You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
StackOverflowError caused by xxl-tool parsing of untrusted JSON String
Description
Using xxl-tool to parse untrusted JSON String may be vulnerable to denial of service (DOS) attacks. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Error Log
Exception in thread "main" java.lang.StackOverflowError
at java.base/java.lang.String.charAt(String.java:693)
at com.xxl.tool.json.reader.BasicJsonReader.trimTrailingCharacter(BasicJsonReader.java:168)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:75)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
at com.xxl.tool.json.reader.BasicJsonReader.parseInternal(BasicJsonReader.java:53)
at com.xxl.tool.json.reader.BasicJsonReader.parseMapInternal(BasicJsonReader.java:79)
Refer to the solution of jackson-databind: Add the depth variable to record the current parsing depth. If the parsing depth exceeds a certain threshold, an exception is thrown. (FasterXML/jackson-databind@fcfc499)
StackOverflowError caused by xxl-tool parsing of untrusted JSON String
Description
Using xxl-tool to parse untrusted JSON String may be vulnerable to denial of service (DOS) attacks. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Error Log
PoC
Rectification Solution
Refer to the solution of jackson-databind: Add the depth variable to record the current parsing depth. If the parsing depth exceeds a certain threshold, an exception is thrown. (FasterXML/jackson-databind@fcfc499)
Refer to the GSON solution: Change the recursive processing on deeply nested arrays or JSON objects to stack+iteration processing.((google/gson@2d01d6a20f39881c692977564c1ea591d9f39027))
References
The text was updated successfully, but these errors were encountered: