3 ms·
if you allow a JSON parser use all of memory to go deep, you know what attackers will do... As other commenters mentioned JSON spec allows setting a limit on th
by msoad 7y ago
if you allow a JSON parser use all of memory to go deep, you know what attackers will do... As other commenters mentioned JSON spec allows setting a limit on the depth.
- zenhack 7y agoIt isn't a matter of memory usage; the memory usage is still linear in the size of the input regardless of the depth. If an attacker can get you to oom by feeding you a deeply nested data structure, they can do the same with a shallow one just as easily: "[0, 0, 0, 0, 0, <...gigabytes of zeros>, 0 0, 0, 0]" So you need to limit the overall input size regardless of whether you already have a depth limit in place.
- lovasoa 7y agoThe memory used by parsers that do not limit the maximum depth is still bounded by the size of the input. An application that does not limit the maximum size of its input in bytes is vulnerable, one that does is not. This is completely independent of the JSON parser.