fix(security): update module github.com/go-viper/mapstructure/v2 to v2.4.0 [security] (#1784)
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
|
[github.com/go-viper/mapstructure/v2](https://redirect.github.com/go-viper/mapstructure)
| `v2.3.0` -> `v2.4.0` |
[](https://docs.renovatebot.com/merge-confidence/)
|
[](https://docs.renovatebot.com/merge-confidence/)
|
### GitHub Vulnerability Alerts
####
[GHSA-2464-8j7c-4cjm](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm)
### Summary
Use of this library in a security-critical context may result in leaking
sensitive information, if used to process sensitive fields.
### Details
OpenBao (and presumably HashiCorp Vault) have surfaced error messages
from `mapstructure` as follows:
98c3a59c04/sdk/framework/field_data.go (L43-L50)
```go
_, _, err := d.getPrimitive(field, schema)
if err != nil {
return fmt.Errorf("error converting input for field %q: %w", field, err)
}
```
where this calls `mapstructure.WeakDecode(...)`:
98c3a59c04/sdk/framework/field_data.go (L181-L193)
```go
func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
raw, ok := d.Raw[k]
if !ok {
return nil, false, nil
}
switch t := schema.Type; t {
case TypeBool:
var result bool
if err := mapstructure.WeakDecode(raw, &result); err != nil {
return nil, false, err
}
return result, true, nil
```
Notably, `WeakDecode(...)` eventually calls one of the decode helpers,
which surfaces the original value via `strconv` helpers:
8c61ec1924/mapstructure.go (L720-L727)
8c61ec1924/mapstructure.go (L791-L798)
8c61ec1924/decode_hooks.go (L180)
& more. These are different code paths than are fixed in the previous
iteration at
https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h.
### PoC
To reproduce with OpenBao:
```
$ podman run --pull=always -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300
```
and in a new tab:
```
$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"ttl":"asdf"}' "http://localhost:8200/v1/auth/userpass/users/asdf"
--> server logs:
2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error="error converting input for field \"ttl\": time: invalid duration \"asdf\""
```
### Impact
This is an information disclosure bug with little mitigation. See
https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717
for a previous version. That version was fixed, but this is in the
second part of that error message (starting at `'' expected a map, got
'string'` -- when the field type is `string` and a `map` is provided, we
see the above information leak -- the previous example had a `map` type
field with a `string` value provided).
This was rated 4.5 Medium by HashiCorp in the past iteration.
---
### Release Notes
<details>
<summary>go-viper/mapstructure
(github.com/go-viper/mapstructure/v2)</summary>
###
[`v2.4.0`](https://redirect.github.com/go-viper/mapstructure/releases/tag/v2.4.0)
[Compare
Source](https://redirect.github.com/go-viper/mapstructure/compare/v2.3.0...v2.4.0)
#### What's Changed
- refactor: replace interface{} with any by
[@​sagikazarmark](https://redirect.github.com/sagikazarmark) in
[https://github.com/go-viper/mapstructure/pull/115](https://redirect.github.com/go-viper/mapstructure/pull/115)
- build(deps): bump github/codeql-action from 3.29.0 to 3.29.2 by
[@​dependabot](https://redirect.github.com/dependabot)\[bot]
in[https://github.com/go-viper/mapstructure/pull/114](https://redirect.github.com/go-viper/mapstructure/pull/114)4
- Generic tests by
[@​sagikazarmark](https://redirect.github.com/sagikazarmark) in
[https://github.com/go-viper/mapstructure/pull/118](https://redirect.github.com/go-viper/mapstructure/pull/118)
- Fix godoc reference link in README.md by
[@​peczenyj](https://redirect.github.com/peczenyj) in
[https://github.com/go-viper/mapstructure/pull/107](https://redirect.github.com/go-viper/mapstructure/pull/107)
- feat: add StringToTimeLocationHookFunc to convert strings to
\*time.Location by
[@​ErfanMomeniii](https://redirect.github.com/ErfanMomeniii) in
[https://github.com/go-viper/mapstructure/pull/117](https://redirect.github.com/go-viper/mapstructure/pull/117)
- feat: add back previous StringToSlice as a weak function by
[@​sagikazarmark](https://redirect.github.com/sagikazarmark) in
[https://github.com/go-viper/mapstructure/pull/119](https://redirect.github.com/go-viper/mapstructure/pull/119)
#### New Contributors
- [@​ErfanMomeniii](https://redirect.github.com/ErfanMomeniii)
made their first contribution in
[https://github.com/go-viper/mapstructure/pull/117](https://redirect.github.com/go-viper/mapstructure/pull/117)
**Full Changelog**:
https://github.com/go-viper/mapstructure/compare/v2.3.0...v2.4.0
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/open-feature/flagd).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS44MS4yIiwidXBkYXRlZEluVmVyIjoiNDEuODEuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->
---------
Signed-off-by: Todd Baert <todd.baert@dynatrace.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Todd Baert <todd.baert@dynatrace.com>
037e30b2f8