Skip to content

Commit 40faf25

Browse files
authored
Fix vulnerability. (google#126)
0 is a sentinel value used to make all enums refutable. This is a hack around issues in maros where you're unknowingly treating irrefutable patterns as refutable, which is unfortunately a hard error. The server panics if it ever encountered the 0-variant, which before this patch was possible. Now, it's not possible, because 0-variants are now not able to be deserialized.
1 parent c8be9b6 commit 40faf25

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

src/macros.rs

+7
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,13 @@ macro_rules! impl_deserialize {
8787
-> ::std::result::Result<impl_deserialize_Field__, E>
8888
where E: $crate::serde::de::Error,
8989
{
90+
if impl_deserialize_value__ == 0 {
91+
return ::std::result::Result::Err(
92+
$crate::serde::de::Error::custom(
93+
"Variant 0 is a sentinel value and should not \
94+
be serialized!"));
95+
}
96+
9097
$(
9198
if impl_deserialize_value__ == $n {
9299
return ::std::result::Result::Ok(

0 commit comments

Comments
 (0)