Skip to content

Commit

Permalink
Upgrade to official Jackson fix for preventing a DoS attack
Browse files Browse the repository at this point in the history
Now Jackson automatically coerces very small and very big integers,
so we can remove our custom deserializers.

(cherry picked from commit f675574)
  • Loading branch information
arteam authored and joschi committed Jan 10, 2019
1 parent 7185703 commit 9bfe0df
Show file tree
Hide file tree
Showing 8 changed files with 8 additions and 146 deletions.
2 changes: 1 addition & 1 deletion dropwizard-bom/pom.xml
Expand Up @@ -21,7 +21,7 @@
<dropwizard.version>${project.version}</dropwizard.version>
<guava.version>27.0-jre</guava.version>
<jersey.version>2.27</jersey.version>
<jackson.version>2.9.7</jackson.version>
<jackson.version>2.9.8</jackson.version>
<jetty.version>9.4.14.v20181114</jetty.version>
<servlet.version>3.0.0.v201112011016</servlet.version>
<metrics4.version>4.0.3</metrics4.version>
Expand Down
Expand Up @@ -30,6 +30,6 @@ public void printsDetailedInformationOnMalformedContent() throws Exception {
.hasMessageContaining(String.format(
"%s has an error:%n" +
" * Malformed YAML at line: 3, column: 22; while parsing a flow sequence\n" +
" in 'reader', line 2, column 7:\n", malformedAdvancedFile.getName()));
" in 'reader'", malformedAdvancedFile.getName()));
}
}
Expand Up @@ -69,7 +69,6 @@ private static ObjectMapper configure(ObjectMapper mapper) {
mapper.setSubtypeResolver(new DiscoverableSubtypeResolver());
mapper.disable(FAIL_ON_UNKNOWN_PROPERTIES);

mapper.registerModule(new SafeJavaTimeModule());
return mapper;
}
}

This file was deleted.

This file was deleted.

This file was deleted.

Expand Up @@ -16,10 +16,9 @@ public class JacksonDeserializationOfBigNumbersToDurationTest {
private final ObjectMapper objectMapper = Jackson.newObjectMapper();

@Test(timeout = 5000)
public void testDoesNotAttemptToDeserializeExtremelyBigNumbers() {
assertThatExceptionOfType(JsonMappingException.class).isThrownBy(
() -> objectMapper.readValue("{\"id\": 42, \"duration\": 1e1000000000}", Task.class))
.withMessageStartingWith("Value is out of range of Duration");
public void testDoesNotAttemptToDeserializeExtremelyBigNumbers() throws Exception {
Task task = objectMapper.readValue("{\"id\": 42, \"duration\": 1e1000000000}", Task.class);
assertThat(task.getDuration()).isEqualTo(Duration.ofSeconds(0));
}

@Test
Expand Down
Expand Up @@ -16,10 +16,9 @@ public class JacksonDeserializationOfBigNumbersToInstantTest {
private final ObjectMapper objectMapper = Jackson.newObjectMapper();

@Test(timeout = 5000)
public void testDoesNotAttemptToDeserializeExtremelBigNumbers() {
assertThatExceptionOfType(JsonMappingException.class).isThrownBy(
() -> objectMapper.readValue("{\"id\": 42, \"createdAt\": 1e1000000000}", Event.class))
.withMessageStartingWith("Value is out of range of Instant");
public void testDoesNotAttemptToDeserializeExtremelBigNumbers() throws Exception {
Event event = objectMapper.readValue("{\"id\": 42, \"createdAt\": 1e1000000000}", Event.class);
assertThat(event.getCreatedAt()).isEqualTo(Instant.ofEpochMilli(0));
}

@Test
Expand Down

0 comments on commit 9bfe0df

Please sign in to comment.