tree 71ec7e1981fe7fa9026e21e969b8d7e53b7fc63d
parent 8f690f22cf1c026c950adddf3d45258bfd0912f0
author Marcel van Lohuizen <mpvl@golang.org> 1613633519 +0100
committer Marcel van Lohuizen <mpvl@golang.org> 1614423485 +0000

language: allow variable number of types per key in -u- extension

This also fixes CVE-2020-28851. This was an off-by one
error, but is fixed by handling all cases according to the spec.

These valid case seem to be not used in practice much,
if at all, but the main benefit is that it makes all valid BCP 47
language tags also valid -u extensions. Fixing the code
to handle BCP 47 results in cleaner and seemingly more
robust code.

The main difference is as follows. The old impementation
assumed a -u- extension of the form:

    <tag> "-u"  { "-" <attr> } { "-" <key> "-" <type> } [ <otherExtensions> ]

where <attr> and <type> are of length 3-8 and a <key> is of length 2.

According to the spec, though, the format is

    <tag> "-u"  { "-" <attr> } { "-" <key> { "-" <type> } } [ <otherExtensions> ]

So every key may be associated with zero or more types, instead of
exactly one.

The new code now handles this.

The language.Tag.TypeForKey method is now defined to only
return the first entry or nothing at all. This is for backwards
compatibilty reasons.

Fixes golang/go#42535

Change-Id: I23aec4e1c4d8807fc2ffc0eb3a08de2d8150219f
Reviewed-on: https://go-review.googlesource.com/c/text/+/293549
Trust: Marcel van Lohuizen <mpvl@golang.org>
Run-TryBot: Marcel van Lohuizen <mpvl@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>