[jackson-user] DoS attack about numbers

2018-10-16 Thread wjm wjm
seems that jackson have some problems when parse super number Gson failed at once, but jackson block long times and then failed because jackson parse the super number to BigInteger first and then convert to target number type. i write a reproduce test case please help me to resolve the problem, t

Re: [jackson-user] DoS attack about numbers

2018-10-16 Thread Tatu Saloranta
On Tue, Oct 16, 2018 at 8:02 AM wjm wjm wrote: > > seems that jackson have some problems when parse super number > Gson failed at once, but jackson block long times and then failed > because jackson parse the super number to BigInteger first and then convert > to target number type. > > i write a

Re: [jackson-user] DoS attack about numbers

2018-10-16 Thread wjm wjm
1/2. "too big" or "too small" number, maybe should throw exception, just like Integer.parseInt(..); 3.valid range of BigInteger/BigDecimal should be determined by different scenes but i'm not sure what is the "best" default configuration or just default to unlimit, it's develop team's

Re: [jackson-user] DoS attack about numbers

2018-10-16 Thread Tatu Saloranta
On Tue, Oct 16, 2018 at 9:50 AM wjm wjm wrote: > > 1/2. "too big" or "too small" number, maybe should throw exception, just > like Integer.parseInt(..); > yes, in cases where this occurs that makes sense. > 3.valid range of BigInteger/BigDecimal should be determined by different > scenes >

Re: [jackson-user] DoS attack about numbers

2018-10-16 Thread wjm wjm
在 2018年10月17日星期三 UTC+8上午12:54:52,Tatu Saloranta写道: > > On Tue, Oct 16, 2018 at 9:50 AM wjm wjm > > wrote: > >> >> 1/2. "too big" or "too small" number, maybe should throw exception, just >> like Integer.parseInt(..); >> > > yes, in cases where this occurs that makes sense. > > >> 3.valid