diff --git a/go.mod b/go.mod index ab28f9182..72878ca0f 100644 --- a/go.mod +++ b/go.mod @@ -15,7 +15,7 @@ require ( github.com/golang/snappy v0.0.1 github.com/klauspost/compress v1.10.10 github.com/lithammer/go-jump-consistent-hash v1.0.1 - github.com/valyala/fastjson v1.5.1 + github.com/valyala/fastjson v1.5.2 github.com/valyala/fastrand v1.0.0 github.com/valyala/gozstd v1.7.0 github.com/valyala/histogram v1.0.1 diff --git a/go.sum b/go.sum index 84c5903b6..03e7bbd04 100644 --- a/go.sum +++ b/go.sum @@ -163,8 +163,8 @@ github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= github.com/valyala/fasthttp v1.12.0/go.mod h1:229t1eWu9UXTPmoUkbpN/fctKPBY4IJoFXQnxHGXy6E= -github.com/valyala/fastjson v1.5.1 h1:SXaQZVSwLjZOVhDEhjiCcDtnX0Feu7Z7A1+C5atpoHM= -github.com/valyala/fastjson v1.5.1/go.mod h1:CLCAqky6SMuOcxStkYQvblddUtoRxhYMGLrsQns1aXY= +github.com/valyala/fastjson v1.5.2 h1:VTbMfG0sCyXqC66PS+ME1cHXy5ClW085avDoy28t4Uo= +github.com/valyala/fastjson v1.5.2/go.mod h1:CLCAqky6SMuOcxStkYQvblddUtoRxhYMGLrsQns1aXY= github.com/valyala/fastrand v1.0.0 h1:LUKT9aKer2dVQNUi3waewTbKV+7H17kvWFNKs2ObdkI= github.com/valyala/fastrand v1.0.0/go.mod h1:HWqCzkrkg6QXT8V2EXWvXCoow7vLwOFN002oeRzjapQ= github.com/valyala/gozstd v1.7.0 h1:Ljh5c9zboqLhwTI33al32R72iCZfn0mCbVGcFWbGwRQ= diff --git a/vendor/github.com/valyala/fastjson/parser.go b/vendor/github.com/valyala/fastjson/parser.go index c617835f0..06a3acc4a 100644 --- a/vendor/github.com/valyala/fastjson/parser.go +++ b/vendor/github.com/valyala/fastjson/parser.go @@ -32,7 +32,7 @@ func (p *Parser) Parse(s string) (*Value, error) { p.b = append(p.b[:0], s...) p.c.reset() - v, tail, err := parseValue(b2s(p.b), &p.c) + v, tail, err := parseValue(b2s(p.b), &p.c, 0) if err != nil { return nil, fmt.Errorf("cannot parse JSON: %s; unparsed tail: %q", err, startEndString(tail)) } @@ -95,20 +95,27 @@ type kv struct { v *Value } -func parseValue(s string, c *cache) (*Value, string, error) { +// MaxDepth is the maximum depth for nested JSON. +const MaxDepth = 300 + +func parseValue(s string, c *cache, depth int) (*Value, string, error) { if len(s) == 0 { return nil, s, fmt.Errorf("cannot parse empty string") } + depth++ + if depth > MaxDepth { + return nil, s, fmt.Errorf("too big depth for the nested JSON; it exceeds %d", MaxDepth) + } if s[0] == '{' { - v, tail, err := parseObject(s[1:], c) + v, tail, err := parseObject(s[1:], c, depth) if err != nil { return nil, tail, fmt.Errorf("cannot parse object: %s", err) } return v, tail, nil } if s[0] == '[' { - v, tail, err := parseArray(s[1:], c) + v, tail, err := parseArray(s[1:], c, depth) if err != nil { return nil, tail, fmt.Errorf("cannot parse array: %s", err) } @@ -160,7 +167,7 @@ func parseValue(s string, c *cache) (*Value, string, error) { return v, tail, nil } -func parseArray(s string, c *cache) (*Value, string, error) { +func parseArray(s string, c *cache, depth int) (*Value, string, error) { s = skipWS(s) if len(s) == 0 { return nil, s, fmt.Errorf("missing ']'") @@ -181,7 +188,7 @@ func parseArray(s string, c *cache) (*Value, string, error) { var err error s = skipWS(s) - v, s, err = parseValue(s, c) + v, s, err = parseValue(s, c, depth) if err != nil { return nil, s, fmt.Errorf("cannot parse array value: %s", err) } @@ -203,7 +210,7 @@ func parseArray(s string, c *cache) (*Value, string, error) { } } -func parseObject(s string, c *cache) (*Value, string, error) { +func parseObject(s string, c *cache, depth int) (*Value, string, error) { s = skipWS(s) if len(s) == 0 { return nil, s, fmt.Errorf("missing '}'") @@ -240,7 +247,7 @@ func parseObject(s string, c *cache) (*Value, string, error) { // Parse value s = skipWS(s) - kv.v, s, err = parseValue(s, c) + kv.v, s, err = parseValue(s, c, depth) if err != nil { return nil, s, fmt.Errorf("cannot parse object value: %s", err) } diff --git a/vendor/github.com/valyala/fastjson/scanner.go b/vendor/github.com/valyala/fastjson/scanner.go index b9ed24264..89b38816f 100644 --- a/vendor/github.com/valyala/fastjson/scanner.go +++ b/vendor/github.com/valyala/fastjson/scanner.go @@ -65,7 +65,7 @@ func (sc *Scanner) Next() bool { } sc.c.reset() - v, tail, err := parseValue(sc.s, &sc.c) + v, tail, err := parseValue(sc.s, &sc.c, 0) if err != nil { sc.err = err return false diff --git a/vendor/modules.txt b/vendor/modules.txt index cb8c78ebb..3accc65cd 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -103,7 +103,7 @@ github.com/klauspost/compress/zstd/internal/xxhash github.com/lithammer/go-jump-consistent-hash # github.com/valyala/bytebufferpool v1.0.0 github.com/valyala/bytebufferpool -# github.com/valyala/fastjson v1.5.1 +# github.com/valyala/fastjson v1.5.2 github.com/valyala/fastjson github.com/valyala/fastjson/fastfloat # github.com/valyala/fastrand v1.0.0