Skip to content

Commit bf3a2ff

Browse files
committed
Disallow nested objects and arrays as keys in objects
Port of stleary/JSON-java#772 to partially remediate https://www.cve.org/CVERecord?id=CVE-2023-5072 , where nested keys can allow relatively small inputs to cause OOM errors through recursion. Test by: - package & import into alpha locally - confirm a suite of unit tests depending on JSONObjects passes - verify that the following CVE Proof-of-concept fails with an 'unexpected character' exception: https://security.snyk.io/vuln/SNYK-JAVA-ORGJSON-5962464
1 parent 1810c2c commit bf3a2ff

File tree

2 files changed

+12
-6
lines changed

2 files changed

+12
-6
lines changed

org/json/JSONObject.java

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -187,8 +187,7 @@ public JSONObject(JSONTokener x) throws JSONException {
187187
case '}':
188188
return;
189189
default:
190-
x.back();
191-
key = x.nextValue().toString();
190+
key = x.nextSimpleValue(c).toString();
192191
}
193192

194193
/*

org/json/JSONTokener.java

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -363,12 +363,8 @@ public String nextTo(String delimiters) throws JSONException {
363363
*/
364364
public Object nextValue() throws JSONException {
365365
char c = nextClean();
366-
String s;
367366

368367
switch (c) {
369-
case '"':
370-
case '\'':
371-
return nextString(c);
372368
case '{':
373369
back();
374370
return new JSONObject(this);
@@ -377,6 +373,17 @@ public Object nextValue() throws JSONException {
377373
back();
378374
return new JSONArray(this);
379375
}
376+
return nextSimpleValue(c);
377+
}
378+
379+
Object nextSimpleValue(char c) throws JSONException {
380+
String s;
381+
382+
switch (c) {
383+
case '"':
384+
case '\'':
385+
return this.nextString(c);
386+
}
380387

381388
/*
382389
* Handle unquoted text. This could be the values true, false, or

0 commit comments

Comments
 (0)