Check no additional entry is present when deserializing with UntypedR…

…eflectDeserializerVisitor
bevyengine · Jan 7, 2023 · 55c1382 · 55c1382
1 parent 85743ce
commit 55c1382
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/crates/bevy_reflect/src/serde/de.rs b/crates/bevy_reflect/src/serde/de.rs
@@ -8,7 +8,8 @@ use crate::{
 };
 use erased_serde::Deserializer;
 use serde::de::{
-    self, DeserializeSeed, EnumAccess, Error, MapAccess, SeqAccess, VariantAccess, Visitor,
+    self, DeserializeSeed, EnumAccess, Error, IgnoredAny, MapAccess, SeqAccess, VariantAccess,
+    Visitor,
 };
 use serde::Deserialize;
 use std::any::TypeId;
@@ -282,7 +283,7 @@ impl<'a, 'de> Visitor<'de> for UntypedReflectDeserializerVisitor<'a> {
     {
         let type_name = map
             .next_key::<BorrowableCowStr>()?
-            .ok_or_else(|| Error::invalid_length(0, &"at least one entry"))?
+            .ok_or_else(|| Error::invalid_length(0, &"a single entry"))?
             .0;
 
         let registration = self.registry.get_with_name(&type_name).ok_or_else(|| {
@@ -292,6 +293,11 @@ impl<'a, 'de> Visitor<'de> for UntypedReflectDeserializerVisitor<'a> {
             registration,
             registry: self.registry,
         })?;
+
+        if map.next_key::<IgnoredAny>()?.is_some() {
+            return Err(Error::invalid_length(2, &"a single entry"));
+        }
+
         Ok(value)
     }
 }