ILSpy

94 Tags

91 MiB

Tree: 5db54eb8af

Author	SHA1	Message	Date
Christoph Wille	9b3e33472d	Cap LightJson parser nesting depth to prevent stack overflow The JSON parser's value/object/array readers are mutually recursive with no depth limit, so input nested tens of thousands of levels deep overflows the stack with an uncatchable StackOverflowException (CWE-674) that kills the process. This is reachable through DotNetCorePathFinder, which parses the .deps.json shipped next to an opened assembly, so a crafted manifest beside a target turns dependency resolution into a clean process kill. Thread a depth counter through the readers and throw a catchable JsonParseException once nesting passes a fixed cap. The cap (64) matches the System.Text.Json default and is far beyond any real dependency graph. Assisted-by: Claude:claude-fable-5:Claude Code	3 weeks ago
Peter Crabtree	e1e16b64f5	dev: Strip BOM mark from text files	1 year ago
dotnet format	0d9f871a4f	#2128 : Reformat the whole code base.	6 years ago
Siegfried Pammer	87ced033ba	Rename Dom -> Metadata; Remove bogus abstraction	9 years ago