templates: add safeguard against building very long strings

Author: jogramming

common/templates/general.go

@@ -364,32 +364,48 @@ func tmplRoundEven(args ...interface{}) float64 {
 	return math.RoundToEven(ToFloat64(args[0]))
 }
 
-func joinStrings(sep string, args ...interface{}) string {
+var ErrStringTooLong = errors.NewPlain("String is too long (max 1MB)")
 
-	out := ""
+const MaxStringLength = 1000000
+
+func joinStrings(sep string, args ...interface{}) (string, error) {
+
+	var builder strings.Builder
 
 	for _, v := range args {
+		if builder.Len() != 0 {
+			builder.WriteString(sep)
+		}
+
 		switch t := v.(type) {
+
 		case string:
-			if out != "" {
-				out += sep
-			}
+			builder.WriteString(t)
 
-			out += t
 		case []string:
-			for _, s := range t {
-				if out != "" {
-					out += sep
+			for j, s := range t {
+				if j != 0 {
+					builder.WriteString(sep)
 				}
 
-				out += s
+				builder.WriteString(s)
+				if builder.Len() > MaxStringLength {
+					return "", ErrStringTooLong
+				}
 			}
+
 		case int, int32, uint32, int64, uint64:
-			out += ToString(v)
+			builder.WriteString(ToString(v))
+
 		}
+
+		if builder.Len() > MaxStringLength {
+			return "", ErrStringTooLong
+		}
+
 	}
 
-	return out
+	return builder.String(), nil
 }
 
 func sequence(start, stop int) ([]int, error) {

common/templates/general_test.go

@@ -3,23 +3,45 @@ package templates
 import (
 	"reflect"
 	"strconv"
+	"strings"
 	"testing"
 )
 
+func buildLongStr(length int) string {
+	var b strings.Builder
+
+	for i := 0; i < length; i++ {
+		b.WriteString("A")
+	}
+
+	return b.String()
+}
+
 func TestJoinStrings(t *testing.T) {
+
+	longString := buildLongStr(1000000)
+
 	cases := []struct {
 		sep            string
 		args           []interface{}
 		expectedResult string
+		shouldError    bool
 	}{
-		{" ", []interface{}{"hello", "world"}, "hello world"},
-		{",", []interface{}{"hello", []string{"world", "!"}}, "hello,world,!"},
-		{" ", []interface{}{[]string{"hello", "world", "!"}}, "hello world !"},
+		{" ", []interface{}{"hello", "world"}, "hello world", false},
+		{" ", []interface{}{"hello", "world", longString}, "", true},
+		{",", []interface{}{"hello", []string{"world", "!"}}, "hello,world,!", false},
+		{" ", []interface{}{[]string{"hello", "world", "!"}}, "hello world !", false},
+		{" ", []interface{}{[]string{"hello", "world", "!", longString}}, "", true},
 	}
 
 	for i, c := range cases {
 		t.Run("case #"+strconv.Itoa(i), func(t *testing.T) {
-			joined := joinStrings(c.sep, c.args...)
+			joined, err := joinStrings(c.sep, c.args...)
+			if err != nil && !c.shouldError {
+				t.Errorf("Should not have errored out")
+			} else if err == nil && c.shouldError {
+				t.Errorf("Should have errored out")
+			}
 			if joined != c.expectedResult {
 				t.Error("Unexpected result, got ", joined, ", expected ", c.expectedResult)
 			}