chore(deps): bump github.com/oapi-codegen/oapi-codegen/v2 from 2.7.0 to 2.7.1 in /server in the go_modules group across 1 directory

[dependabot]

Bumps the go_modules group with 1 update in the /server directory: github.com/oapi-codegen/oapi-codegen/v2.

Updates github.com/oapi-codegen/oapi-codegen/v2 from 2.7.0 to 2.7.1

Release notes

Sourced from github.com/oapi-codegen/oapi-codegen/v2's releases.

Security fix for Go code injection

This is a security fix for a code injection vulnerability in v2.7.0, please see:

GHSA-rjwr-m7qx-3fjr

[!NOTE] A vulnerability like this requires that it is missed in code review and that you then call the malicious method.

Using an init() function could be enough to not require a direct call to the code, and instead rely on you importing the package, but either way, code review should be performed before any oapi-codegen generated code is executed.

We strongly recommend all users to be reviewing changes to their generated code before they execute anything within it, to protect against supply chain attacks or malicious injected code.

This is also why we recommend oapi-codegen generated code is committed to source control.

We're more strict about escaping strings passed into the OpenAPI specification, so that people can't inject Go code into generated code.

The problem was that it was possible to craft a description for server URL's which would emit arbitrary Go code, so if an attacker controlled your specification, they could inject Go code into your generated code which could do something malicious.

Commits

• 19c6282 Improve string escaping and add tests (#2396)
• See full diff in compare view

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml