refactor(frontmatter): constrain frontmatter object after parsing

This change removes the meta-marked dependency which solely was
used for extracting the frontmatter, which is possible as well
with one function. Furthermore, this introduces constraints to
objects resulting from frontmatter parsing and enforces them in
order to prevent attacks like a yaml bomb (massive alias expansion).
This change should resolve a possible DoS attack.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>

lib/models/note.js

@@ -5,12 +5,13 @@ const path = require('path')
 const LZString = require('lz-string')
 const base64url = require('base64url')
 const md = require('markdown-it')()
-const metaMarked = require('@hedgedoc/meta-marked')
+const yaml = require('js-yaml')
 const cheerio = require('cheerio')
 const nanoid = require('nanoid')
 const Sequelize = require('sequelize')
 const async = require('async')
 const moment = require('moment')
+const { constrainObject } = require('constrain-object')
 const DiffMatchPatch = require('diff-match-patch')
 const dmp = new DiffMatchPatch()
 
@@ -397,12 +398,41 @@ module.exports = function (sequelize, DataTypes) {
     }
     return tags
   }
+  function splitFrontmatter (str) {
+    if (str.slice(0, 3) !== '---') {
+      return null
+    }
+    const matcher = /\n(\.{3}|-{3})/g
+    const metaEnd = matcher.exec(str)
+    if (!metaEnd) {
+      return null
+    }
+    return {
+      yaml: str.slice(0, metaEnd.index),
+      markdown: str.slice(matcher.lastIndex)
+    }
+  }
+
   Note.extractMeta = function (content) {
     let obj = null
     try {
-      obj = metaMarked(content)
-      if (!obj.markdown) obj.markdown = ''
-      if (!obj.meta) obj.meta = {}
+      const parts = splitFrontmatter(content)
+      if (parts) {
+        const parsed = yaml.load(parts.yaml)
+        const constrained = constrainObject(parsed, {
+          onCycle: 'omit',
+          maxDepth: 4
+        })
+        obj = {
+          meta: constrained || {},
+          markdown: parts.markdown || ''
+        }
+      } else {
+        obj = {
+          meta: {},
+          markdown: content
+        }
+      }
     } catch (err) {
       obj = {
         markdown: content,