JsonStringInput: accept decimal format for integer types #272
Conversation
commons-core/src/main/scala/com/avsystem/commons/serialization/json/JsonStringInput.scala
Show resolved
Hide resolved
commons-core/src/main/scala/com/avsystem/commons/serialization/json/JsonStringInput.scala
Show resolved
Hide resolved
commons-core/src/main/scala/com/avsystem/commons/serialization/json/JsonStringInput.scala
Show resolved
Hide resolved
commons-core/src/main/scala/com/avsystem/commons/serialization/json/JsonStringInput.scala
Show resolved
Hide resolved
| def readLong(): Long = parseNumber { str => | ||
| if (isInteger(str)) str.toLong | ||
| else { | ||
| val bd = BigDecimal(str, options.mathContext) |
There was a problem hiding this comment.
Using BigDecimal for parsing of Long values opens ability for DoS/DoW attacks which exploit O(n^2) complexity of Java's way to parse big numbers from textual representations.
I've raised an issue for BigInt and BigDecimal types but now it goes to more widely used types.
There was a problem hiding this comment.
@plokhotnyuk do you have a safe BigInt/BigDecimal parsing implementation that we could lend?
There was a problem hiding this comment.
Here is the code which has O(n^1.5) complexity and checks limits for the scale and number of digits. I've used the following default values for them.
There was a problem hiding this comment.
Current part with tests LGTM. Feel free to continue the BigDecimal case here if you wish with @plokhotnyuk.
|
|
No description provided.