diff --git a/release-notes/VERSION-2.x b/release-notes/VERSION-2.x index 8f02554c94..34a60ffa9a 100644 --- a/release-notes/VERSION-2.x +++ b/release-notes/VERSION-2.x @@ -31,6 +31,8 @@ a pure JSON library. #1041: Start using AssertJ in unit tests #1042: Allow configuring spaces before and/or after the colon in `DefaultPrettyPrinter` (contributed by @digulla) +#1046: Add configurable limit for the maximum number of bytes/chars + of content to parse before failing #1047: Add configurable limit for the maximum length of Object property names to parse before failing (default max: 50,000 chars) (contributed by @pjfanning) diff --git a/src/main/java/com/fasterxml/jackson/core/json/ReaderBasedJsonParser.java b/src/main/java/com/fasterxml/jackson/core/json/ReaderBasedJsonParser.java index 92907fbd7b..27b5cfec2a 100644 --- a/src/main/java/com/fasterxml/jackson/core/json/ReaderBasedJsonParser.java +++ b/src/main/java/com/fasterxml/jackson/core/json/ReaderBasedJsonParser.java @@ -273,11 +273,14 @@ protected void _loadMoreGuaranteed() throws IOException { protected boolean _loadMore() throws IOException { if (_reader != null) { + final int bufSize = _inputEnd; + _currInputProcessed += bufSize; + _currInputRowStart -= bufSize; + // 06-Sep-2023, tatu: [core#1046] Enforce max doc length limit + streamReadConstraints().validateDocumentLength(_currInputProcessed); + int count = _reader.read(_inputBuffer, 0, _inputBuffer.length); if (count > 0) { - final int bufSize = _inputEnd; - _currInputProcessed += bufSize; - _currInputRowStart -= bufSize; // 26-Nov-2015, tatu: Since name-offset requires it too, must offset // this increase to avoid "moving" name-offset, resulting most likely @@ -289,6 +292,7 @@ protected boolean _loadMore() throws IOException return true; } + _inputPtr = _inputEnd = 0; // End of input _closeInput(); // Should never return 0, so let's fail diff --git a/src/main/java/com/fasterxml/jackson/core/json/UTF8StreamJsonParser.java b/src/main/java/com/fasterxml/jackson/core/json/UTF8StreamJsonParser.java index 89dd2b361a..4f43c7eeb9 100644 --- a/src/main/java/com/fasterxml/jackson/core/json/UTF8StreamJsonParser.java +++ b/src/main/java/com/fasterxml/jackson/core/json/UTF8StreamJsonParser.java @@ -255,12 +255,14 @@ protected final boolean _loadMore() throws IOException return false; } + final int bufSize = _inputEnd; + _currInputProcessed += bufSize; + _currInputRowStart -= bufSize; + // 06-Sep-2023, tatu: [core#1046] Enforce max doc length limit + streamReadConstraints().validateDocumentLength(_currInputProcessed); + int count = _inputStream.read(_inputBuffer, 0, space); if (count > 0) { - final int bufSize = _inputEnd; - - _currInputProcessed += bufSize; - _currInputRowStart -= bufSize; // 26-Nov-2015, tatu: Since name-offset requires it too, must offset // this increase to avoid "moving" name-offset, resulting most likely @@ -272,6 +274,7 @@ protected final boolean _loadMore() throws IOException return true; } + _inputPtr = _inputEnd = 0; // End of input _closeInput(); // Should never return 0, so let's fail diff --git a/src/test/java/com/fasterxml/jackson/core/constraints/LargeDocReadTest.java b/src/test/java/com/fasterxml/jackson/core/constraints/LargeDocReadTest.java index 8a7ad2971c..0208e19578 100644 --- a/src/test/java/com/fasterxml/jackson/core/constraints/LargeDocReadTest.java +++ b/src/test/java/com/fasterxml/jackson/core/constraints/LargeDocReadTest.java @@ -33,7 +33,7 @@ public void testLargeNameChars() throws Exception { public void testLargeNameWithSmallLimitBytes() throws Exception { - final String doc = generateJSON(15_000); + final String doc = generateJSON(12_000); try (JsonParser p = createParserUsingStream(JSON_F_DOC_10K, doc, "UTF-8")) { consumeTokens(p); fail("expected StreamConstraintsException"); @@ -44,7 +44,7 @@ public void testLargeNameWithSmallLimitBytes() throws Exception public void testLargeNameWithSmallLimitChars() throws Exception { - final String doc = generateJSON(15_000); + final String doc = generateJSON(12_000); try (JsonParser p = createParserUsingReader(JSON_F_DOC_10K, doc)) { consumeTokens(p); fail("expected StreamConstraintsException"); @@ -55,7 +55,7 @@ public void testLargeNameWithSmallLimitChars() throws Exception public void testLargeNameWithSmallLimitAsync() throws Exception { - final byte[] doc = utf8Bytes(generateJSON(25_000)); + final byte[] doc = utf8Bytes(generateJSON(12_000)); // first with byte[] backend try (AsyncReaderWrapper p = asyncForBytes(JSON_F_DOC_10K, 1000, doc, 1)) {