Fix issues that are variants of those #1182 (#1184)

* Catch excessive objects in json being parsed, even if following a comment.

* Include line info on excessive content for deserialisation.
This commit is contained in:
Jon Hanna
2017-01-19 10:33:30 +13:00
committed by James Newton-King
parent 76600dcc5b
commit 8956d3ca9c
9 changed files with 137 additions and 10 deletions
@@ -556,6 +556,31 @@ Parameter name: index");
Assert.AreEqual(3, (int)a[2]);
}
[Test]
public void Parse_ExcessiveContentJustComments()
{
string json = @"[1,2,3]/*comment*/
//Another comment.";
JArray a = JArray.Parse(json);
Assert.AreEqual(3, a.Count);
Assert.AreEqual(1, (int)a[0]);
Assert.AreEqual(2, (int)a[1]);
Assert.AreEqual(3, (int)a[2]);
}
[Test]
public void Parse_ExcessiveContent()
{
string json = @"[1,2,3]/*comment*/
//Another comment.
[]";
ExceptionAssert.Throws<JsonReaderException>(() => JArray.Parse(json),
"Additional text encountered after finished reading JSON content: [. Path '', line 3, position 0.");
}
[Test]
public void Parse_LineInfo()
{
@@ -1994,5 +1994,30 @@ Parameter name: arrayIndex");
Assert.AreEqual(2, (int)o["prop"][1]);
Assert.AreEqual(3, (int)o["prop"][2]);
}
[Test]
public void Parse_ExcessiveContentJustComments()
{
string json = @"{'prop':[1,2,3]}/*comment*/
//Another comment.";
JObject o = JObject.Parse(json);
Assert.AreEqual(3, o["prop"].Count());
Assert.AreEqual(1, (int)o["prop"][0]);
Assert.AreEqual(2, (int)o["prop"][1]);
Assert.AreEqual(3, (int)o["prop"][2]);
}
[Test]
public void Parse_ExcessiveContent()
{
string json = @"{'prop':[1,2,3]}/*comment*/
//Another comment.
[]";
ExceptionAssert.Throws<JsonReaderException>(() => JObject.Parse(json),
"Additional text encountered after finished reading JSON content: [. Path '', line 3, position 0.");
}
}
}
@@ -1264,5 +1264,30 @@ namespace Newtonsoft.Json.Tests.Linq
Assert.AreEqual(2, (int)o["prop"][1]);
Assert.AreEqual(3, (int)o["prop"][2]);
}
[Test]
public void Parse_ExcessiveContentJustComments()
{
string json = @"{'prop':[1,2,3]}/*comment*/
//Another comment.";
JToken o = JToken.Parse(json);
Assert.AreEqual(3, o["prop"].Count());
Assert.AreEqual(1, (int)o["prop"][0]);
Assert.AreEqual(2, (int)o["prop"][1]);
Assert.AreEqual(3, (int)o["prop"][2]);
}
[Test]
public void Parse_ExcessiveContent()
{
string json = @"{'prop':[1,2,3]}/*comment*/
//Another comment.
{}";
ExceptionAssert.Throws<JsonReaderException>(() => JToken.Parse(json),
"Additional text encountered after finished reading JSON content: {. Path '', line 3, position 0.");
}
}
}
@@ -8253,7 +8253,52 @@ lines.*/
reader.Read();
serializer.Deserialize(reader, typeof(MyType));
}, "Additional text found in JSON string after finishing deserializing object.");
}, "Additional text found in JSON string after finishing deserializing object. Path '[1]', line 1, position 5.");
}
[Test]
public void AdditionalContentAfterFinishCheckNotRequested()
{
string json = @"{ ""MyProperty"":{""Key"":""Value""}} A bunch of junk at the end of the json";
JsonSerializer serializer = new JsonSerializer();
var reader = new JsonTextReader(new StringReader(json));
MyType mt = (MyType)serializer.Deserialize(reader, typeof(MyType));
Assert.AreEqual(1, mt.MyProperty.Count);
}
[Test]
public void AdditionalContentAfterCommentsCheckNotRequested()
{
string json = @"{ ""MyProperty"":{""Key"":""Value""}} /*this is a comment */
// this is also a comment
This is just junk, though.";
JsonSerializer serializer = new JsonSerializer();
var reader = new JsonTextReader(new StringReader(json));
MyType mt = (MyType)serializer.Deserialize(reader, typeof(MyType));
Assert.AreEqual(1, mt.MyProperty.Count);
}
[Test]
public void AdditionalContentAfterComments()
{
string json = @"[{ ""MyProperty"":{""Key"":""Value""}} /*this is a comment */
// this is also a comment
,{}";
JsonSerializer serializer = new JsonSerializer();
serializer.CheckAdditionalContent = true;
var reader = new JsonTextReader(new StringReader(json));
reader.Read();
reader.Read();
ExceptionAssert.Throws<JsonSerializationException>(() => serializer.Deserialize(reader, typeof(MyType)),
"Additional text found in JSON string after finishing deserializing object. Path '[1]', line 3, position 2.");
}
[Test]
+8 -2
View File
@@ -962,9 +962,15 @@ namespace Newtonsoft.Json
{
jsonSerializer.Populate(jsonReader, target);
if (jsonReader.Read() && jsonReader.TokenType != JsonToken.Comment)
if (settings != null && settings.CheckAdditionalContent)
{
throw new JsonSerializationException("Additional text found in JSON string after finishing deserializing object.");
while (jsonReader.Read())
{
if (jsonReader.TokenType != JsonToken.Comment)
{
throw JsonSerializationException.Create(jsonReader, "Additional text found in JSON string after finishing deserializing object.");
}
}
}
}
}
+2 -2
View File
@@ -176,9 +176,9 @@ namespace Newtonsoft.Json.Linq
{
JArray a = Load(reader, settings);
if (reader.Read() && reader.TokenType != JsonToken.Comment)
while (reader.Read())
{
throw JsonReaderException.Create(reader, "Additional text found in JSON string after parsing content.");
// Any content encountered here other than a comment will throw in the reader.
}
return a;
+2 -2
View File
@@ -426,9 +426,9 @@ namespace Newtonsoft.Json.Linq
{
JObject o = Load(reader, settings);
if (reader.Read() && reader.TokenType != JsonToken.Comment)
while (reader.Read())
{
throw JsonReaderException.Create(reader, "Additional text found in JSON string after parsing content.");
// Any content encountered here other than a comment will throw in the reader.
}
return o;
+3 -2
View File
@@ -2187,11 +2187,12 @@ namespace Newtonsoft.Json.Linq
{
JToken t = Load(reader, settings);
if (reader.Read() && reader.TokenType != JsonToken.Comment)
while (reader.Read())
{
throw JsonReaderException.Create(reader, "Additional text found in JSON string after parsing content.");
// Any content encountered here other than a comment will throw in the reader.
}
return t;
}
}
@@ -173,7 +173,7 @@ namespace Newtonsoft.Json.Serialization
{
if (reader.TokenType != JsonToken.Comment)
{
throw new JsonSerializationException("Additional text found in JSON string after finishing deserializing object.");
throw JsonSerializationException.Create(reader, "Additional text found in JSON string after finishing deserializing object.");
}
}
}