Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.
And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.
Denial of service when parsing a big JSON number as Instant/ZonedDateTime/OffsetDateTime
See original GitHub issueIt looks the same as: https://github.com/playframework/play-json/issues/180
Reproduced by the following commit: https://github.com/plokhotnyuk/jsoniter-scala/pull/153/commits/0d53faf5093b492867b550f2cec55ff0b5cc62de
The security bug is in InstantDeserializer and DurationDeserializer of the jackson-datatype-jsr310 artifact:
protected T _fromDecimal(DeserializationContext context, BigDecimal value)
{
long seconds = value.longValue(); // <- hangs in case of 10000000e100000000
int nanoseconds = DecimalUtils.extractNanosecondDecimal(value, seconds);
return fromNanoseconds.apply(new FromDecimalArguments(
seconds, nanoseconds, getZone(context)));
}
W/A is to use custom serializers for all types that are parsed with InstantDeserializer and DurationDeserializer by registering them after (or instead of) registration of the JavaTimeModule module.
Issue Analytics
- State:
- Created 5 years ago
- Reactions:15
- Comments:27 (6 by maintainers)
Top Results From Across the Web
Top Related Medium Post
Top Related StackOverflow Question
Troubleshoot Live Code
Top Related Reddit Thread
Top Related Hackernoon Post
Top Related Tweet
Top Related Dev.to Post
Top Related Hashnode Post
@abracadv8 would
longValueExactbe enough? if we want long anyway then it might be good idea to throw exception if number is too large/low, and this will do everything for you. Also @plokhotnyuk note that similar operation is inside DecimalUtils: https://github.com/FasterXML/jackson-modules-java8/blob/b45e632dbf4911c49cf33d2e8da5eb31113d1d75/datetime/src/main/java/com/fasterxml/jackson/datatype/jsr310/DecimalUtils.java#L101 And this will hang too.@cowtowncoder More over, it seems that during parsing of any JSON object it is possible to DoS the Jackson parser by just adding a field with the big number.
Here is a PR which initially reproduced it for Play-JSON parser:
https://github.com/plokhotnyuk/jsoniter-scala/pull/168/files
Below are results of parametrized benchmarks where the
sizeparameter specifies a number of digits in the value of that additional field:Step to reproduce are same as before, except the names of branch and benchmark:
sbtand/or ensure that it already installed properly:jsoniter-scalarepo:play-json-DoS-using-big-numberbranch: