x/text/language: ParseAcceptLanguage takes a long time to parse complex tags

[rolandshoemaker]

The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers.

This is a PRIVATE issue for CVE-2022-32149, tracked in http://b/238189978 and fixed by http://tg/1565112

/cc @golang/security

[gopherbot]

Change https://go.dev/cl/442235 mentions this issue: language: reject excessively large Accept-Language strings

[maariitsme]

Hi Team
@rolandshoemaker @gopherbot @dmitshur @evanphx
It is patched in which golang version?

[ianlancetaylor]

This was fixed in the golang.org/x/text repository. It's not in any particular Go release. I think the first revision of golang.org/x/text with the fix is v0.4.0.

[ChrisZhangJin]

yes, it is fixed in golang.org/x/text repository, and it is not in any particular Go release. but there is reference relationship between the go version and x/text version.

when i run go mod graph in the src of go(any version), i can see the dependencies like this

go mod graph | grep text

std golang.org/x/text@v0.11.0
golang.org/x/crypto@v0.11.1-0.20230711161743-2e82bdd1719d golang.org/x/text@v0.11.0
golang.org/x/net@v0.12.1-0.20231027154334-5ca955b1789c golang.org/x/text@v0.11.0
golang.org/x/text@v0.11.0 golang.org/x/tools@v0.6.0
golang.org/x/text@v0.11.0 golang.org/x/mod@v0.8.0
golang.org/x/text@v0.11.0 golang.org/x/sys@v0.5.0

the text version was referred in the source code, i think. even if i upgrade the version of the x/text, how can i handle this part?

[neild]

Nothing in the Go standard library uses this function, so no versions of Go itself are affected.