Skip to content

THRIFT-6047: Limit struct/union/exception read/write recursion depth in PHP library #3552

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Jens-G wants to merge 1 commit into
base: master
Choose a base branch
from
+401 −121
Open

THRIFT-6047: Limit struct/union/exception read/write recursion depth in PHP library #3552

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,12 +201,16 @@ jobs:
mkdir -p ./lib/php/test/Resources/packages/phpvo
mkdir -p ./lib/php/test/Resources/packages/phpjs
mkdir -p ./lib/php/test/Resources/packages/phpcm
mkdir -p ./lib/php/test/Resources/packages/phprec
mkdir -p ./lib/php/test/Resources/packages/phprecoop
compiler/cpp/thrift --gen php:nsglobal="Basic" -r --out ./lib/php/test/Resources/packages/php lib/php/test/Resources/ThriftTest.thrift
compiler/cpp/thrift --gen php:inlined,nsglobal="BasicInline" -r --out ./lib/php/test/Resources/packages/phpi lib/php/test/Resources/ThriftTest.thrift
compiler/cpp/thrift --gen php:validate,nsglobal="Validate" -r --out ./lib/php/test/Resources/packages/phpv lib/php/test/Resources/ThriftTest.thrift
compiler/cpp/thrift --gen php:validate,oop,nsglobal="ValidateOop" -r --out ./lib/php/test/Resources/packages/phpvo lib/php/test/Resources/ThriftTest.thrift
compiler/cpp/thrift --gen php:json,nsglobal="Json" -r --out ./lib/php/test/Resources/packages/phpjs lib/php/test/Resources/ThriftTest.thrift
compiler/cpp/thrift --gen php:classmap,server,rest,nsglobal="Classmap" -r --out ./lib/php/test/Resources/packages/phpcm lib/php/test/Resources/ThriftTest.thrift
compiler/cpp/thrift --gen php:nsglobal="PhpRec" -r --out ./lib/php/test/Resources/packages/phprec lib/php/test/Resources/RecursionDepth.thrift
compiler/cpp/thrift --gen php:oop,nsglobal="PhpRecOop" -r --out ./lib/php/test/Resources/packages/phprecoop lib/php/test/Resources/RecursionDepth.thrift

- name: Run Tests
run: vendor/bin/phpunit -c lib/php/phpunit.xml
Expand Down
18 changes: 18 additions & 0 deletions compiler/cpp/src/thrift/generate/t_php_generator.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1144,6 +1144,9 @@ void t_php_generator::generate_php_struct_reader(ostream& out, t_struct* tstruct

// Declare stack tmp variables
if (!binary_inline_) {
indent(out) << "$input->incrementRecursionDepth();" << '\n';
indent(out) << "try {" << '\n';
indent_up();
indent(out) << "$xfer += $input->readStructBegin($fname);" << '\n';
}

Expand Down Expand Up @@ -1222,6 +1225,12 @@ void t_php_generator::generate_php_struct_reader(ostream& out, t_struct* tstruct

if (!binary_inline_) {
indent(out) << "$xfer += $input->readStructEnd();" << '\n';
indent_down();
indent(out) << "} finally {" << '\n';
indent_up();
indent(out) << "$input->decrementRecursionDepth();" << '\n';
indent_down();
indent(out) << "}" << '\n';
}

if (needs_php_read_validator(tstruct, is_result)) {
Expand Down Expand Up @@ -1265,6 +1274,9 @@ void t_php_generator::generate_php_struct_writer(ostream& out, t_struct* tstruct
indent(out) << "$xfer = 0;" << '\n';

if (!binary_inline_) {
indent(out) << "$output->incrementRecursionDepth();" << '\n';
indent(out) << "try {" << '\n';
indent_up();
indent(out) << "$xfer += $output->writeStructBegin('" << name << "');" << '\n';
}

Expand Down Expand Up @@ -1317,6 +1329,12 @@ void t_php_generator::generate_php_struct_writer(ostream& out, t_struct* tstruct
} else {
out << indent() << "$xfer += $output->writeFieldStop();" << '\n' << indent()
<< "$xfer += $output->writeStructEnd();" << '\n';
indent_down();
out << indent() << "} finally {" << '\n';
indent_up();
out << indent() << "$output->decrementRecursionDepth();" << '\n';
indent_down();
out << indent() << "}" << '\n';
}

out << '\n';
Expand Down
130 changes: 70 additions & 60 deletions lib/php/lib/Base/TBase.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -216,47 +216,52 @@ protected function readStruct(string $class, array $spec, TProtocol $input): int
$fname = null;
$ftype = 0;
$fid = 0;
$xfer += $input->readStructBegin($fname);
while (true) {
$xfer += $input->readFieldBegin($fname, $ftype, $fid);
if ($ftype == TType::STOP) {
break;
}
if (isset($spec[$fid])) {
$fspec = $spec[$fid];
$var = $fspec['var'];
if ($ftype == $fspec['type']) {
$xfer = 0;
if (isset(TBase::$tmethod[$ftype])) {
$func = 'read' . TBase::$tmethod[$ftype];
$xfer += $input->$func($this->$var);
} else {
switch ($ftype) {
case TType::STRUCT:
$class = $fspec['class'];
$this->$var = new $class();
$xfer += $this->$var->read($input);
break;
case TType::MAP:
$xfer += $this->readMap($this->$var, $fspec, $input);
break;
case TType::LST:
$xfer += $this->readList($this->$var, $fspec, $input, false);
break;
case TType::SET:
$xfer += $this->readList($this->$var, $fspec, $input, true);
break;
$input->incrementRecursionDepth();
try {
$xfer += $input->readStructBegin($fname);
while (true) {
$xfer += $input->readFieldBegin($fname, $ftype, $fid);
if ($ftype == TType::STOP) {
break;
}
if (isset($spec[$fid])) {
$fspec = $spec[$fid];
$var = $fspec['var'];
if ($ftype == $fspec['type']) {
$xfer = 0;
if (isset(TBase::$tmethod[$ftype])) {
$func = 'read' . TBase::$tmethod[$ftype];
$xfer += $input->$func($this->$var);
} else {
switch ($ftype) {
case TType::STRUCT:
$class = $fspec['class'];
$this->$var = new $class();
$xfer += $this->$var->read($input);
break;
case TType::MAP:
$xfer += $this->readMap($this->$var, $fspec, $input);
break;
case TType::LST:
$xfer += $this->readList($this->$var, $fspec, $input, false);
break;
case TType::SET:
$xfer += $this->readList($this->$var, $fspec, $input, true);
break;
}
}
} else {
$xfer += $input->skip($ftype);
}
} else {
$xfer += $input->skip($ftype);
}
} else {
$xfer += $input->skip($ftype);
$xfer += $input->readFieldEnd();
}
$xfer += $input->readFieldEnd();
$xfer += $input->readStructEnd();
} finally {
$input->decrementRecursionDepth();
}
$xfer += $input->readStructEnd();

return $xfer;
}
Expand Down Expand Up @@ -380,36 +385,41 @@ private function writeList(array $var, array $spec, TProtocol $output, bool $set
protected function writeStruct(string $class, array $spec, TProtocol $output): int
Comment thread
sveneld marked this conversation as resolved.
{
$xfer = 0;
$xfer += $output->writeStructBegin($class);
foreach ($spec as $fid => $fspec) {
$var = $fspec['var'];
if ($this->$var !== null) {
$ftype = $fspec['type'];
$xfer += $output->writeFieldBegin($var, $ftype, $fid);
if (isset(TBase::$tmethod[$ftype])) {
$func = 'write' . TBase::$tmethod[$ftype];
$xfer += $output->$func($this->$var);
} else {
switch ($ftype) {
case TType::STRUCT:
$xfer += $this->$var->write($output);
break;
case TType::MAP:
$xfer += $this->writeMap($this->$var, $fspec, $output);
break;
case TType::LST:
$xfer += $this->writeList($this->$var, $fspec, $output, false);
break;
case TType::SET:
$xfer += $this->writeList($this->$var, $fspec, $output, true);
break;
$output->incrementRecursionDepth();
try {
$xfer += $output->writeStructBegin($class);
foreach ($spec as $fid => $fspec) {
$var = $fspec['var'];
if ($this->$var !== null) {
$ftype = $fspec['type'];
$xfer += $output->writeFieldBegin($var, $ftype, $fid);
if (isset(TBase::$tmethod[$ftype])) {
$func = 'write' . TBase::$tmethod[$ftype];
$xfer += $output->$func($this->$var);
} else {
switch ($ftype) {
case TType::STRUCT:
$xfer += $this->$var->write($output);
break;
case TType::MAP:
$xfer += $this->writeMap($this->$var, $fspec, $output);
break;
case TType::LST:
$xfer += $this->writeList($this->$var, $fspec, $output, false);
break;
case TType::SET:
$xfer += $this->writeList($this->$var, $fspec, $output, true);
break;
}
}
$xfer += $output->writeFieldEnd();
}
$xfer += $output->writeFieldEnd();
}
$xfer += $output->writeFieldStop();
$xfer += $output->writeStructEnd();
} finally {
$output->decrementRecursionDepth();
}
$xfer += $output->writeFieldStop();
$xfer += $output->writeStructEnd();

return $xfer;
}
Expand Down
130 changes: 70 additions & 60 deletions lib/php/lib/Exception/TException.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,47 +215,52 @@ protected function readStruct(string $class, array $spec, TProtocol $input): int
$fname = null;
$ftype = 0;
$fid = 0;
$xfer += $input->readStructBegin($fname);
while (true) {
$xfer += $input->readFieldBegin($fname, $ftype, $fid);
if ($ftype == TType::STOP) {
break;
}
if (isset($spec[$fid])) {
$fspec = $spec[$fid];
$var = $fspec['var'];
if ($ftype == $fspec['type']) {
$xfer = 0;
if (isset(TBase::$tmethod[$ftype])) {
$func = 'read' . TBase::$tmethod[$ftype];
$xfer += $input->$func($this->$var);
} else {
switch ($ftype) {
case TType::STRUCT:
$class = $fspec['class'];
$this->$var = new $class();
$xfer += $this->$var->read($input);
break;
case TType::MAP:
$xfer += $this->readMap($this->$var, $fspec, $input);
break;
case TType::LST:
$xfer += $this->readList($this->$var, $fspec, $input, false);
break;
case TType::SET:
$xfer += $this->readList($this->$var, $fspec, $input, true);
break;
$input->incrementRecursionDepth();
try {
$xfer += $input->readStructBegin($fname);
while (true) {
$xfer += $input->readFieldBegin($fname, $ftype, $fid);
if ($ftype == TType::STOP) {
break;
}
if (isset($spec[$fid])) {
$fspec = $spec[$fid];
$var = $fspec['var'];
if ($ftype == $fspec['type']) {
$xfer = 0;
if (isset(TBase::$tmethod[$ftype])) {
$func = 'read' . TBase::$tmethod[$ftype];
$xfer += $input->$func($this->$var);
} else {
switch ($ftype) {
case TType::STRUCT:
$class = $fspec['class'];
$this->$var = new $class();
$xfer += $this->$var->read($input);
break;
case TType::MAP:
$xfer += $this->readMap($this->$var, $fspec, $input);
break;
case TType::LST:
$xfer += $this->readList($this->$var, $fspec, $input, false);
break;
case TType::SET:
$xfer += $this->readList($this->$var, $fspec, $input, true);
break;
}
}
} else {
$xfer += $input->skip($ftype);
}
} else {
$xfer += $input->skip($ftype);
}
} else {
$xfer += $input->skip($ftype);
$xfer += $input->readFieldEnd();
}
$xfer += $input->readFieldEnd();
$xfer += $input->readStructEnd();
} finally {
$input->decrementRecursionDepth();
}
$xfer += $input->readStructEnd();

return $xfer;
}
Expand Down Expand Up @@ -379,36 +384,41 @@ private function writeList(array $var, array $spec, TProtocol $output, bool $set
protected function writeStruct(string $class, array $spec, TProtocol $output): int
{
$xfer = 0;
$xfer += $output->writeStructBegin($class);
foreach ($spec as $fid => $fspec) {
$var = $fspec['var'];
if ($this->$var !== null) {
$ftype = $fspec['type'];
$xfer += $output->writeFieldBegin($var, $ftype, $fid);
if (isset(TBase::$tmethod[$ftype])) {
$func = 'write' . TBase::$tmethod[$ftype];
$xfer += $output->$func($this->$var);
} else {
switch ($ftype) {
case TType::STRUCT:
$xfer += $this->$var->write($output);
break;
case TType::MAP:
$xfer += $this->writeMap($this->$var, $fspec, $output);
break;
case TType::LST:
$xfer += $this->writeList($this->$var, $fspec, $output, false);
break;
case TType::SET:
$xfer += $this->writeList($this->$var, $fspec, $output, true);
break;
$output->incrementRecursionDepth();
try {
$xfer += $output->writeStructBegin($class);
foreach ($spec as $fid => $fspec) {
$var = $fspec['var'];
if ($this->$var !== null) {
$ftype = $fspec['type'];
$xfer += $output->writeFieldBegin($var, $ftype, $fid);
if (isset(TBase::$tmethod[$ftype])) {
$func = 'write' . TBase::$tmethod[$ftype];
$xfer += $output->$func($this->$var);
} else {
switch ($ftype) {
case TType::STRUCT:
$xfer += $this->$var->write($output);
break;
case TType::MAP:
$xfer += $this->writeMap($this->$var, $fspec, $output);
break;
case TType::LST:
$xfer += $this->writeList($this->$var, $fspec, $output, false);
break;
case TType::SET:
$xfer += $this->writeList($this->$var, $fspec, $output, true);
break;
}
}
$xfer += $output->writeFieldEnd();
}
$xfer += $output->writeFieldEnd();
}
$xfer += $output->writeFieldStop();
$xfer += $output->writeStructEnd();
} finally {
$output->decrementRecursionDepth();
}
$xfer += $output->writeFieldStop();
$xfer += $output->writeStructEnd();

return $xfer;
}
Expand Down
Loading
Loading