diff options
Diffstat (limited to 'src/main')
-rw-r--r-- | src/main/scala/spray/json/JsonParser.scala | 12 | ||||
-rw-r--r-- | src/main/scala/spray/json/JsonParserSettings.scala | 17 |
2 files changed, 26 insertions, 3 deletions
diff --git a/src/main/scala/spray/json/JsonParser.scala b/src/main/scala/spray/json/JsonParser.scala index 4a723b5..3efdac8 100644 --- a/src/main/scala/spray/json/JsonParser.scala +++ b/src/main/scala/spray/json/JsonParser.scala @@ -135,9 +135,19 @@ class JsonParser(input: ParserInput, settings: JsonParserSettings = JsonParserSe `int`() `frac`() `exp`() + val numberLength = input.cursor - start + jsValue = if (startChar == '0' && input.cursor - start == 1) JsNumber.zero - else JsNumber(input.sliceCharArray(start, input.cursor)) + else if (numberLength <= settings.maxNumberCharacters) JsNumber(input.sliceCharArray(start, input.cursor)) + else { + val numberSnippet = new String(input.sliceCharArray(start, math.min(input.cursor, start + 20))) + throw new ParsingException("Number too long", + s"The number starting with '$numberSnippet' had " + + s"$numberLength characters which is more than the allowed limit maxNumberCharacters = ${settings.maxNumberCharacters}. If this is legit input " + + s"consider increasing the limit." + ) + } ws() } diff --git a/src/main/scala/spray/json/JsonParserSettings.scala b/src/main/scala/spray/json/JsonParserSettings.scala index d07075e..b82c47d 100644 --- a/src/main/scala/spray/json/JsonParserSettings.scala +++ b/src/main/scala/spray/json/JsonParserSettings.scala @@ -12,16 +12,29 @@ trait JsonParserSettings { def maxDepth: Int /** - * Return a copy of this settings object with the `maxDepth` setting changed to the new value. + * Returns a copy of this settings object with the `maxDepth` setting changed to the new value. */ def withMaxDepth(newValue: Int): JsonParserSettings + + /** + * The maximum number of characters the parser should support for numbers. This is restricted because creating + * `BigDecimal`s with high precision can be very slow (approx. quadratic runtime per amount of characters). + */ + def maxNumberCharacters: Int + + /** + * Returns a copy of this settings object with the `maxNumberCharacters` setting changed to the new value. + */ + def withMaxNumberCharacters(newValue: Int): JsonParserSettings } object JsonParserSettings { val default: JsonParserSettings = SettingsImpl() private case class SettingsImpl( - maxDepth: Int = 1000 + maxDepth: Int = 1000, + maxNumberCharacters: Int = 100 ) extends JsonParserSettings { override def withMaxDepth(newValue: Int): JsonParserSettings = copy(maxDepth = newValue) + override def withMaxNumberCharacters(newValue: Int): JsonParserSettings = copy(maxNumberCharacters = newValue) } }
\ No newline at end of file |