valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-06 17:45:22 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

json: Configure rapidjson to use iterative parsing (#5893)

Browse Source
This commit is contained in:
Teddy Reed 2019-10-19 15:25:21 -04:00 committed by GitHub
parent 0bf2245396
commit 15d522f447
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
osquery/utils/json/json.h
View File

@ -19,6 +19,14 @@
#pragma warning(disable : 4715)
#endif
/**
* This protects parsing from overflowing the stack.
* See http://rapidjson.org/md_doc_features.html for more details.
*
* This must be defined before including RapidJSON headers.
*/
#define RAPIDJSON_PARSE_DEFAULT_FLAGS (kParseIterativeFlag)
#include <rapidjson/document.h>
#include <rapidjson/error/en.h>
#include <rapidjson/stringbuffer.h>

13
osquery/utils/json/tests/json.cpp
View File

@ -228,4 +228,17 @@ TEST_F(ConversionsTests, test_json_bool_like) {
EXPECT_FALSE(JSON::valueToBool(doc.doc()["false6"]));
}
/*
* By default, rapidjson will use recursive parsing without stack guards,
* which would result in a segfault for this test. To guard against
* malicious json, we should be configured to use iterative mode.
* https://github.com/Tencent/rapidjson/issues/632
*/
TEST_F(ConversionsTests, test_iterativeparsing) {
std::string json(543210, '[');
auto doc = JSON::newObject();
EXPECT_FALSE(doc.fromString(json).ok());
}
} // namespace osquery