From 16de272a08c6d6822c53a6467795cdbf402b9af1 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Tue, 3 Nov 2026 15:40:42 +0100 Subject: [PATCH] vendor: go.yaml.in/yaml/v2 v2.4.5 v2: Fix YAML unmarshaler validation bypass Quoted null and tilde scalars bypass UnmarshalYAML, allowing invalid values to escape application-defined validation. In applications accepting configuration from less-trusted sources, this can lead to denial of service or shared configuration corruption. Require implicit scalar resolution before treating untagged scalars as null. Add regression tests covering custom validation, both quote styles, explicit tags, and actual null values. full diff: https://github.com/yaml/go-yaml/compare/v2.4.4...v2.4.5 Signed-off-by: Sebastiaan van Stijn --- go.mod | 2 +- go.sum | 4 ++-- vendor/go.yaml.in/yaml/v2/decode.go | 4 +++- vendor/modules.txt | 2 +- 4 files changed, 7 insertions(+), 5 deletions(-) diff --git a/go.mod b/go.mod index b46717d621..f75301910d 100644 --- a/go.mod +++ b/go.mod @@ -293,7 +293,7 @@ require ( go.opentelemetry.io/proto/otlp v1.11.1 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.28.0 // indirect - go.yaml.in/yaml/v2 v2.4.4 // indirect + go.yaml.in/yaml/v2 v2.4.5 // indirect go.yaml.in/yaml/v3 v3.0.6 // indirect golang.org/x/crypto v0.58.0 // indirect golang.org/x/mod v0.42.0 // indirect diff --git a/go.sum b/go.sum index 80abf72e77..c7332a9d54 100644 --- a/go.sum +++ b/go.sum @@ -766,8 +766,8 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo= go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q= -go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= -go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= +go.yaml.in/yaml/v2 v2.4.5 h1:a5nxWvYi94DRl6QSLlTbLpVmutgx2qg8EVjnJtuFpwI= +go.yaml.in/yaml/v2 v2.4.5/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= go.yaml.in/yaml/v3 v3.0.6 h1:zcDfvjXEqTQmpjniUBLc91xYJMB2c4QOFxEF/LCEckM= go.yaml.in/yaml/v3 v3.0.6/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= diff --git a/vendor/go.yaml.in/yaml/v2/decode.go b/vendor/go.yaml.in/yaml/v2/decode.go index 129bc2a97d..903f30a819 100644 --- a/vendor/go.yaml.in/yaml/v2/decode.go +++ b/vendor/go.yaml.in/yaml/v2/decode.go @@ -295,7 +295,9 @@ func (d *decoder) callUnmarshaler(n *node, u Unmarshaler) (good bool) { // // If n holds a null value, prepare returns before doing anything. func (d *decoder) prepare(n *node, out reflect.Value) (newout reflect.Value, unmarshaled, good bool) { - if n.tag == yaml_NULL_TAG || n.kind == scalarNode && n.tag == "" && (n.value == "null" || n.value == "~" || n.value == "" && n.implicit) { + if n.tag == yaml_NULL_TAG || + n.kind == scalarNode && n.tag == "" && n.implicit && + (n.value == "null" || n.value == "~" || n.value == "") { return out, false, false } again := true diff --git a/vendor/modules.txt b/vendor/modules.txt index 78eda7ce4d..4de398c2cd 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1971,7 +1971,7 @@ go.uber.org/zap/internal/exit go.uber.org/zap/internal/pool go.uber.org/zap/internal/stacktrace go.uber.org/zap/zapcore -# go.yaml.in/yaml/v2 v2.4.4 +# go.yaml.in/yaml/v2 v2.4.5 ## explicit; go 1.15 go.yaml.in/yaml/v2 # go.yaml.in/yaml/v3 v3.0.6