Throw JsonMappingException for deeply nested JSON (#2816, CVE-2020-36518)#3416

Merged

cowtowncoder merged 3 commits intoFasterXML:2.13from TaylorSMarks:2.13

Mar 22, 2022

+133-47

Commits on Mar 16, 2022

Throw a checked JsonMappingException instead of an unchecked StackOverflowException as a hotfix for FasterXML#2816 , CVE-2020-36518

TaylorSMarks
authored and
Taylor Marks
committed

Commits on Mar 17, 2022

Track depth of object being deserialized and abort if it's too deep (arbitrary defined as 256 levels deep) as a hotfix for FasterXML#2816 , CVE-2020-36518

TaylorSMarks
authored and
Taylor Marks
committed
Increase the maximum depth from 256 to 1000. Update the unit tests to use 1000 as a depth that's not too deep and 4000 as a depth that is.

TaylorSMarks
authored and
Taylor Marks
committed