spray / spray-json

A lightweight, clean and simple JSON implementation in Scala
Apache License 2.0
972 stars 190 forks source link

Scientific notation numbers potentially break when not converted to the right type #256

Open legopiraat opened 6 years ago

legopiraat commented 6 years ago

Hello,

When i was testing my application i noticed when you send a scientific notation number in the json and convert it to a Long the calculation takes very long and uses all the CPU.

example:

  case class ScientificNotation(number: Long)
  implicit val testJsonFormat: RootJsonFormat[ScientificNotation] = jsonFormat1(ScientificNotation)

  "it should break" when {
    "a scientific number is parsed as long" in {
      val json = s"""{ "number": 1e100000000 }"""

      json.parseJson.convertTo[ScientificNotation]
    }
  }

This will a big calculation and will use up all CPU. When used in an API this could potentially DDos the application really easy.

Regards, Legopiraat