Limit nested filters to avoid stack overflow

askama_parser/src/expr.rs

@@ -187,24 +187,15 @@ impl<'a> Expr<'a> {
     expr_prec_layer!(addsub, muldivmod, "+", "-");
     expr_prec_layer!(muldivmod, filtered, "*", "/", "%");
 
-    fn filtered(i: &'a str, level: Level) -> ParseResult<'a, Self> {
-        let (_, level) = level.nest(i)?;
-        let (i, (obj, filters)) =
-            tuple((|i| Self::prefix(i, level), many0(|i| filter(i, level))))(i)?;
-
-        let mut res = obj;
-        for (fname, args) in filters {
-            res = Self::Filter(Filter {
-                name: fname,
-                arguments: {
-                    let mut args = match args {
-                        Some(inner) => inner,
-                        None => Vec::new(),
-                    };
-                    args.insert(0, res);
-                    args
-                },
-            });
+    fn filtered(i: &'a str, mut level: Level) -> ParseResult<'a, Self> {
+        let (mut i, mut res) = Self::prefix(i, level)?;
+        while let (j, Some((name, arguments))) = opt(|i| filter(i, &mut level))(i)? {
+            i = j;
+
+            let mut arguments = arguments.unwrap_or(Vec::with_capacity(1));
+            arguments.insert(0, res);
+
+            res = Self::Filter(Filter { name, arguments });
         }
 
         Ok((i, res))

askama_parser/src/lib.rs

@@ -479,11 +479,8 @@ impl Level {
 }
 
 #[allow(clippy::type_complexity)]
-fn filter(i: &str, level: Level) -> ParseResult<'_, (&str, Option<Vec<Expr<'_>>>)> {
-    let (i, (_, fname, args)) = tuple((
-        char('|'),
-        ws(identifier),
-        opt(|i| Expr::arguments(i, level, false)),
-    ))(i)?;
-    Ok((i, (fname, args)))
+fn filter<'a>(i: &'a str, level: &mut Level) -> ParseResult<'a, (&'a str, Option<Vec<Expr<'a>>>)> {
+    let (i, _) = char('|')(i)?;
+    *level = level.nest(i)?.1;
+    pair(ws(identifier), opt(|i| Expr::arguments(i, *level, false)))(i)
 }

askama_parser/src/node.rs

@@ -570,13 +570,14 @@ pub struct FilterBlock<'a> {
 
 impl<'a> FilterBlock<'a> {
     fn parse(i: &'a str, s: &State<'_>) -> ParseResult<'a, Self> {
+        let mut level = s.level.get();
         let mut start = tuple((
             opt(Whitespace::parse),
             ws(keyword("filter")),
             cut(tuple((
                 ws(identifier),
                 opt(|i| Expr::arguments(i, s.level.get(), false)),
-                many0(|i| filter(i, s.level.get())),
+                many0(|i| filter(i, &mut level)),
                 opt(Whitespace::parse),
                 |i| s.tag_block_end(i),
             ))),

askama_parser/src/tests.rs

@@ -882,3 +882,9 @@ fn fuzzed_unary_recursion() {
     const TEMPLATE: &str = include_str!("../tests/unary-recursion.txt");
     assert!(Ast::from_str(TEMPLATE, &Syntax::default()).is_err());
 }
+
+#[test]
+fn fuzzed_filter_recursion() {
+    const TEMPLATE: &str = include_str!("../tests/filter-recursion.txt");
+    assert!(Ast::from_str(TEMPLATE, &Syntax::default()).is_err());
+}

testing/tests/ui/excessive_nesting.stderr

@@ -1,4 +1,4 @@
-error: problems parsing template source at row 14, column 34 near:
+error: problems parsing template source at row 14, column 42 near:
        "%}{%if 1%}{%if 1%}{%if 1%}{%if 1%}{%if 1"...
  --> tests/ui/excessive_nesting.rs:3:10
   |

testing/tests/ui/filter-recursion.rs

@@ -0,0 +1,9 @@
+use askama::Template;
+
+#[derive(Template)]
+#[template(source = "{{ s|a|a|a|a|a|a|a|A|a|a|a|a|a|a|a|a|a|a|a|a|a", ext = "txt")]
+struct Filtered {
+    s: &'static str,
+}
+
+fn main() {}

testing/tests/ui/filter-recursion.stderr

@@ -0,0 +1,8 @@
+error: problems parsing template source at row 1, column 46 near:
+       ""
+ --> tests/ui/filter-recursion.rs:3:10
+  |
+3 | #[derive(Template)]
+  |          ^^^^^^^^
+  |
+  = note: this error originates in the derive macro `Template` (in Nightly builds, run with -Z macro-backtrace for more info)