llvy.ltd/casdoor
1
0
Fork 0
mirror of https://github.com/casdoor/casdoor.git synced 2025-07-03 04:10:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: Gosec/sec fixes (#2004)

Browse Source 
* Customization of the initialization file

* fix: G601 (CWE-118): Implicit memory aliasing in for loop

* fix: G304 (CWE-22): Potential file inclusion via variable

* fix: G110 (CWE-409): Potential DoS vulnerability via decompression bomb
This commit is contained in:
Alex OvsInc
2023-06-21 13:55:20 +03:00
committed by GitHub
parent d505a4bf2d
commit 6ebca6dbe7
11 changed files with 25 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
object/saml_idp.go
View File

@ -260,10 +260,17 @@ func GetSamlResponse(application *Application, user *User, samlRequest string, h
// decompress
var buffer bytes.Buffer
rdr := flate.NewReader(bytes.NewReader(defated))
_, err = io.Copy(&buffer, rdr)
if err != nil {
return "", "", "", err
for {
_, err := io.CopyN(&buffer, rdr, 1024)
if err != nil {
if err == io.EOF {
break
}
return "", "", "", err
}
}
var authnRequest saml.AuthnRequest
err = xml.Unmarshal(buffer.Bytes(), &authnRequest)
if err != nil {