oapi-codegen icon indicating copy to clipboard operation
oapi-codegen copied to clipboard
verified publisher icon deepmap

fix(deps): update module github.com/getkin/kin-openapi to v0.131.0 [security]

Open renovate[bot] opened this issue 9 months ago • 3 comments

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
github.com/getkin/kin-openapi v0.128.0 -> v0.131.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-30153

Summary

When validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory.

Details

The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says.

PoC

To reproduce the vulnerability, you can use the following OpenAPI schema:

openapi: 3.0.0
info:
  title: 'Validator'
  version: 0.0.1
paths:
  /:
    post:
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              type: object
              required:
                - file
              properties:
                file:
                  type: string
                  format: binary
      responses:
        '200':
          description: Created

And this code to validate the request (nothing fancy, it basically only calls the openapi3filter.ValidateRequest function`):

package main

import (
	"fmt"
	"log"
	"net/http"

	"github.com/getkin/kin-openapi/openapi3filter"
	legacyrouter "github.com/getkin/kin-openapi/routers/legacy"

	"github.com/getkin/kin-openapi/openapi3"
)

func handler(w http.ResponseWriter, r *http.Request) {
	loader := openapi3.NewLoader()

	doc, err := loader.LoadFromFile("schema.yaml")
	if err != nil {
		http.Error(w, "Failed to load OpenAPI document", http.StatusInternalServerError)
		return
	}

	if err := doc.Validate(r.Context()); err != nil {
		http.Error(w, "Invalid OpenAPI document", http.StatusBadRequest)
		return
	}

	router, err := legacyrouter.NewRouter(doc)
	if err != nil {
		http.Error(w, "Failed to create router", http.StatusInternalServerError)
		return
	}

	route, pathParams, err := router.FindRoute(r)
	if err != nil {
		http.Error(w, "Failed to find route", http.StatusNotFound)
		return
	}

	input := &openapi3filter.RequestValidationInput{
		Request:     r,
		QueryParams: r.URL.Query(),
		Route:       route,
		PathParams:  pathParams,
	}

	if err := openapi3filter.ValidateRequest(r.Context(), input); err != nil {
		http.Error(w, fmt.Sprintf("Request validation failed: %v", err), http.StatusBadRequest)
		return
	}

	w.Write([]byte("request ok !"))
}

func main() {
	http.HandleFunc("/", handler)
	log.Fatal(http.ListenAndServe(":8080", nil))

}

We also need to create a zip bomb. This command will create a 4.7GB file and compress it to to 4.7MB zip archive:

perl -e 'print "0" x 5000000000' > /tmp/bigfile.txt; zip -9 /tmp/bomb.zip /tmp/bigfile.txt

Run the PoC provided, and upload the zip bomb with curl localhost:8080/ -F file="@​/tmp/bomb.zip;type=application/zip" -v.

Observe the memory consumption of the test server during and after the upload (it jumped to a bit over 22GB in my testing, with only a 4.7MB input file, you can reduce the size of the generated file to not kill your test machine when reproducing.)

Impact

An attacker can trigger an out-of-memory (OOM) condition, leading to server crashes or degraded performance. It seems to only be exploitable if the OpenAPI schema allows for multipart upload.

Remediation

I see at least 2 potential fixes/improvements:

  • Do not register by default the zip file decoder (I honestly was a bit surprised to see it was enabled by default, it seems to be quite a niche use-case ?)
  • Update ZipFileBodyDecoder to enforce a maximum size of the decompressed archive and bailout as soon as it's reached (probably with a small default value and allow the users to configure it through the input options ?)

Release Notes

getkin/kin-openapi (github.com/getkin/kin-openapi)

v0.131.0

Compare Source

What's Changed

Full Changelog: https://github.com/getkin/kin-openapi/compare/v0.130.0...v0.131.0

v0.130.0

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/getkin/kin-openapi/compare/v0.129.0...v0.130.0

v0.129.0

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/getkin/kin-openapi/compare/v0.128.0...v0.129.0

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • [ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate[bot] avatar May 15 '25 17:05 renovate[bot]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.22 -> 1.22.5

renovate[bot] avatar May 15 '25 17:05 renovate[bot]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License

View full report

socket-security[bot] avatar May 15 '25 17:05 socket-security[bot]

Kusari Analysis Results

Analysis for commit: 657f8d9a820a731769e30f3466dec8b43611e38d, performed at: 2025-07-15T14:06:58Z

• @kusari-inspector rerun - Trigger a re-analysis of this PR

• @kusari-inspector feedback [your message] - Send feedback to our AI and team

Recommendation

✅ PROCEED with this Pull Request

Summary

✅ No Flagged Issues Detected

All values appear to be within acceptable risk parameters.

This PR safely updates github.com/getkin/kin-openapi from v0.128.0 to v0.131.0, which fixes a HIGH severity vulnerability (CVE-2025-30153) related to ZIP bomb attacks that could cause out-of-memory conditions. The security code analysis shows no issues, and the dependency changes include only permissive licenses (MIT, BSD-3-Clause, Apache-2.0). The package has good maintenance (8/10) and code review (9/10) scores, indicating it's well-maintained. The additional YAML-related dependency changes appear to be related to this security update and don't introduce new risks.

Found this helpful? Give it a 👍 or 👎 reaction!

Click to expand for details and specific link to issues

Dependency Changes

Status Package Change Version Latest Version Advisories License
❓ Uncertain stdlib updated 1.22 → 1.22.5 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown
❓ Uncertain stdlib updated 1.22 → 1.22.5 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown
❓ Uncertain stdlib updated 1.22 → 1.22.5 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown
❓ Uncertain stdlib updated 1.22 → 1.22.5 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown
❓ Uncertain stdlib updated 1.22 → 1.22.5 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown
❓ Uncertain stdlib updated 1.22 → 1.22.5 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown
❓ Uncertain stdlib updated 1.22 → 1.22.5 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown

Risk Details

Safe Dependency Changes

Status Package Change Version Latest Version Advisories License
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)

kusari-inspector[bot] avatar Jun 14 '25 13:06 kusari-inspector[bot]

Kusari PR Analysis rerun based on - d803a416c5715e20ea358121f6e018105763316e performed at: 2025-07-15T13:58:28Z - link to updated analysis

kusari-inspector[bot] avatar Jul 15 '25 14:07 kusari-inspector[bot]

Kusari PR Analysis rerun based on - 657f8d9a820a731769e30f3466dec8b43611e38d performed at: 2025-07-15T14:06:58Z - link to updated analysis

kusari-inspector[bot] avatar Jul 15 '25 14:07 kusari-inspector[bot]