Enforce maximum json stack depth

.github/workflows/ci.yml

@@ -7,21 +7,21 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Cache Composer dependencies
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: /tmp/composer-cache
           key: ${{ runner.os }}-${{ hashFiles('**/composer.lock') }}
 
-      - uses: php-actions/composer@v5
+      - uses: php-actions/composer@v6
 
       - name: Archive build
         run: mkdir /tmp/github-actions/ && tar -cvf /tmp/github-actions/build.tar ./
 
       - name: Upload build archive for test runners
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: build-artifact
           path: /tmp/github-actions
@@ -31,7 +31,7 @@ jobs:
     needs: [composer]
 
     steps:
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
         with:
           name: build-artifact
           path: /tmp/github-actions
@@ -40,9 +40,9 @@ jobs:
         run: tar -xvf /tmp/github-actions/build.tar ./
 
       - name: PHP Unit tests
-        uses: php-actions/phpunit@v2
+        uses: php-actions/phpunit@v3
         with:
-          php_version: 8.0
+          php_version: 8.1
           php_extensions: xdebug
           configuration: test/phpunit/phpunit.xml
           bootstrap: vendor/autoload.php
@@ -52,7 +52,7 @@ jobs:
     needs: [composer]
 
     steps:
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
         with:
           name: build-artifact
           path: /tmp/github-actions
@@ -61,6 +61,7 @@ jobs:
         run: tar -xvf /tmp/github-actions/build.tar ./
 
       - name: PHP Static Analysis
-        uses: php-actions/phpstan@v2
+        uses: php-actions/phpstan@v3
         with:
-          path: src/
+          path: src/
+          php_version: 8.1

src/JsonObjectBuilder.php

@@ -12,8 +12,13 @@
 use stdClass;
 
 class JsonObjectBuilder extends DataObjectBuilder {
+	public function __construct(
+		private readonly int $depth = 512,
+	) {
+	}
+
 	public function fromJsonString(string $jsonString):JsonObject {
-		$json = json_decode($jsonString);
+		$json = json_decode($jsonString, depth: $this->depth);
 		if(is_null($json)) {
 // It's completely reasonable to have a null value here, so we need to check the
 // error code before throwing an exception.
@@ -26,7 +31,7 @@ public function fromJsonString(string $jsonString):JsonObject {
 	}
 
 	/**
-	 * @param object|array|string|int|float|bool|null $jsonDecoded
+	 * @param object|array<mixed>|string|int|float|bool|null $jsonDecoded
 	 */
 	public function fromJsonDecoded(
 		object|array|string|int|float|bool|null $jsonDecoded

test/phpunit/JsonObjectBuilderTest.php

@@ -194,4 +194,25 @@ public function testFromJson_illegalCharacters() {
 		self::expectExceptionMessage("Error decoding JSON: Malformed UTF-8 characters, possibly incorrectly encoded");
 		$sut->fromJsonString($jsonString);
 	}
+
+	public function testFromJson_depth() {
+		$jsonString = <<<JSON
+		{
+			"name": "Greg",
+			"address": {
+				"home": {
+					"addressId": 105
+				},
+				"work": {
+					"addressId": 210
+				}
+			}
+		}
+		JSON;
+
+		$sut = new JsonObjectBuilder(3);
+		self::expectException(JsonDecodeException::class);
+		self::expectExceptionMessage("Error decoding JSON: Maximum stack depth exceeded");
+		$sut->fromJsonString($jsonString);
+	}
 }