-
-
Notifications
You must be signed in to change notification settings - Fork 1.4k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[2.13.x] Add check in primitive value deserializers to avoid deep wra…
…pper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS [CVE-2022-42003] (#3621) * Fix #3590 (cherry picked from commit d78d00e) * Updates release notes for 2.13.4.1 Co-authored-by: Tatu Saloranta <tatu.saloranta@iki.fi>
- Loading branch information
1 parent
7690a33
commit 2c4a601
Showing
3 changed files
with
140 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
95 changes: 95 additions & 0 deletions
95
...test/java/com/fasterxml/jackson/databind/deser/dos/DeepArrayWrappingForDeser3590Test.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,95 @@ | ||
| package com.fasterxml.jackson.databind.deser.dos; | ||
|
|
||
| import java.util.Date; | ||
|
|
||
| import com.fasterxml.jackson.databind.*; | ||
| import com.fasterxml.jackson.databind.exc.MismatchedInputException; | ||
|
|
||
| public class DeepArrayWrappingForDeser3590Test extends BaseMapTest | ||
| { | ||
| // 05-Sep-2022, tatu: Before fix, failed with 5000 | ||
| private final static int TOO_DEEP_NESTING = 9999; | ||
|
|
||
| private final ObjectMapper MAPPER = jsonMapperBuilder() | ||
| .enable(DeserializationFeature.UNWRAP_SINGLE_VALUE_ARRAYS) | ||
| .build(); | ||
|
|
||
| private final static String TOO_DEEP_DOC = _nestedDoc(TOO_DEEP_NESTING, "[ ", "] ", "123"); | ||
|
|
||
| public void testArrayWrappingForBoolean() throws Exception | ||
| { | ||
| _testArrayWrappingFor(Boolean.class); | ||
| _testArrayWrappingFor(Boolean.TYPE); | ||
| } | ||
|
|
||
| public void testArrayWrappingForByte() throws Exception | ||
| { | ||
| _testArrayWrappingFor(Byte.class); | ||
| _testArrayWrappingFor(Byte.TYPE); | ||
| } | ||
|
|
||
| public void testArrayWrappingForShort() throws Exception | ||
| { | ||
| _testArrayWrappingFor(Short.class); | ||
| _testArrayWrappingFor(Short.TYPE); | ||
| } | ||
|
|
||
| public void testArrayWrappingForInt() throws Exception | ||
| { | ||
| _testArrayWrappingFor(Integer.class); | ||
| _testArrayWrappingFor(Integer.TYPE); | ||
| } | ||
|
|
||
| public void testArrayWrappingForLong() throws Exception | ||
| { | ||
| _testArrayWrappingFor(Long.class); | ||
| _testArrayWrappingFor(Long.TYPE); | ||
| } | ||
|
|
||
| public void testArrayWrappingForFloat() throws Exception | ||
| { | ||
| _testArrayWrappingFor(Float.class); | ||
| _testArrayWrappingFor(Float.TYPE); | ||
| } | ||
|
|
||
| public void testArrayWrappingForDouble() throws Exception | ||
| { | ||
| _testArrayWrappingFor(Double.class); | ||
| _testArrayWrappingFor(Double.TYPE); | ||
| } | ||
|
|
||
| public void testArrayWrappingForDate() throws Exception | ||
| { | ||
| _testArrayWrappingFor(Date.class); | ||
| } | ||
|
|
||
| private void _testArrayWrappingFor(Class<?> cls) throws Exception | ||
| { | ||
| try { | ||
| MAPPER.readValue(TOO_DEEP_DOC, cls); | ||
| fail("Should not pass"); | ||
| } catch (MismatchedInputException e) { | ||
| verifyException(e, "Cannot deserialize"); | ||
| verifyException(e, "nested Arrays not allowed"); | ||
| } | ||
| } | ||
|
|
||
| private static String _nestedDoc(int nesting, String open, String close, String content) { | ||
| StringBuilder sb = new StringBuilder(nesting * (open.length() + close.length())); | ||
| for (int i = 0; i < nesting; ++i) { | ||
| sb.append(open); | ||
| if ((i & 31) == 0) { | ||
| sb.append("\n"); | ||
| } | ||
| } | ||
| sb.append("\n").append(content).append("\n"); | ||
| for (int i = 0; i < nesting; ++i) { | ||
| sb.append(close); | ||
| if ((i & 31) == 0) { | ||
| sb.append("\n"); | ||
| } | ||
| } | ||
| return sb.toString(); | ||
| } | ||
|
|
||
| } |