Fix recursion loop in decoding of a SingleValueContainer (#88)

* Fix for recursion loop in decoding * Update test per PR feedback
vapor · Apr 13, 2023 · 1adfd69 · 1adfd69
1 parent 3a31859
commit 1adfd69
Show file tree

Hide file tree

Showing 3 changed files with 28 additions and 1 deletion.
diff --git a/Sources/MultipartKit/FormDataDecoder/FormDataDecoder.Decoder.swift b/Sources/MultipartKit/FormDataDecoder/FormDataDecoder.Decoder.swift
@@ -3,6 +3,16 @@ extension FormDataDecoder {
         let codingPath: [CodingKey]
         let data: MultipartFormData
         let userInfo: [CodingUserInfoKey: Any]
+        let previousCodingPath : [CodingKey]?
+        let previousType: Decodable.Type?
+
+        init(codingPath: [CodingKey], data: MultipartFormData, userInfo: [CodingUserInfoKey: Any], previousCodingPath: [CodingKey]? = nil, previousType: Decodable.Type? = nil) {
+            self.codingPath = codingPath
+            self.data = data
+            self.userInfo = userInfo
+            self.previousCodingPath = previousCodingPath
+            self.previousType = previousType
+        }
     }
 }
 

diff --git a/Sources/MultipartKit/FormDataDecoder/FormDataDecoder.SingleValueContainer.swift b/Sources/MultipartKit/FormDataDecoder/FormDataDecoder.SingleValueContainer.swift
@@ -8,7 +8,10 @@ extension FormDataDecoder.Decoder: SingleValueDecodingContainer {
             let part = data.part,
             let Convertible = T.self as? MultipartPartConvertible.Type
         else {
-            return try T(from: self)
+            guard previousCodingPath?.count != codingPath.count || previousType != T.self else {
+                throw DecodingError.dataCorrupted(.init(codingPath: codingPath, debugDescription: "Decoding caught in recursion loop"))
+            }
+            return try T(from: FormDataDecoder.Decoder(codingPath: codingPath, data: data, userInfo: userInfo, previousCodingPath: codingPath, previousType: T.self))
         }
 
         guard !data.hasExceededNestingDepth else {

diff --git a/Tests/MultipartKitTests/FormDataTests.swift b/Tests/MultipartKitTests/FormDataTests.swift
@@ -493,4 +493,18 @@ class FormDataTests: XCTestCase {
         XCTAssertEqual(try FormDataEncoder().encode(license, boundary: "-"), multipart)
         XCTAssertEqual(try FormDataDecoder().decode(License.self, from: multipart, boundary: "-"), license)
     }
+
+    func testIncorrectlyNestedData() throws {
+        struct TestData : Codable {
+            var x: String
+        }
+        let multipart = """
+                   ---\r
+                   Content-Disposition: form-data; name="x[not-present]"\r
+                   \r
+                   foo\r
+                   -----\r
+                   """
+        XCTAssertThrowsError (try FormDataDecoder().decode(TestData.self, from: multipart, boundary: "-"))
+    }
 }