json: Limit how deeply nested arrays and objects can be

json/json.h

@@ -70,6 +70,22 @@ class Parser {
 public:
     explicit constexpr Parser(std::string_view json) : json_{json} {}
 
+    std::optional<Value> parse() {
+        static constexpr auto kRecursionLimit = 257;
+        auto v = parse_value(kRecursionLimit);
+        skip_whitespace();
+
+        if (!is_eof()) {
+            return std::nullopt;
+        }
+
+        return v;
+    }
+
+private:
+    std::string_view json_;
+    std::size_t pos_{0};
+
     constexpr bool is_eof() const { return pos_ >= json_.size(); }
 
     constexpr bool is_whitespace(char c) const {
@@ -108,19 +124,12 @@ class Parser {
         }
     }
 
-    std::optional<Value> parse() {
-        auto v = parse_value();
-        skip_whitespace();
-
-        if (!is_eof()) {
+    // NOLINTNEXTLINE(misc-no-recursion)
+    std::optional<Value> parse_value(int recursion_limit) {
+        if (recursion_limit <= 0) {
             return std::nullopt;
         }
 
-        return v;
-    }
-
-    // NOLINTNEXTLINE(misc-no-recursion)
-    std::optional<Value> parse_value() {
         skip_whitespace();
         auto c = peek();
         if (!c) {
@@ -141,9 +150,9 @@ class Parser {
             case 'n':
                 return parse_null();
             case '[':
-                return parse_array();
+                return parse_array(recursion_limit);
             case '{':
-                return parse_object();
+                return parse_object(recursion_limit);
             default:
                 return std::nullopt;
         }
@@ -246,7 +255,7 @@ class Parser {
     }
 
     // NOLINTNEXTLINE(misc-no-recursion)
-    std::optional<Value> parse_object() {
+    std::optional<Value> parse_object(int recursion_limit) {
         std::ignore = consume(); // '{'
         skip_whitespace();
 
@@ -269,7 +278,7 @@ class Parser {
                 return std::nullopt;
             }
 
-            auto value = parse_value();
+            auto value = parse_value(recursion_limit - 1);
             if (!value) {
                 return std::nullopt;
             }
@@ -297,7 +306,7 @@ class Parser {
     }
 
     // NOLINTNEXTLINE(misc-no-recursion)
-    std::optional<Value> parse_array() {
+    std::optional<Value> parse_array(int recursion_limit) {
         std::ignore = consume(); // '['
         skip_whitespace();
 
@@ -308,7 +317,7 @@ class Parser {
 
         Array array;
         while (true) {
-            auto v = parse_value();
+            auto v = parse_value(recursion_limit - 1);
             if (!v) {
                 return std::nullopt;
             }
@@ -486,10 +495,6 @@ class Parser {
 
         return code_unit;
     }
-
-private:
-    std::string_view json_;
-    std::size_t pos_{0};
 };
 
 inline std::optional<Value> parse(std::string_view json) {

json/json_test.cpp

@@ -7,7 +7,10 @@
 #include "etest/etest2.h"
 
 #include <algorithm>
+#include <cstddef>
 #include <optional>
+#include <string>
+#include <variant>
 
 int main() {
     using json::Value;
@@ -142,5 +145,98 @@ int main() {
         a.expect_eq(json::parse("123."), std::nullopt);
     });
 
+    s.add_test("deeply nested object", [](etest::IActions &a) {
+        static constexpr auto kMaxDepth = 256;
+        std::string to_parse;
+        for (int i = 0; i < kMaxDepth; ++i) {
+            to_parse += R"({"a":)";
+        }
+
+        to_parse += R"("b")";
+
+        for (int i = 0; i < kMaxDepth; ++i) {
+            to_parse += "}";
+        }
+
+        auto json = json::parse(to_parse).value();
+
+        json::Object const *v = std::get_if<json::Object>(&json);
+        a.expect(v != nullptr);
+
+        while (v != nullptr && !v->values.empty()) {
+            a.expect_eq(v->values[0].first, "a");
+            if (!std::holds_alternative<json::Object>(v->values[0].second)) {
+                break;
+            }
+
+            v = std::get_if<json::Object>(&v->values[0].second);
+        }
+
+        a.require_eq(v->values.size(), std::size_t{1});
+        a.expect_eq(std::get<std::string>(v->values[0].second), "b");
+    });
+
+    s.add_test("deeply nested object, limit hit", [](etest::IActions &a) {
+        static constexpr auto kMaxDepth = 300;
+        std::string to_parse;
+        for (int i = 0; i < kMaxDepth; ++i) {
+            to_parse += R"({"a":)";
+        }
+
+        to_parse += R"("b")";
+
+        for (int i = 0; i < kMaxDepth; ++i) {
+            to_parse += "}";
+        }
+
+        a.expect_eq(json::Parser{to_parse}.parse(), std::nullopt);
+    });
+
+    s.add_test("deeply nested array", [](etest::IActions &a) {
+        static constexpr auto kMaxDepth = 256;
+        std::string to_parse;
+        for (int i = 0; i < kMaxDepth; ++i) {
+            to_parse += "[";
+        }
+
+        to_parse += R"("b")";
+
+        for (int i = 0; i < kMaxDepth; ++i) {
+            to_parse += "]";
+        }
+
+        auto json = json::parse(to_parse).value();
+
+        json::Array const *v = std::get_if<json::Array>(&json);
+        a.expect(v != nullptr);
+
+        while (v != nullptr && !v->values.empty()) {
+            if (!std::holds_alternative<json::Array>(v->values[0])) {
+                break;
+            }
+
+            v = std::get_if<json::Array>(&v->values[0]);
+        }
+
+        a.require_eq(v->values.size(), std::size_t{1});
+        a.expect_eq(std::get<std::string>(v->values[0]), "b");
+    });
+
+    s.add_test("deeply nested array, limit hit", [](etest::IActions &a) {
+        static constexpr auto kMaxDepth = 300;
+        std::string to_parse;
+        for (int i = 0; i < kMaxDepth; ++i) {
+            to_parse += "[";
+        }
+
+        to_parse += R"("b")";
+
+        for (int i = 0; i < kMaxDepth; ++i) {
+            to_parse += "]";
+        }
+
+        a.expect_eq(json::Parser{to_parse}.parse(), std::nullopt);
+    });
+
     return s.run();
 }