From: Roland Shoemaker Date: Wed, 28 Sep 2022 21:41:30 +0000 (-0700) Subject: encoding/gob: add top level security doc X-Git-Tag: go1.20rc1~852 X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=13d48bb6a1ad3787c10fbbe4265ad11672d90a37;p=gostls13.git encoding/gob: add top level security doc Add a slightly expanded version of the Decoder type comment to the top level package doc, which explains that this package is not designed to be hardened against adversarial inputs. Change-Id: I8b83433838c8235eb06ded99041fdf726c811ee5 Reviewed-on: https://go-review.googlesource.com/c/go/+/436096 TryBot-Result: Gopher Robot Run-TryBot: Roland Shoemaker Auto-Submit: Roland Shoemaker Reviewed-by: Damien Neil --- diff --git a/src/encoding/gob/doc.go b/src/encoding/gob/doc.go index 306d395d5b..04cb0ac471 100644 --- a/src/encoding/gob/doc.go +++ b/src/encoding/gob/doc.go @@ -276,6 +276,13 @@ document for background: https://golang.org/doc/go1compat See "Gobs of data" for a design discussion of the gob wire format: https://blog.golang.org/gobs-of-data + +# Security + +This package is not designed to be hardened against adversarial inputs. In +particular, the Decoder does only basic sanity checking on decoded input sizes, +and its limits are not configurable. Care should be taken when decoding gob data +from untrusted sources, which may consume significant resources. */ package gob