Limit nested filters to avoid stack overflow 2

askama_parser/src/expr.rs

@@ -182,21 +182,15 @@ impl<'a> Expr<'a> {
     expr_prec_layer!(addsub, muldivmod, "+", "-");
     expr_prec_layer!(muldivmod, filtered, "*", "/", "%");
 
-    fn filtered(i: &'a str, level: Level) -> ParseResult<'a, Self> {
-        let (_, level) = level.nest(i)?;
-        let (i, (obj, filters)) =
-            tuple((|i| Self::prefix(i, level), many0(|i| filter(i, level))))(i)?;
-
-        let mut res = obj;
-        for (fname, args) in filters {
-            res = Self::Filter(Filter {
-                name: fname,
-                arguments: {
-                    let mut args = args.unwrap_or_default();
-                    args.insert(0, res);
-                    args
-                },
-            });
+    fn filtered(i: &'a str, mut level: Level) -> ParseResult<'a, Self> {
+        let (mut i, mut res) = Self::prefix(i, level)?;
+        while let (j, Some((name, arguments))) = opt(|i| filter(i, &mut level))(i)? {
+            i = j;
+
+            let mut arguments = arguments.unwrap_or(Vec::with_capacity(1));
+            arguments.insert(0, res);
+
+            res = Self::Filter(Filter { name, arguments });
         }
 
         Ok((i, res))

askama_parser/src/lib.rs

@@ -636,13 +636,10 @@ impl Level {
 }
 
 #[allow(clippy::type_complexity)]
-fn filter(i: &str, level: Level) -> ParseResult<'_, (&str, Option<Vec<Expr<'_>>>)> {
-    let (i, (_, fname, args)) = tuple((
-        char('|'),
-        ws(identifier),
-        opt(|i| Expr::arguments(i, level, false)),
-    ))(i)?;
-    Ok((i, (fname, args)))
+fn filter<'a>(i: &'a str, level: &mut Level) -> ParseResult<'a, (&'a str, Option<Vec<Expr<'a>>>)> {
+    let (i, _) = char('|')(i)?;
+    *level = level.nest(i)?.1;
+    pair(ws(identifier), opt(|i| Expr::arguments(i, *level, false)))(i)
 }
 
 /// Returns the common parts of two paths.

askama_parser/src/node.rs

@@ -598,13 +598,14 @@ pub struct FilterBlock<'a> {
 
 impl<'a> FilterBlock<'a> {
     fn parse(i: &'a str, s: &State<'_>) -> ParseResult<'a, Self> {
+        let mut level = s.level.get();
         let mut start = tuple((
             opt(Whitespace::parse),
             ws(keyword("filter")),
             cut(tuple((
                 ws(identifier),
                 opt(|i| Expr::arguments(i, s.level.get(), false)),
-                many0(|i| filter(i, s.level.get())),
+                many0(|i| filter(i, &mut level)),
                 ws(|i| Ok((i, ()))),
                 opt(Whitespace::parse),
                 |i| s.tag_block_end(i),

askama_parser/src/tests.rs

@@ -944,3 +944,9 @@ fn let_set() {
             .nodes(),
     );
 }
+
+#[test]
+fn fuzzed_filter_recursion() {
+    const TEMPLATE: &str = include_str!("../tests/filter-recursion.txt");
+    assert!(Ast::from_str(TEMPLATE, None, &Syntax::default()).is_err());
+}

testing/tests/ui/excessive_nesting.stderr

@@ -1,4 +1,4 @@
-error: failed to parse template source at row 14, column 34 near:
+error: failed to parse template source at row 14, column 42 near:
        "%}{%if 1%}{%if 1%}{%if 1%}{%if 1%}{%if 1"...
  --> tests/ui/excessive_nesting.rs:3:10
   |