Warning about DoS attacks at parsing CUE

[cueckoo]

Originally opened by @tredoe in cuelang/cue#158

Does CUE could be vulnerable to a DoS attack like "Billion Laughs" one discovered recently at go-yaml?

kubernetes/kubernetes#83253

[cueckoo]

Original reply by @rogpeppe in cuelang/cue#158 (comment)

Yes, it's definitely vulnerable to that kind of expansion attack.

[cueckoo]

Original reply by @rogpeppe in cuelang/cue#158 (comment)

Note that this isn't an issue when parsing CUE, only when exporting values from it.

[cueckoo]

Original reply by @myitcv in cuelang/cue#158 (comment)

Per cue help filetypes there is a solution here:

The following tags can be used in qualifiers to further
influence input or output. For input these act as
restrictions, validating the input. For output these act
as filters, showing only the requested data and picking
defaults as requested.

    Tag         Description
    data        Require concrete input and output that does
                not require any evaluation.
    graph       Like data, but allow references.
    schema      Export data and definitions.

e.g.

# Data is always allowed
exec cue eval cue+data: data.cue
exec cue eval cue+graph: data.cue
exec cue eval cue+schema: data.cue

# References are not allowed in data mode
! exec cue eval cue+data: reference.cue
stderr 'references not allowed in data mode'
exec cue eval cue+graph: reference.cue
exec cue eval cue+schema: reference.cue

# Expressions are not allowed in data or graph modes
! exec cue eval cue+data: expression.cue
stderr 'expressions not allowed in data mode'
! exec cue eval cue+graph: expression.cue
stderr 'expressions not allowed in graph mode'
exec cue eval cue+schema: expression.cue

# Definitions are not allowed in data or graph modes
! exec cue eval cue+data: definitions.cue
stderr 'definitions not allowed in data mode'
! exec cue eval cue+graph: definitions.cue
stderr 'definitions not allowed in graph mode'
exec cue eval cue+schema: definitions.cue


-- data.cue --
l: [1, 2, 3, 4, 5]
-- expression.cue --
 for _, v in [1, 2, 3, 4, 5] {
	"\(v)": v
}
-- definitions.cue --
#Def: {
	name: string
}
-- reference.cue --
l: [1, 2, 3, 4, 5]
l2: l

The said, I think these docs could be better surfaced because I missed this until it was pointed out by @mpvl!

[myitcv]

For reference (linking to a previous answer by @mpvl) please see the section "Structure Sharing" on how this type of attack can be handled by CUE: #804