JSON Encoder Injection Using Indent

[DustinMoriarty]

BPO	41998
Nosy	@serhiy-storchaka

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2020-10-10.13:39:13.181>
created_at = <Date 2020-10-10.13:22:37.596>
labels = ['type-security', '3.8', '3.9', '3.10', 'invalid', '3.7', 'library']
title = 'JSON Encoder Injection Using Indent'
updated_at = <Date 2020-10-10.13:39:13.180>
user = 'https://bugs.python.org/DustinMoriarty'

bugs.python.org fields:

activity = <Date 2020-10-10.13:39:13.180>
actor = 'DustinMoriarty'
assignee = 'none'
closed = True
closed_date = <Date 2020-10-10.13:39:13.181>
closer = 'DustinMoriarty'
components = ['Library (Lib)']
creation = <Date 2020-10-10.13:22:37.596>
creator = 'DustinMoriarty'
dependencies = []
files = []
hgrepos = []
issue_num = 41998
keywords = []
message_count = 3.0
messages = ['378395', '378400', '378402']
nosy_count = 2.0
nosy_names = ['serhiy.storchaka', 'DustinMoriarty']
pr_nums = []
priority = 'normal'
resolution = 'not a bug'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue41998'
versions = ['Python 3.5', 'Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']

[DustinMoriarty]

It is possible to inject data while encoding json when a string is passed to the indent argument.

Here is an example of an injection attack.

import json

data = {"a": "original data"}
indent = '"b": "injected data",\n'
json_string = json.dumps(data, indent=indent)
print(json_string)

Output:

{
"b": "injected data",
"a": "original data"
}

This is a vulnerability because it is common for CLI and web frameworks to use string as the default data type for arguments. The vulnerability is more likely to be realized for CLI applications where there is more likely to be a use case for exposing the indent parameter to external users in order to control the json output. While this could be prevented by the application using the json encoder, the potential attach vector is not obvious or clear to developers. I cannot see any use case for allowing strings to be passed as indent, so I propose that indent is cast to integer on __init__ of the encoder. I will submit a corresponding PR.

[serhiy-storchaka]

The code works as expected. I do not think there is a problem with the json module. If some application accepts user input and use it without validation to control the formatting of sensitive data, it is a vulnerability in this application, not in tools which it uses.

[DustinMoriarty]

Sounds good. If this is the design intent, then we can close the issue.