Protect against deeply nested maps

philwebb · philwebb · commit 2f85ea3a305f · 2022-08-09T10:21:13.000+01:00
Update BasicJsonParser to fix the deeply nested map protection logic. Fixes gh-32029
diff --git a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/json/BasicJsonParser.java b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/json/BasicJsonParser.java
@@ -67,7 +67,7 @@ private Object parseInternal(int nesting, String json) {
 			return parseListInternal(nesting + 1, json);
 		}
 		if (json.startsWith("{")) {
-			return parseMapInternal(nesting, json);
+			return parseMapInternal(nesting + 1, json);
 		}
 		if (json.startsWith("\"")) {
 			return trimTrailingCharacter(trimLeadingCharacter(json, '"'), '"');
diff --git a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/json/AbstractJsonParserTests.java b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/json/AbstractJsonParserTests.java
@@ -205,4 +205,12 @@ void largeMalformed() throws IOException {
 		assertThatExceptionOfType(JsonParseException.class).isThrownBy(() -> this.parser.parseList(input));
 	}
 
+	@Test // gh-32029
+	void deeplyNestedMap() throws IOException {
+		String input = StreamUtils.copyToString(
+				AbstractJsonParserTests.class.getResourceAsStream("deeply-nested-map-json.txt"),
+				StandardCharsets.UTF_8);
+		assertThatExceptionOfType(JsonParseException.class).isThrownBy(() -> this.parser.parseList(input));
+	}
+
 }
diff --git a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/json/YamlJsonParserTests.java b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/json/YamlJsonParserTests.java
@@ -66,4 +66,9 @@ void listWithRepeatedOpenArray() throws IOException {
 	void largeMalformed() throws IOException {
 	}
 
+	@Override
+	@Disabled("SnakeYaml does not protect against deeply nested JSON")
+	void deeplyNestedMap() throws IOException {
+	}
+
 }
diff --git a/spring-boot-project/spring-boot/src/test/resources/org/springframework/boot/json/deeply-nested-map-json.txt b/spring-boot-project/spring-boot/src/test/resources/org/springframework/boot/json/deeply-nested-map-json.txt
@@ -0,0 +1 @@
+[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��

Original file line number	Diff line number	Diff line change
`@@ -67,7 +67,7 @@ private Object parseInternal(int nesting, String json) {`
`67`	`67`	`return parseListInternal(nesting + 1, json);`
`68`	`68`	`}`
`69`	`69`	`if (json.startsWith("{")) {`
`70`		`- return parseMapInternal(nesting, json);`
	`70`	`+ return parseMapInternal(nesting + 1, json);`
`71`	`71`	`}`
`72`	`72`	`if (json.startsWith("\"")) {`
`73`	`73`	`return trimTrailingCharacter(trimLeadingCharacter(json, '"'), '"');`
Original file line number	Diff line number	Diff line change
`@@ -205,4 +205,12 @@ void largeMalformed() throws IOException {`
`205`	`205`	`assertThatExceptionOfType(JsonParseException.class).isThrownBy(() -> this.parser.parseList(input));`
`206`	`206`	`}`
`207`	`207`
	`208`	`+ @Test // gh-32029`
	`209`	`+ void deeplyNestedMap() throws IOException {`
	`210`	`+ String input = StreamUtils.copyToString(`
	`211`	`+ AbstractJsonParserTests.class.getResourceAsStream("deeply-nested-map-json.txt"),`
	`212`	`+ StandardCharsets.UTF_8);`
	`213`	`+ assertThatExceptionOfType(JsonParseException.class).isThrownBy(() -> this.parser.parseList(input));`
	`214`	`+ }`
	`215`	`+`
`208`	`216`	`}`
Original file line number	Diff line number	Diff line change
`@@ -66,4 +66,9 @@ void listWithRepeatedOpenArray() throws IOException {`
`66`	`66`	`void largeMalformed() throws IOException {`
`67`	`67`	`}`
`68`	`68`
	`69`	`+ @Override`
	`70`	`+ @Disabled("SnakeYaml does not protect against deeply nested JSON")`
	`71`	`+ void deeplyNestedMap() throws IOException {`
	`72`	`+ }`
	`73`	`+`
`69`	`74`	`}`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	+[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��