Commit bf3a2ff
committed
Disallow nested objects and arrays as keys in objects
Port of stleary/JSON-java#772
to partially remediate
https://www.cve.org/CVERecord?id=CVE-2023-5072 , where
nested keys can allow relatively small inputs to
cause OOM errors through recursion.
Test by:
- package & import into alpha locally
- confirm a suite of unit tests depending on JSONObjects
passes
- verify that the following CVE Proof-of-concept fails
with an 'unexpected character' exception:
https://security.snyk.io/vuln/SNYK-JAVA-ORGJSON-59624641 parent 1810c2c commit bf3a2ff
2 files changed
+12
-6
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
187 | 187 | | |
188 | 188 | | |
189 | 189 | | |
190 | | - | |
191 | | - | |
| 190 | + | |
192 | 191 | | |
193 | 192 | | |
194 | 193 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
363 | 363 | | |
364 | 364 | | |
365 | 365 | | |
366 | | - | |
367 | 366 | | |
368 | 367 | | |
369 | | - | |
370 | | - | |
371 | | - | |
372 | 368 | | |
373 | 369 | | |
374 | 370 | | |
| |||
377 | 373 | | |
378 | 374 | | |
379 | 375 | | |
| 376 | + | |
| 377 | + | |
| 378 | + | |
| 379 | + | |
| 380 | + | |
| 381 | + | |
| 382 | + | |
| 383 | + | |
| 384 | + | |
| 385 | + | |
| 386 | + | |
380 | 387 | | |
381 | 388 | | |
382 | 389 | | |
| |||
0 commit comments