Enforce StreamReadConstraints.maxNumberLength for non-blocking (async) parser#1555
Enforce StreamReadConstraints.maxNumberLength for non-blocking (async) parser#1555cowtowncoder merged 4 commits intoFasterXML:2.18from
StreamReadConstraints.maxNumberLength for non-blocking (async) parser#1555Conversation
StreamReadConstraints.maxNumberLength for non-blocking (async) parser
cowtowncoder
left a comment
There was a problem hiding this comment.
LGTM, will merge first thing tomorrow.
|
Hi there @cowtowncoder @pjfanning, I work in Product Security over at Red Hat. We had a reporter reach out to us concerned that this should be considered a security vulnerability. If you don't mind, I was going to assign a CVE id to track this. Is this alright with you? If so, let me know if anyone would like credit for the discovery and/or if @pjfanning want's credit for the fix. Thanks! |
|
@cebarks we have GHSA-72hv-8253-57qq We don't view this as CVE worthy. The effect of numbers with multi thousand digits is non-linear CPU time parsing the number. We use Java Runtime to do this parsing. If Jackson has an issue, then so does the Java Runtime. |
|
Gotcha, totally reasonable. I'll defer to your judgement and skip assigning a CVE. Thanks for your quick response! |
validate number length against constraints in async parser