest(mux goahttp.Muxer, decoder fu
17961796
{
17971797
openIdx := strings.IndexRune(keyRaw, '[')
17981798
closeIdx := strings.IndexRune(keyRaw, ']')
1799-
if closeIdx == -1 {
1800-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
1799+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
1800+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
18011801
} else {
18021802
keyaRaw := keyRaw[openIdx+1 : closeIdx]
18031803
v, err2 := strconv.ParseBool(keyaRaw)
@@ -1852,8 +1852,8 @@ func DecodeMethodQueryMapBoolBoolRequest(mux goahttp.Muxer, decoder func(*http.R
18521852
{
18531853
openIdx := strings.IndexRune(keyRaw, '[')
18541854
closeIdx := strings.IndexRune(keyRaw, ']')
1855-
if closeIdx == -1 {
1856-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
1855+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
1856+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
18571857
} else {
18581858
keyaRaw := keyRaw[openIdx+1 : closeIdx]
18591859
v, err2 := strconv.ParseBool(keyaRaw)
@@ -1910,8 +1910,8 @@ func DecodeMethodQueryMapBoolBoolValidateRequest(mux goahttp.Muxer, decoder func
19101910
{
19111911
openIdx := strings.IndexRune(keyRaw, '[')
19121912
closeIdx := strings.IndexRune(keyRaw, ']')
1913-
if closeIdx == -1 {
1914-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
1913+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
1914+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
19151915
} else {
19161916
keyaRaw := keyRaw[openIdx+1 : closeIdx]
19171917
v, err2 := strconv.ParseBool(keyaRaw)
@@ -1976,8 +1976,8 @@ func DecodeMethodQueryMapStringArrayStringRequest(mux goahttp.Muxer, decoder fun
19761976
{
19771977
openIdx := strings.IndexRune(keyRaw, '[')
19781978
closeIdx := strings.IndexRune(keyRaw, ']')
1979-
if closeIdx == -1 {
1980-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
1979+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
1980+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
19811981
} else {
19821982
keya = keyRaw[openIdx+1 : closeIdx]
19831983
}
@@ -2020,8 +2020,8 @@ func DecodeMethodQueryMapStringArrayStringValidateRequest(mux goahttp.Muxer, dec
20202020
{
20212021
openIdx := strings.IndexRune(keyRaw, '[')
20222022
closeIdx := strings.IndexRune(keyRaw, ']')
2023-
if closeIdx == -1 {
2024-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
2023+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
2024+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
20252025
} else {
20262026
keya = keyRaw[openIdx+1 : closeIdx]
20272027
}
@@ -2072,8 +2072,8 @@ func DecodeMethodQueryMapStringArrayBoolRequest(mux goahttp.Muxer, decoder func(
20722072
{
20732073
openIdx := strings.IndexRune(keyRaw, '[')
20742074
closeIdx := strings.IndexRune(keyRaw, ']')
2075-
if closeIdx == -1 {
2076-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
2075+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
2076+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
20772077
} else {
20782078
keya = keyRaw[openIdx+1 : closeIdx]
20792079
}
@@ -2127,8 +2127,8 @@ func DecodeMethodQueryMapStringArrayBoolValidateRequest(mux goahttp.Muxer, decod
21272127
{
21282128
openIdx := strings.IndexRune(keyRaw, '[')
21292129
closeIdx := strings.IndexRune(keyRaw, ']')
2130-
if closeIdx == -1 {
2131-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
2130+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
2131+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
21322132
} else {
21332133
keya = keyRaw[openIdx+1 : closeIdx]
21342134
}
@@ -2190,8 +2190,8 @@ func DecodeMethodQueryMapBoolArrayStringRequest(mux goahttp.Muxer, decoder func(
21902190
{
21912191
openIdx := strings.IndexRune(keyRaw, '[')
21922192
closeIdx := strings.IndexRune(keyRaw, ']')
2193-
if closeIdx == -1 {
2194-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
2193+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
2194+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
21952195
} else {
21962196
keyaRaw := keyRaw[openIdx+1 : closeIdx]
21972197
v, err2 := strconv.ParseBool(keyaRaw)
@@ -2237,8 +2237,8 @@ func DecodeMethodQueryMapBoolArrayStringValidateRequest(mux goahttp.Muxer, decod
22372237
{
22382238
openIdx := strings.IndexRune(keyRaw, '[')
22392239
closeIdx := strings.IndexRune(keyRaw, ']')
2240-
if closeIdx == -1 {
2241-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
2240+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
2241+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
22422242
} else {
22432243
keyaRaw := keyRaw[openIdx+1 : closeIdx]
22442244
v, err2 := strconv.ParseBool(keyaRaw)
@@ -2294,8 +2294,8 @@ func DecodeMethodQueryMapBoolArrayBoolRequest(mux goahttp.Muxer, decoder func(*h
22942294
{
22952295
openIdx := strings.IndexRune(keyRaw, '[')
22962296
closeIdx := strings.IndexRune(keyRaw, ']')
2297-
if closeIdx == -1 {
2298-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
2297+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
2298+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
22992299
} else {
23002300
keyaRaw := keyRaw[openIdx+1 : closeIdx]
23012301
v, err2 := strconv.ParseBool(keyaRaw)
@@ -2354,8 +2354,8 @@ func DecodeMethodQueryMapBoolArrayBoolValidateRequest(mux goahttp.Muxer, decoder
23542354
{
23552355
openIdx := strings.IndexRune(keyRaw, '[')
23562356
closeIdx := strings.IndexRune(keyRaw, ']')
2357-
if closeIdx == -1 {
2358-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
2357+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
2358+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
23592359
} else {
23602360
keyaRaw := keyRaw[openIdx+1 : closeIdx]
23612361
v, err2 := strconv.ParseBool(keyaRaw)
@@ -2556,8 +2556,8 @@ func DecodeMethodQueryPrimitiveMapStringArrayStringValidateRequest(mux goahttp.M
25562556
{
25572557
openIdx := strings.IndexRune(keyRaw, '[')
25582558
closeIdx := strings.IndexRune(keyRaw, ']')
2559-
if closeIdx == -1 {
2560-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
2559+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
2560+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
25612561
} else {
25622562
keya = keyRaw[openIdx+1 : closeIdx]
25632563
}
@@ -2611,8 +2611,8 @@ func DecodeMethodQueryPrimitiveMapStringBoolValidateRequest(mux goahttp.Muxer, d
26112611
{
26122612
openIdx := strings.IndexRune(keyRaw, '[')
26132613
closeIdx := strings.IndexRune(keyRaw, ']')
2614-
if closeIdx == -1 {
2615-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
2614+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
2615+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
26162616
} else {
26172617
keya = keyRaw[openIdx+1 : closeIdx]
26182618
}
@@ -2672,8 +2672,8 @@ func DecodeMethodQueryPrimitiveMapBoolArrayBoolValidateRequest(mux goahttp.Muxer
26722672
{
26732673
openIdx := strings.IndexRune(keyRaw, '[')
26742674
closeIdx := strings.IndexRune(keyRaw, ']')
2675-
if closeIdx == -1 {
2676-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
2675+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
2676+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
26772677
} else {
26782678
keyaRaw := keyRaw[openIdx+1 : closeIdx]
26792679
v, err2 := strconv.ParseBool(keyaRaw)
@@ -2747,8 +2747,8 @@ func DecodeMethodQueryMapStringMapIntStringValidateRequest(mux goahttp.Muxer, de
27472747
{
27482748
openIdx := strings.IndexRune(keyRaw, '[')
27492749
closeIdx := strings.IndexRune(keyRaw, ']')
2750-
if closeIdx == -1 {
2751-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
2750+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
2751+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
27522752
} else {
27532753
keya = keyRaw[openIdx+1 : closeIdx]
27542754
keyRaw = keyRaw[closeIdx+1:]
@@ -2761,8 +2761,8 @@ func DecodeMethodQueryMapStringMapIntStringValidateRequest(mux goahttp.Muxer, de
27612761
{
27622762
openIdx := strings.IndexRune(keyRaw, '[')
27632763
closeIdx := strings.IndexRune(keyRaw, ']')
2764-
if closeIdx == -1 {
2765-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
2764+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
2765+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
27662766
} else {
27672767
keybRaw := keyRaw[openIdx+1 : closeIdx]
27682768
v, err2 := strconv.ParseInt(keybRaw, 10, strconv.IntSize)
@@ -2814,8 +2814,8 @@ func DecodeMethodQueryMapIntMapStringArrayIntValidateRequest(mux goahttp.Muxer,
28142814
{
28152815
openIdx := strings.IndexRune(keyRaw, '[')
28162816
closeIdx := strings.IndexRune(keyRaw, ']')
2817-
if closeIdx == -1 {
2818-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
2817+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
2818+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
28192819
} else {
28202820
keyaRaw := keyRaw[openIdx+1 : closeIdx]
28212821
v, err2 := strconv.ParseInt(keyaRaw, 10, strconv.IntSize)
@@ -2833,8 +2833,8 @@ func DecodeMethodQueryMapIntMapStringArrayIntValidateRequest(mux goahttp.Muxer,
28332833
{
28342834
openIdx := strings.IndexRune(keyRaw, '[')
28352835
closeIdx := strings.IndexRune(keyRaw, ']')
2836-
if closeIdx == -1 {
2837-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
2836+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
2837+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
28382838
} else {
28392839
keyb = keyRaw[openIdx+1 : closeIdx]
28402840
}
@@ -5161,8 +5161,8 @@ func DecodeMapQueryPrimitivePrimitiveRequest(mux goahttp.Muxer, decoder func(*ht
51615161
{
51625162
openIdx := strings.IndexRune(keyRaw, '[')
51635163
closeIdx := strings.IndexRune(keyRaw, ']')
5164-
if closeIdx == -1 {
5165-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
5164+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
5165+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
51665166
} else {
51675167
keya = keyRaw[openIdx+1 : closeIdx]
51685168
}
@@ -5203,8 +5203,8 @@ func DecodeMapQueryPrimitiveArrayRequest(mux goahttp.Muxer, decoder func(*http.R
52035203
{
52045204
openIdx := strings.IndexRune(keyRaw, '[')
52055205
closeIdx := strings.IndexRune(keyRaw, ']')
5206-
if closeIdx == -1 {
5207-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
5206+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
5207+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
52085208
} else {
52095209
keya = keyRaw[openIdx+1 : closeIdx]
52105210
}
@@ -5662,8 +5662,8 @@ func DecodeMethodARequest(mux goahttp.Muxer, decoder func(*http.Request) goahttp
56625662
{
56635663
openIdx := strings.IndexRune(keyRaw, '[')
56645664
closeIdx := strings.IndexRune(keyRaw, ']')
5665-
if closeIdx == -1 {
5666-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
5665+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
5666+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
56675667
} else {
56685668
keyaRaw := keyRaw[openIdx+1 : closeIdx]
56695669
v, err2 := strconv.ParseFloat(keyaRaw, 32)
@@ -5717,8 +5717,8 @@ func DecodeMethodARequest(mux goahttp.Muxer, decoder func(*http.Request) goahttp
57175717
{
57185718
openIdx := strings.IndexRune(keyRaw, '[')
57195719
closeIdx := strings.IndexRune(keyRaw, ']')
5720-
if closeIdx == -1 {
5721-
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
5720+
if openIdx == -1 || closeIdx == -1 || closeIdx <= openIdx {
5721+
err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: malformed brackets"))
57225722
} else {
57235723
keyaRaw := keyRaw[openIdx+1 : closeIdx]
57245724
v, err2 := strconv.ParseFloat(keyaRaw, 32)

0 commit comments

Comments
 (0)