cue: limit validation depth
This is a temporary workaround to not having an
occurs check. See Issue #29.
Change-Id: I2d6f3bfe3493322cf507e0088d415afaf97bda4f
Reviewed-on: https://cue-review.googlesource.com/c/cue/+/2365
Reviewed-by: Marcel van Lohuizen <mpvl@golang.org>
diff --git a/cue/context.go b/cue/context.go
index 9fc5d13..9fa7323 100644
--- a/cue/context.go
+++ b/cue/context.go
@@ -42,6 +42,10 @@
// tracing
trace bool
level int
+
+ // TODO: replace with proper structural cycle detection/ occurs check.
+ // See Issue #29.
+ maxDepth int
}
func (c *context) incEvalDepth() {
diff --git a/cue/validate.go b/cue/validate.go
index 15c2e23..5cdbce4 100644
--- a/cue/validate.go
+++ b/cue/validate.go
@@ -23,11 +23,16 @@
switch x := eval.(type) {
case *structLit:
x = x.expandFields(ctx)
+ if ctx.maxDepth++; ctx.maxDepth > 20 {
+ return nil
+ }
for i := range x.arcs {
if err := validate(ctx, x.at(ctx, i)); err != nil {
+ ctx.maxDepth--
return err
}
}
+ ctx.maxDepth--
case *list:
// TODO: also validate types for open lists?
return validate(ctx, x.elem)
