Skip to content

Commit

Permalink
Disallow nested objects and arrays as keys in objects
Browse files Browse the repository at this point in the history
Port of stleary/JSON-java#772
to partially remediate
https://www.cve.org/CVERecord?id=CVE-2023-5072 , where
nested keys can allow relatively small inputs to
cause OOM errors through recursion.

Test by:
- package & import into alpha locally
- confirm a suite of unit tests depending on JSONObjects
passes
- verify that the following CVE Proof-of-concept fails
with an 'unexpected character' exception:
https://security.snyk.io/vuln/SNYK-JAVA-ORGJSON-5962464
  • Loading branch information
claireagordon committed Mar 26, 2024
1 parent 1810c2c commit bf3a2ff
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 6 deletions.
3 changes: 1 addition & 2 deletions org/json/JSONObject.java
Original file line number Diff line number Diff line change
Expand Up @@ -187,8 +187,7 @@ public JSONObject(JSONTokener x) throws JSONException {
case '}':
return;
default:
x.back();
key = x.nextValue().toString();
key = x.nextSimpleValue(c).toString();
}

/*
Expand Down
15 changes: 11 additions & 4 deletions org/json/JSONTokener.java
Original file line number Diff line number Diff line change
Expand Up @@ -363,12 +363,8 @@ public String nextTo(String delimiters) throws JSONException {
*/
public Object nextValue() throws JSONException {
char c = nextClean();
String s;

switch (c) {
case '"':
case '\'':
return nextString(c);
case '{':
back();
return new JSONObject(this);
Expand All @@ -377,6 +373,17 @@ public Object nextValue() throws JSONException {
back();
return new JSONArray(this);
}
return nextSimpleValue(c);
}

Object nextSimpleValue(char c) throws JSONException {
String s;

switch (c) {
case '"':
case '\'':
return this.nextString(c);
}

/*
* Handle unquoted text. This could be the values true, false, or
Expand Down

0 comments on commit bf3a2ff

Please sign in to comment.