This is an automated email from the ASF dual-hosted git repository.
joerghoh pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git
The following commit(s) were added to refs/heads/master by this push:
new df4f127 SLING-13337 for unit-tests use Johnzon instead of Jakarta
df4f127 is described below
commit df4f127d8423bb1b21ce75e4a638ce510e9d29cc
Author: Joerg Hoh <[email protected]>
AuthorDate: Mon Sep 14 18:15:51 2026 +0200
SLING-13337 for unit-tests use Johnzon instead of Jakarta
---
pom.xml | 6 ++--
.../java/org/apache/sling/xss/impl/XSSAPIImpl.java | 37 +++++++++++++++++++---
.../org/apache/sling/xss/impl/XSSAPIImplTest.java | 8 +++++
3 files changed, 43 insertions(+), 8 deletions(-)
diff --git a/pom.xml b/pom.xml
index f64abfa..dfab5dc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -271,9 +271,9 @@
<scope>test</scope>
</dependency>
<dependency>
- <groupId>org.glassfish</groupId>
- <artifactId>jakarta.json</artifactId>
- <version>2.0.1</version>
+ <groupId>org.apache.johnzon</groupId>
+ <artifactId>johnzon-core</artifactId>
+ <version>2.0.2</version>
<scope>test</scope>
</dependency>
</dependencies>
diff --git a/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java
b/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java
index f752ad2..8853da5 100644
--- a/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java
+++ b/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java
@@ -433,11 +433,14 @@ public class XSSAPIImpl implements XSSAPI {
/**
* Returns {@code true} if {@code json} contains an object/array nesting
level deeper than
- * {@code maxDepth}. Only structural {@code {}}/{@code []} characters
outside of string literals are
- * counted (backslash-escaped quotes are tracked so a string is not exited
early), so a string value
- * that merely contains bracket characters cannot trigger a false
positive. This is a cheap,
- * non-validating scan meant only to bound recursion depth before the
input reaches the JSON parser;
- * it does not otherwise check that {@code json} is well-formed.
+ * {@code maxDepth}. Only structural {@code {}}/{@code []} characters
outside of string literals and
+ * {@code //}/{@code /* *}{@code /} comments are counted
(backslash-escaped quotes are tracked so a
+ * string is not exited early), so a string value or comment that merely
contains bracket characters
+ * cannot trigger a false positive or mask real nesting - the {@code
jsonReaderFactory} used by
+ * {@link #getValidJSON(String, String)} is configured with {@code
org.apache.johnzon.supports-comments},
+ * so comments must be skipped here the same way the parser skips them.
This is a cheap, non-validating
+ * scan meant only to bound recursion depth before the input reaches the
JSON parser; it does not
+ * otherwise check that {@code json} is well-formed.
*
* @param json the serialized JSON document to scan
* @param maxDepth the maximum accepted nesting depth
@@ -447,8 +450,23 @@ public class XSSAPIImpl implements XSSAPI {
int depth = 0;
boolean inString = false;
boolean escaped = false;
+ boolean inLineComment = false;
+ boolean inBlockComment = false;
for (int i = 0; i < json.length(); i++) {
char c = json.charAt(i);
+ if (inLineComment) {
+ if (c == '\n') {
+ inLineComment = false;
+ }
+ continue;
+ }
+ if (inBlockComment) {
+ if (c == '*' && i + 1 < json.length() && json.charAt(i + 1) ==
'/') {
+ inBlockComment = false;
+ i++;
+ }
+ continue;
+ }
if (inString) {
if (escaped) {
escaped = false;
@@ -463,6 +481,15 @@ public class XSSAPIImpl implements XSSAPI {
case '"':
inString = true;
break;
+ case '/':
+ if (i + 1 < json.length() && json.charAt(i + 1) == '/') {
+ inLineComment = true;
+ i++;
+ } else if (i + 1 < json.length() && json.charAt(i + 1) ==
'*') {
+ inBlockComment = true;
+ i++;
+ }
+ break;
case '{':
case '[':
depth++;
diff --git a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
index 75e8e98..5243725 100644
--- a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
+++ b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
@@ -303,6 +303,14 @@ public class XSSAPIImplTest {
() -> assertEquals(RUBBISH_JSON,
xssAPI.getValidJSON(deeplyNested, RUBBISH_JSON)));
}
+ @Test
+ public void testGetValidJSONDeepNestingAfterCommentDoesNotStackOverflow() {
+ String deeplyNested = "/*" + "]".repeat(5000) + "*/" +
"[".repeat(5000) + "1" + "]".repeat(5000);
+ assertTimeoutPreemptively(
+ Duration.ofSeconds(5),
+ () -> assertEquals(RUBBISH_JSON,
xssAPI.getValidJSON(deeplyNested, RUBBISH_JSON)));
+ }
+
@Test
public void testGetValidJSONNestingWithinStringIsNotFalselyRejected() {
// bracket characters inside a string value are not structural nesting
and must not count
