Skip to content

Commit 7304d1e

Browse files
UrielChUrielCh
authored
Merge pull request #72 from dpeger/fixes/v2.3/parse-numberformatexception
[#60][#62] Unchecked Exception in Parser
2 parents 33c3322 + d08ad4f commit 7304d1e

File tree

8 files changed

+188
-135
lines changed

8 files changed

+188
-135
lines changed

‎README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@
66

77
# Changelog
88

9+
### *V 2.3.1*
10+
* Fixes [issue #60](https://github.com/netplex/json-smart-v2/issues/60) (CVE-2021-27568)
11+
912
### *V 2.3*
1013
* Patch 37 [issue 37](http://code.google.com/p/json-smart/issues/detail?id=37)
1114
* explicite support of char 127 [issue 18](http://code.google.com/p/json-smart/issues/detail?id=18)

‎accessors-smart/pom.xml‎

Lines changed: 16 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,22 @@
33
<modelVersion>4.0.0</modelVersion>
44
<groupId>net.minidev</groupId>
55
<artifactId>accessors-smart</artifactId>
6-
<version>1.2-SNAPSHOT</version>
6+
<version>2.3.1</version>
77
<name>ASM based accessors helper used by json-smart</name>
88
<description>Java reflect give poor performance on getter setter an constructor calls, accessors-smart use ASM to speed up those calls.
99
</description>
1010
<packaging>bundle</packaging>
11-
<url>http://www.minidev.net/</url>
11+
<url>https://urielch.github.io/</url>
1212
<organization>
1313
<name>Chemouni Uriel</name>
14-
<url>http://www.minidev.net/</url>
14+
<url>https://urielch.github.io/</url>
1515
</organization>
1616
<developers>
1717
<developer>
1818
<id>uriel</id>
1919
<name>Uriel Chemouni</name>
2020
<email>[email protected]</email>
21-
<timezone>GMT-7</timezone>
21+
<timezone>GMT+3</timezone>
2222
<roles>
2323
</roles>
2424
</developer>
@@ -33,8 +33,8 @@
3333
</licenses>
3434
<properties>
3535
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
36-
<maven.compiler.source>1.5</maven.compiler.source>
37-
<maven.compiler.target>1.5</maven.compiler.target>
36+
<maven.compiler.source>1.8</maven.compiler.source>
37+
<maven.compiler.target>1.8</maven.compiler.target>
3838
</properties>
3939
<dependencies>
4040
<dependency>
@@ -51,7 +51,7 @@
5151
</dependencies>
5252

5353
<!-- updated on 29/10/2015 -->
54-
<!--
54+
<!--
5555
<reporting>
5656
<plugins>
5757
<plugin>
@@ -92,7 +92,11 @@
9292
</property>
9393
</activation>
9494
<properties>
95-
<gpg.keyname>8E322ED0</gpg.keyname>
95+
<!-- My old Is back -->
96+
<!-- <gpg.keyname>2C8DF6EC</gpg.keyname> -->
97+
<!-- 2021 rsa4096 key-->
98+
<gpg.keyname>53BE126D</gpg.keyname>
99+
<!-- <gpg.keyname>8E322ED0</gpg.keyname> -->
96100
<!-- <gpg.keyname>Uriel Chemouni (dev) <[email protected]></gpg.keyname> -->
97101
<!-- GPG Key ID to use for signing -->
98102
</properties>
@@ -196,8 +200,8 @@
196200
<version>3.3</version>
197201
<configuration>
198202
<encoding>UTF-8</encoding>
199-
<source>1.6</source>
200-
<target>1.6</target>
203+
<source>${maven.compiler.source}</source>
204+
<target>${maven.compiler.target}</target>
201205
<excludes>
202206
<exclude>**/.svn/*</exclude>
203207
<exclude>**/.svn</exclude>
@@ -229,7 +233,7 @@
229233
<!-- updated on 29/07/2015 -->
230234
<groupId>org.apache.maven.plugins</groupId>
231235
<artifactId>maven-javadoc-plugin</artifactId>
232-
<version>2.10.3</version>
236+
<version>2.10.4</version>
233237
<!-- ONLY NEEDED With jdk 1.7+ -->
234238
<configuration>
235239
<failOnError>false</failOnError>
@@ -247,7 +251,7 @@
247251
<plugin>
248252
<groupId>org.apache.felix</groupId>
249253
<artifactId>maven-bundle-plugin</artifactId>
250-
<version>3.3.0</version> <!-- 3.0.0 need java 7+ -->
254+
<version>3.5.1</version> <!-- 3.0.0 need java 7+ -->
251255
<extensions>true</extensions>
252256
<configuration>
253257
<instructions>

‎json-smart-action/pom.xml‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,26 +3,26 @@
33
<parent>
44
<groupId>net.minidev</groupId>
55
<artifactId>minidev-parent</artifactId>
6-
<version>2.3-SNAPSHOT</version>
6+
<version>2.3.1</version>
77
</parent>
88
<modelVersion>4.0.0</modelVersion>
99
<artifactId>json-smart-action</artifactId>
10-
<name>JSON Small and Fast Parser</name>
10+
<name>JSON-smart-action Small and Fast Parser</name>
1111
<description>
1212
JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but uses conventions that are familiar to programmers of the C-family of languages, including C, C++, C#, Java, JavaScript, Perl, Python, and many others. These properties make JSON an ideal data-interchange language.
1313
</description>
1414
<packaging>bundle</packaging>
15-
<url>http://www.minidev.net/</url>
15+
<url>https://urielch.github.io/</url>
1616
<organization>
1717
<name>Chemouni Uriel</name>
18-
<url>http://www.minidev.net/</url>
18+
<url>https://urielch.github.io/</url>
1919
</organization>
2020
<developers>
2121
<developer>
2222
<id>uriel</id>
2323
<name>Uriel Chemouni</name>
2424
<email>[email protected]</email>
25-
<timezone>GMT-7</timezone>
25+
<timezone>GMT+3</timezone>
2626
<roles>
2727
</roles>
2828
</developer>
@@ -43,8 +43,8 @@
4343
</licenses>
4444
<properties>
4545
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
46-
<maven.compiler.source>1.5</maven.compiler.source>
47-
<maven.compiler.target>1.5</maven.compiler.target>
46+
<maven.compiler.source>1.8</maven.compiler.source>
47+
<maven.compiler.target>1.8</maven.compiler.target>
4848
</properties>
4949
<dependencies>
5050
<dependency>
@@ -85,7 +85,9 @@
8585
</activation>
8686
<properties>
8787
<!-- My old Is back -->
88-
<gpg.keyname>2C8DF6EC</gpg.keyname>
88+
<!-- <gpg.keyname>2C8DF6EC</gpg.keyname> -->
89+
<!-- 2021 rsa4096 key-->
90+
<gpg.keyname>53BE126D</gpg.keyname>
8991
<!-- <gpg.keyname>8E322ED0</gpg.keyname> -->
9092
<!-- <gpg.keyname>Uriel Chemouni (dev) <[email protected]></gpg.keyname> -->
9193
<!-- GPG Key ID to use for signing -->
@@ -190,8 +192,8 @@
190192
<version>3.3</version>
191193
<configuration>
192194
<encoding>UTF-8</encoding>
193-
<source>1.6</source>
194-
<target>1.6</target>
195+
<source>${maven.compiler.source}</source>
196+
<target>${maven.compiler.target}</target>
195197
<excludes>
196198
<exclude>**/.svn/*</exclude>
197199
<exclude>**/.svn</exclude>
@@ -223,7 +225,7 @@
223225
<!-- updated on 29/07/2015 -->
224226
<groupId>org.apache.maven.plugins</groupId>
225227
<artifactId>maven-javadoc-plugin</artifactId>
226-
<version>2.10.3</version>
228+
<version>2.10.4</version>
227229
<!-- ONLY NEEDED With jdk 1.7+ -->
228230
<configuration>
229231
<failOnError>false</failOnError>
@@ -241,7 +243,7 @@
241243
<plugin>
242244
<groupId>org.apache.felix</groupId>
243245
<artifactId>maven-bundle-plugin</artifactId>
244-
<version>3.0.0</version>
246+
<version>3.5.1</version>
245247
<extensions>true</extensions>
246248
<configuration>
247249
<instructions>

‎json-smart/pom.xml‎

Lines changed: 27 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<parent>
44
<groupId>net.minidev</groupId>
55
<artifactId>minidev-parent</artifactId>
6-
<version>2.3-SNAPSHOT</version>
6+
<version>2.3.1</version>
77
</parent>
88
<!-- this POM is released under an Apache 2.0 license -->
99
<modelVersion>4.0.0</modelVersion>
@@ -13,17 +13,17 @@
1313
JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but uses conventions that are familiar to programmers of the C-family of languages, including C, C++, C#, Java, JavaScript, Perl, Python, and many others. These properties make JSON an ideal data-interchange language.
1414
</description>
1515
<packaging>bundle</packaging>
16-
<url>http://www.minidev.net/</url>
16+
<url>https://urielch.github.io/</url>
1717
<organization>
1818
<name>Chemouni Uriel</name>
19-
<url>http://www.minidev.net/</url>
19+
<url>https://urielch.github.io/</url>
2020
</organization>
2121
<developers>
2222
<developer>
2323
<id>uriel</id>
2424
<name>Uriel Chemouni</name>
2525
<email>[email protected]</email>
26-
<timezone>GMT-7</timezone>
26+
<timezone>GMT+3</timezone>
2727
<roles>
2828
</roles>
2929
</developer>
@@ -44,8 +44,8 @@
4444
</licenses>
4545
<properties>
4646
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
47-
<maven.compiler.source>1.5</maven.compiler.source>
48-
<maven.compiler.target>1.5</maven.compiler.target>
47+
<maven.compiler.source>1.8</maven.compiler.source>
48+
<maven.compiler.target>1.8</maven.compiler.target>
4949
</properties>
5050
<dependencies>
5151
<dependency>
@@ -56,7 +56,7 @@
5656
<dependency>
5757
<groupId>net.minidev</groupId>
5858
<artifactId>accessors-smart</artifactId>
59-
<version>1.2-SNAPSHOT</version>
59+
<version>2.3.1</version>
6060
</dependency>
6161
</dependencies>
6262
<scm>
@@ -87,7 +87,9 @@
8787
</activation>
8888
<properties>
8989
<!-- My old Is back -->
90-
<gpg.keyname>2C8DF6EC</gpg.keyname>
90+
<!-- <gpg.keyname>2C8DF6EC</gpg.keyname> -->
91+
<!-- 2021 rsa4096 key-->
92+
<gpg.keyname>53BE126D</gpg.keyname>
9193
<!-- <gpg.keyname>8E322ED0</gpg.keyname> -->
9294
<!-- <gpg.keyname>Uriel Chemouni (dev) <[email protected]></gpg.keyname> -->
9395
<!-- GPG Key ID to use for signing -->
@@ -122,8 +124,10 @@
122124
</plugin>
123125
<!-- Publish also javadocs when releasing - required by Sonatype -->
124126
<plugin>
127+
<!-- updated on 17/04/2021 -->
125128
<groupId>org.apache.maven.plugins</groupId>
126129
<artifactId>maven-javadoc-plugin</artifactId>
130+
<version>3.2.0</version>
127131
<executions>
128132
<execution>
129133
<id>attach-javadocs</id>
@@ -140,7 +144,7 @@
140144
<plugin>
141145
<groupId>org.apache.maven.plugins</groupId>
142146
<artifactId>maven-release-plugin</artifactId>
143-
<version>2.5.2</version>
147+
<version>2.5.3</version>
144148
<configuration>
145149
<mavenExecutorId>forked-path</mavenExecutorId>
146150
<arguments>-Psonatype-oss-release</arguments>
@@ -172,10 +176,10 @@
172176
<build>
173177
<plugins>
174178
<plugin>
175-
<!-- updated on 29/07/2015 -->
179+
<!-- updated on 17/04/2021 -->
176180
<groupId>org.apache.maven.plugins</groupId>
177181
<artifactId>maven-source-plugin</artifactId>
178-
<version>2.4</version>
182+
<version>3.2.1</version>
179183
<executions>
180184
<execution>
181185
<id>bind-sources</id>
@@ -186,34 +190,34 @@
186190
</executions>
187191
</plugin>
188192
<plugin>
189-
<!-- updated on 29/10/2015 -->
193+
<!-- updated on 17/04/2021 -->
190194
<groupId>org.apache.maven.plugins</groupId>
191195
<artifactId>maven-compiler-plugin</artifactId>
192-
<version>3.3</version>
196+
<version>3.8.1</version>
193197
<configuration>
194198
<encoding>UTF-8</encoding>
195-
<source>1.6</source>
196-
<target>1.6</target>
199+
<source>${maven.compiler.source}</source>
200+
<target>${maven.compiler.target}</target>
197201
<excludes>
198202
<exclude>**/.svn/*</exclude>
199203
<exclude>**/.svn</exclude>
200204
</excludes>
201205
</configuration>
202206
</plugin>
203207
<plugin>
204-
<!-- updated on 29/10/2015 -->
208+
<!-- updated on 17/04/2021 -->
205209
<groupId>org.apache.maven.plugins</groupId>
206210
<artifactId>maven-resources-plugin</artifactId>
207-
<version>2.7</version>
211+
<version>3.2.0</version>
208212
<configuration>
209213
<encoding>UTF-8</encoding>
210214
</configuration>
211215
</plugin>
212216
<plugin>
213-
<!-- updated on 29/10/2015 -->
217+
<!-- updated on 17/04/2021 -->
214218
<groupId>org.apache.maven.plugins</groupId>
215219
<artifactId>maven-jar-plugin</artifactId>
216-
<version>2.6</version>
220+
<version>3.2.0</version>
217221
<configuration>
218222
<excludes>
219223
<exclude>**/.svn/*</exclude>
@@ -222,10 +226,10 @@
222226
</configuration>
223227
</plugin>
224228
<plugin>
225-
<!-- updated on 29/07/2015 -->
229+
<!-- updated on 17/04/2021 -->
226230
<groupId>org.apache.maven.plugins</groupId>
227231
<artifactId>maven-javadoc-plugin</artifactId>
228-
<version>2.10.3</version>
232+
<version>3.2.0</version>
229233
<!-- ONLY NEEDED With jdk 1.7+ -->
230234
<configuration>
231235
<failOnError>false</failOnError>
@@ -241,9 +245,10 @@
241245
</executions>
242246
</plugin>
243247
<plugin>
248+
<!-- updated on 17/04/2021 -->
244249
<groupId>org.apache.felix</groupId>
245250
<artifactId>maven-bundle-plugin</artifactId>
246-
<version>3.3.0</version> <!-- 3.0.0 need java 7+ -->
251+
<version>5.1.2</version> <!-- 3.0.0 need java 7+ -->
247252
<extensions>true</extensions>
248253
<configuration>
249254
<instructions>

‎json-smart/src/main/java/net/minidev/json/parser/JSONParserBase.java‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -139,11 +139,15 @@ public void checkLeadinZero() throws ParseException {
139139
protected Number extractFloat() throws ParseException {
140140
if (!acceptLeadinZero)
141141
checkLeadinZero();
142-
if (!useHiPrecisionFloat)
143-
return Float.parseFloat(xs);
144-
if (xs.length() > 18) // follow JSonIJ parsing method
145-
return new BigDecimal(xs);
146-
return Double.parseDouble(xs);
142+
try {
143+
if (!useHiPrecisionFloat)
144+
return Float.parseFloat(xs);
145+
if (xs.length() > 18) // follow JSonIJ parsing method
146+
return new BigDecimal(xs);
147+
return Double.parseDouble(xs);
148+
} catch (NumberFormatException e) {
149+
throw new ParseException(pos, ERROR_UNEXPECTED_TOKEN, xs);
150+
}
147151
}
148152

149153
/**

0 commit comments

Comments
 (0)