search

ipfs-shipyard / java-ipfs-http-client

A Java implementation of the HTTP IPFS API
MIT License
538 stars 243 forks source link

Potential numeric overflow in JSONParser.java. can't handle complete uint64 range from kubo rpc api. #197

Closed adpadilla closed 1 year ago

adpadilla commented 2 years ago

I noticed that the kubo RPC API specifies response payloads which include json attribute values that are specified as uint64. Current the JSONParser.java logic only parses integer values up to java.lang.Long.MAX_VALUE ( 9223372036854775807 ) which admittedly probably covers overwhelming values returned by Kubo RPC API. However, in the event that Kubo RPC API does return a 64 bit unsigned integer value greater than java.Long.MAX_VALUE, this will cause a NumberFormatException which describes the disconnect between the Kubo RPC API and this java client.

ianopolous commented 2 years ago

JSON the format technically doesn't impose any limits, but anything JS based like in browsers will not be able to express integers bigger than 2^52 a much smaller limit. So I would argue that kubo returning values > 2^52 would be a bigger problem.