diff --git a/ICSharpCode.Decompiler.Tests/LightJsonParserTests.cs b/ICSharpCode.Decompiler.Tests/LightJsonParserTests.cs new file mode 100644 index 000000000..eaed1a134 --- /dev/null +++ b/ICSharpCode.Decompiler.Tests/LightJsonParserTests.cs @@ -0,0 +1,71 @@ +// Copyright (c) 2026 Christoph Wille +// +// Permission is hereby granted, free of charge, to any person obtaining a copy of this +// software and associated documentation files (the "Software"), to deal in the Software +// without restriction, including without limitation the rights to use, copy, modify, merge, +// publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons +// to whom the Software is furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all copies or +// substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, +// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR +// PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE +// FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR +// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +// DEALINGS IN THE SOFTWARE. + +using System.Text; + +using LightJson.Serialization; + +using NUnit.Framework; + +namespace ICSharpCode.Decompiler.Tests +{ + [TestFixture] + public class LightJsonParserTests + { + [Test] + public void DeeplyNestedArrays_ThrowCatchableException_InsteadOfOverflowingTheStack() + { + // A crafted .deps.json (see DotNetCorePathFinder) nested far beyond any real + // dependency graph must fail with a catchable parse exception, not an + // uncatchable StackOverflowException that terminates the process. + const int depth = 500; + var json = new string('[', depth) + new string(']', depth); + + Assert.Throws(() => JsonReader.Parse(json)); + } + + [Test] + public void DeeplyNestedObjects_ThrowCatchableException_InsteadOfOverflowingTheStack() + { + const int depth = 500; + var builder = new StringBuilder(); + for (int i = 0; i < depth; i++) + builder.Append("{\"a\":"); + builder.Append("1"); + builder.Append('}', depth); + + Assert.Throws(() => JsonReader.Parse(builder.ToString())); + } + + [Test] + public void ModeratelyNestedJson_ParsesSuccessfully() + { + // Depth well within the limit must still round-trip; the guard must not + // reject legitimately structured documents. + const int depth = 32; + var json = new string('[', depth) + "42" + new string(']', depth); + + var value = JsonReader.Parse(json); + + var current = value; + for (int i = 0; i < depth; i++) + current = current[0]; + Assert.That((int)current, Is.EqualTo(42)); + } + } +} diff --git a/ICSharpCode.Decompiler/Metadata/LightJson/Serialization/JsonParseException.cs b/ICSharpCode.Decompiler/Metadata/LightJson/Serialization/JsonParseException.cs index a4ca5fa2a..e414b8387 100644 --- a/ICSharpCode.Decompiler/Metadata/LightJson/Serialization/JsonParseException.cs +++ b/ICSharpCode.Decompiler/Metadata/LightJson/Serialization/JsonParseException.cs @@ -68,6 +68,11 @@ namespace LightJson.Serialization /// Indicates that the parser encountered and invalid or unexpected character. /// InvalidOrUnexpectedCharacter, + + /// + /// Indicates that the input nested arrays/objects deeper than the parser allows. + /// + MaximumNestingDepthExceeded, } /// @@ -95,6 +100,9 @@ namespace LightJson.Serialization case ErrorType.DuplicateObjectKeys: return "The parser encountered a JsonObject with duplicate keys."; + case ErrorType.MaximumNestingDepthExceeded: + return "The parser exceeded the maximum allowed nesting depth."; + default: return "An error occurred while parsing the JSON message."; } diff --git a/ICSharpCode.Decompiler/Metadata/LightJson/Serialization/JsonReader.cs b/ICSharpCode.Decompiler/Metadata/LightJson/Serialization/JsonReader.cs index 8b742f32d..be9f66255 100644 --- a/ICSharpCode.Decompiler/Metadata/LightJson/Serialization/JsonReader.cs +++ b/ICSharpCode.Decompiler/Metadata/LightJson/Serialization/JsonReader.cs @@ -17,6 +17,15 @@ namespace LightJson.Serialization { private TextScanner scanner; + /// + /// The deepest array/object nesting the parser will descend into before failing. + /// Guards against uncontrolled recursion (CWE-674): without it, deeply nested input + /// such as a crafted .deps.json overflows the stack with an uncatchable + /// StackOverflowException. 64 matches the ecosystem default (System.Text.Json) and is + /// far beyond any real dependency manifest. + /// + private const int MaxNestingDepth = 64; + private JsonReader(TextReader reader) { this.scanner = new TextScanner(reader); @@ -60,8 +69,15 @@ namespace LightJson.Serialization return this.ReadString(); } - private JsonValue ReadJsonValue() + private JsonValue ReadJsonValue(int depth) { + if (depth > MaxNestingDepth) + { + throw new JsonParseException( + ErrorType.MaximumNestingDepthExceeded, + this.scanner.Position); + } + this.scanner.SkipWhitespace(); var next = this.scanner.Peek(); @@ -74,10 +90,10 @@ namespace LightJson.Serialization switch (next) { case '{': - return this.ReadObject(); + return this.ReadObject(depth); case '[': - return this.ReadArray(); + return this.ReadArray(depth); case '"': return this.ReadString(); @@ -320,12 +336,12 @@ namespace LightJson.Serialization return (char)value; } - private JsonObject ReadObject() + private JsonObject ReadObject(int depth) { - return this.ReadObject(new JsonObject()); + return this.ReadObject(new JsonObject(), depth); } - private JsonObject ReadObject(JsonObject jsonObject) + private JsonObject ReadObject(JsonObject jsonObject, int depth) { this.scanner.Assert('{'); @@ -357,7 +373,7 @@ namespace LightJson.Serialization this.scanner.SkipWhitespace(); - var value = this.ReadJsonValue(); + var value = this.ReadJsonValue(depth + 1); jsonObject.Add(key, value); @@ -395,12 +411,12 @@ namespace LightJson.Serialization return jsonObject; } - private JsonArray ReadArray() + private JsonArray ReadArray(int depth) { - return this.ReadArray(new JsonArray()); + return this.ReadArray(new JsonArray(), depth); } - private JsonArray ReadArray(JsonArray jsonArray) + private JsonArray ReadArray(JsonArray jsonArray, int depth) { this.scanner.Assert('['); @@ -416,7 +432,7 @@ namespace LightJson.Serialization { this.scanner.SkipWhitespace(); - var value = this.ReadJsonValue(); + var value = this.ReadJsonValue(depth + 1); jsonArray.Add(value); @@ -457,7 +473,7 @@ namespace LightJson.Serialization private JsonValue Parse() { this.scanner.SkipWhitespace(); - return this.ReadJsonValue(); + return this.ReadJsonValue(0); } } }