mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2025-10-29 05:40:27 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

spa: json: allow only ascii in bare values

Browse source 
Control characters probably are an error. We also are not validating any
utf8 here, so disallow bare utf8 too --- one likely should use strings
for such content anyway as spaces are not allowed otherwise.
This commit is contained in:
Pauli Virtanen 2024-03-24 21:08:45 +02:00
parent e63e8b8a37
commit 921c8b99db
2 changed files with 23 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
spa/include/spa/utils/json.h
View file

@ -137,12 +137,16 @@ static inline int spa_json_next(struct spa_json * iter, const char **value)
/* disallow bare escape */ /* disallow bare escape */
goto error; goto error;
default: default:
/* allow bare ascii */
if (!(cur >= 32 && cur <= 126))
goto error;
*value = iter->cur; *value = iter->cur;
iter->state = __BARE | flag; iter->state = __BARE | flag;
} }
continue; continue;
case __BARE: case __BARE:
switch (cur) { switch (cur) {
case '\0':
case '\t': case ' ': case '\r': case '\n': case '\t': case ' ': case '\r': case '\n':
case '"': case '#': case '"': case '#':
case ':': case ',': case '=': case ']': case '}': case ':': case ',': case '=': case ']': case '}':
@ -153,8 +157,12 @@ static inline int spa_json_next(struct spa_json * iter, const char **value)
case '\\': case '\\':
/* disallow bare escape */ /* disallow bare escape */
goto error; goto error;
default:
/* allow bare ascii */
if (cur >= 32 && cur <= 126)
continue;
} }
continue; goto error;
case __STRING: case __STRING:
switch (cur) { switch (cur) {
case '\\': case '\\':

14
test/test-spa-json.c
View file

@ -506,6 +506,19 @@ PWTEST(json_parse_fail)
spa_json_init(&it[0], json, strlen(json)); spa_json_init(&it[0], json, strlen(json));
expect_parse_error(&it[0], json, 1, 3); expect_parse_error(&it[0], json, 1, 3);
/* bad bare */
json = "\x01x";
spa_json_init(&it[0], json, strlen(json));
expect_parse_error(&it[0], json, 1, 1);
json = "x\x01";
spa_json_init(&it[0], json, strlen(json));
expect_parse_error(&it[0], json, 1, 2);
json = "\xc3\xa4";
spa_json_init(&it[0], json, strlen(json));
expect_parse_error(&it[0], json, 1, 1);
return PWTEST_PASS; return PWTEST_PASS;
} }
@ -890,6 +903,7 @@ PWTEST(json_data)
"n_structure_null-byte-outside-string.json", "n_structure_null-byte-outside-string.json",
"n_structure_object_with_trailing_garbage.json", "n_structure_object_with_trailing_garbage.json",
"n_structure_trailing_#.json", "n_structure_trailing_#.json",
"n_multidigit_number_then_00.json",
/* SPA JSON accepts more number formats */ /* SPA JSON accepts more number formats */
"n_number_-01.json", "n_number_-01.json",