britram / borat Goto Github PK

CBORReader needs a way to implement object size limits (e.g., for parser DoS defense). Add a limit field to the CBORReader struct, start counting against the limit when a "top-level" read begins, and return an error when the limit is exceeded.

If a struct like the following is passed to the Unmarshaler, then it is unclear as to how the unmarshaler would know which concrete type to fill into the struct field:

type ConvolutedIndirectable interface {
  ConvolutedIndirection() int
}

type Indirector struct {
  I int
}

func (i *Indirector) ConvolutedIndirection() int {
  return i.I
}

type One struct {
  A ConvolutedIndirectable
}

func main() {
  reader := ...
  var o One
  if err := reader.Unmarshal(&o); err != nil {
    ...
  }
}

When the struct is marshaled the information about what struct was actually in the interface is lost, only an un-type-annotated map is transferred via CBOR, so it does not seem possible to work out what type to create to put in this field when unmarshaling.

The struct cache should not have to learn the struct each time it unmarshals it (possibly recursively), just store the global struct name in a cache and retrieve it from there each time or create it once and put it there.

see §2.2 of RFC7011