net.minidev.json.parser.ParseException: Malicious payload, having non natural depths. about json-smart-v2 HOT 8 CLOSED

@brad302 I think it has been discussed this in #131 (comment)
Could you please provide us the case? We can add an argument to customize this limit if need.
cc @UrielCh

from json-smart-v2.

seemingly innocuous sized JSON structure

I think this error only occurs when json size very large. Could you please provide a minimal reproduced case?

from json-smart-v2.

seemingly innocuous sized JSON structure

I think this error only occurs when json size very large. Could you please provide a minimal reproduced case?

Yep, have attached one.

When I say "innocuous" I mean, I would expect it to be able to be processed. I consider the payload to be large enough but I have seen much larger.

Let me know how you go. Thanks
payload.zip

from json-smart-v2.

@brad302 @UrielCh
I hava created a draft pr #155 for this issue. PTAL

from json-smart-v2.

What are the chances of having the default value substantially increased? My issue is, when this new version is released, there's nothing to say that Talend will follow suit and provide the ability to enter a value and override the default.

It may be a big ask but something like 2000 (rather than 400) would help a lot. I'd say that would still alleviate any issues relating to a DDOS attack but not sure if it would then re-expose the CVE.

Happy to get your thoughts.

from json-smart-v2.

If a real non-malicious application needs more, adding a flag to drop this security may be a better choice, and increasing the current 400 to more like 1000, is fine, 400 never blew up any stack, and 1000 is still kind of okay.

from json-smart-v2.

discussions are in progress in the draft #155

from json-smart-v2.

I think we can close this issue now, see #156 to drop the limit.

from json-smart-v2.