Limit memory usage in templates

util/sprig/strings_test.go

@@ -4,6 +4,7 @@ import (
 	"encoding/base32"
 	"encoding/base64"
 	"fmt"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -214,6 +215,25 @@ func TestNindent(t *testing.T) {
 	}
 }
 
+func TestIndentLimit(t *testing.T) {
+	// Indentation beyond a sane width is an amplification attempt: indent allocates
+	// spaces * lines bytes in a single uninterruptible call
+	if err := runt(`{{indent 100 "a"}}`, strings.Repeat(" ", 100)+"a"); err != nil {
+		t.Error(err)
+	}
+	for _, tpl := range []string{
+		`{{indent 101 "a"}}`,
+		`{{nindent 101 "a"}}`,
+		`{{indent 1000000000 "a"}}`,
+	} {
+		if _, err := runRaw(tpl, nil); err == nil {
+			t.Errorf("expected %s to be rejected", tpl)
+		} else if !strings.Contains(err.Error(), "exceeds limit") {
+			t.Errorf("expected limit error for %s, got: %v", tpl, err)
+		}
+	}
+}
+
 func TestReplace(t *testing.T) {
 	tpl := `{{"I Am Henry VIII" | replace " " "-"}}`
 	if err := runt(tpl, "I-Am-Henry-VIII"); err != nil {