Check for trailing content when parsing JSON #5048
Conversation
|
Currently, based on #4537, since it fixes also code being added there. |
findepi
force-pushed
the
findepi/reject-trailing-json-garbage
branch
from
314e6fb to
3661c85
Compare
findepi
force-pushed
the
findepi/reject-trailing-json-garbage
branch
from
3661c85 to
3e684b7
Compare
Before the change, various JSON parsing routines would ignore content
after a `}` matching to the opening `{` is found. This commit changes
the common parsing pattern to use a newly introduced utility method
which checks for trailing payload and fails if any is found.
findepi
force-pushed
the
findepi/reject-trailing-json-garbage
branch
from
3e684b7 to
b40c777
Compare
|
I think I don't know how to fix the iceberg-mr classpath to include jackson databind, with the right version. |
|
@findepi, what problem is this fixing? Did you see this in practice with a corrupt file? |
|
@rdblue thank for spending time and reviewing my PR.
I haven't. i also don't see currently that this could be exploited for security reasons
we incorrectly accept an incorrect input which ought to be rejected |
|
we have a bug in the library where we accept invalid JSON payloads (files) just because we stop parsing at some point. |
|
@danielcweeks do you have opinion about this PR? |
3 participants
Before the change, various JSON parsing routines would ignore content
after a
}matching to the opening{is found. This commit changesthe common parsing pattern to use a newly introduced utility method
which checks for trailing payload and fails if any is found.
Follows #4537 (comment)