this repo has no description
cmd/cue: import -R: don't treat text with no newlines as YAML
To avoid potentially dangerous false positives, change the `import --recursive`
logic to avoid treating any single-line text as YAML.
Fixes #1443.
Change-Id: I65bb7974dac35f04b27127471980fcb5ffc562cd
Reviewed-on: https://review.gerrithub.io/c/cue-lang/cue/+/536902
Reviewed-by: Marcel van Lohuizen <mpvl@gmail.com>
+13
-14
+8
cmd/cue/cmd/import.go
+8
cmd/cue/cmd/import.go
···
15
15
package cmd
16
16
17
17
import (
18
+
"bytes"
18
19
"fmt"
19
20
"io/ioutil"
20
21
"os"
···
581
582
return nil, ""
582
583
}
583
584
return expr, "json"
585
+
}
586
+
// When a string has no newlines, never treat it as
587
+
// YAML because there's too much risk of false positives
588
+
// with regular-expressions or other such syntax.
589
+
// See issue 1443.
590
+
if bytes.IndexByte(b, '\n') == -1 {
591
+
return nil, ""
584
592
}
585
593
586
594
if expr, err := yaml.Unmarshal("", b); err == nil {
+5
-14
cmd/cue/cmd/testdata/script/import_hoiststr.txt
+5
-14
cmd/cue/cmd/testdata/script/import_hoiststr.txt
···
28
28
nocodec2: "1234"
29
29
nocodec3: "null"
30
30
nocodec4: "true"
31
-
nocodec5: yaml656e63.Marshal(_cue_nocodec5)
32
-
let _cue_nocodec5 = ["a-z"]
33
-
nocodec6: yaml656e63.Marshal(_cue_nocodec6)
34
-
let _cue_nocodec6 = {
35
-
a: 123
36
-
}
37
-
nocodec7: yaml656e63.Marshal(_cue_nocodec7)
38
-
let _cue_nocodec7 = ["a-z"]
39
-
nocodec8: yaml656e63.Marshal(_cue_nocodec8)
40
-
let _cue_nocodec8 = ["a"]
41
-
nocodec9: yaml656e63.Marshal(_cue_nocodec9)
42
-
let _cue_nocodec9 = {
43
-
a: 1, b: 2
44
-
}
31
+
nocodec5: "[a-z]+"
32
+
nocodec6: "a: 123"
33
+
nocodec7: "[a-z]+"
34
+
nocodec8: "[a]"
35
+
nocodec9: "{a: 1, b: 2}"
45
36
}
46
37
-- import/data.json --
47
38
{