userver icon indicating copy to clipboard operation
userver copied to clipboard

[json] parse depth limit

Open segoon opened this issue 1 year ago • 2 comments

Parsing depth should be limited to some sane value, e.g. 128. Too big value may lead to a recursive call to rapidjson which might lead to stack overflow.

Internal ticket: 7801

segoon avatar Dec 04 '23 09:12 segoon

This can be implemented without patching rapidjson itself. formats::json::FromString can use a wrapper class/struct around impl::Value with rapidjson visitation API that keeps track of the depth and forwards to impl::Value's visitation API.

Anton3 avatar Dec 04 '23 09:12 Anton3

@segoon can you please assign this one to me?

moki avatar Dec 08 '23 13:12 moki