commit 4b7ea7fc0cb61f42b88e2621601a3160415b6675
author Robert Newson <rnewson@apache.org> Thu Apr 23 22:24:37 2020 +0100
committer GitHub <noreply@github.com> Thu Apr 23 22:24:37 2020 +0100
tree 37af2607044af5e2fc904c95a813551e0cc89215
parent 17f8c22657fc0e582d5fe55244eed93824679482
parent b4078092151c12e18df0ac37faa980486e908b7d

Merge pull request #2819 from apache/mango-bookmark-2.3.x

safer binary_to_term in mango_json_bookmark

src/mango/src/mango_json_bookmark.erl

diff --git a/src/mango/src/mango_json_bookmark.erl b/src/mango/src/mango_json_bookmark.erl
index 97f81cf..83fd00f 100644
--- a/src/mango/src/mango_json_bookmark.erl
+++ b/src/mango/src/mango_json_bookmark.erl
@@ -54,7 +54,7 @@
     nil;
 unpack(Packed) ->
     try
-        Bookmark = binary_to_term(couch_util:decodeBase64Url(Packed)),
+        Bookmark = binary_to_term(couch_util:decodeBase64Url(Packed), [safe]),
         verify(Bookmark)
     catch _:_ ->
         ?MANGO_ERROR({invalid_bookmark, Packed})