github-wownero/wownero
1
0
Fork 0
mirror of https://github.com/wownero/wownero.git synced 2026-10-17 15:41:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

epee: prevent JSON parser log injection

Browse Source
This commit is contained in:
selsta
2026-08-19 22:27:22 +02:00
parent d85cfa04d8
commit 7a3bd6c68d
3 changed files with 12 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
contrib/epee/include/net/http_server_handlers_map2.h
+1 -1
View File
@@ -72,7 +72,7 @@
bool parse_res = epee::serialization::load_t_from_json(static_cast<command_type::request&>(req), query_info.m_body); \
if (!parse_res) \
{ \
MERROR("Failed to parse json: \r\n" << query_info.m_body); \
MERROR("Failed to parse JSON request"); \
response_info.m_response_code = 400; \
response_info.m_response_comment = "Bad request"; \
return true; \
contrib/epee/include/storages/portable_storage_from_json.h
+3 -3
View File
@@ -43,7 +43,7 @@ namespace epee
{
namespace json
{
#define CHECK_ISSPACE() if(!epee::misc_utils::parse::isspace(*it)){ ASSERT_MES_AND_THROW("Wrong JSON character at: " << std::string(it, buf_end));}
#define CHECK_ISSPACE() if(!epee::misc_utils::parse::isspace(*it)){ ASSERT_MES_AND_THROW("Unexpected character in JSON data");}
/*inline void parse_error()
{
@@ -168,7 +168,7 @@ namespace epee
{
//sub section here
typename t_storage::hsection new_sec = stg.open_section(name, current_section, true);
CHECK_AND_ASSERT_THROW_MES(new_sec, "Failed to insert new section in json: " << std::string(it, buf_end));
CHECK_AND_ASSERT_THROW_MES(new_sec, "Failed to insert new section in JSON data");
run_handler(new_sec, it, buf_end, stg, recursion + 1);
state = match_state_wonder_after_value;
}else if(*it == '[')
@@ -403,7 +403,7 @@ namespace epee
}
catch(const std::exception& ex)
{
MERROR("Failed to parse json, what: " << ex.what());
MERROR("Failed to parse json, what: " << misc_utils::parse::transform_to_escape_sequence(ex.what()));
return false;
}
catch(...)
contrib/epee/src/parserse_base_utils.cpp
+8 -9
View File
@@ -176,8 +176,7 @@ namespace misc_utils
}
break;
default:
val.push_back(*it);
LOG_PRINT_L0("Unknown escape sequence :\"\\" << *it << "\"");
ASSERT_MES_AND_THROW("Invalid escape sequence in JSON string");
}
escape_mode = false;
}else if(*it == '"')
@@ -187,13 +186,13 @@ namespace misc_utils
}else if(*it == '\\')
{
escape_mode = true;
}
}
else
{
val.push_back(*it);
}
}
ASSERT_MES_AND_THROW("Failed to match string in json entry: " << std::string(star_end_string, buf_end));
ASSERT_MES_AND_THROW("Unterminated JSON string");
}
void match_number2(std::string::const_iterator& star_end_string, std::string::const_iterator buf_end, boost::string_ref& val, bool& is_float_val, bool& is_signed_val)
{
@@ -226,10 +225,10 @@ namespace misc_utils
return;
}
else
ASSERT_MES_AND_THROW("wrong number in json entry: " << std::string(star_end_string, buf_end));
ASSERT_MES_AND_THROW("Invalid number in JSON entry");
}
}
ASSERT_MES_AND_THROW("wrong number in json entry: " << std::string(star_end_string, buf_end));
ASSERT_MES_AND_THROW("Invalid number in JSON entry");
}
void match_word2(std::string::const_iterator& star_end_string, std::string::const_iterator buf_end, boost::string_ref& val)
{
@@ -244,11 +243,11 @@ namespace misc_utils
{
star_end_string = --it;
return;
}else
ASSERT_MES_AND_THROW("failed to match word number in json entry: " << std::string(star_end_string, buf_end));
}else
ASSERT_MES_AND_THROW("Invalid word in JSON entry");
}
}
ASSERT_MES_AND_THROW("failed to match word number in json entry: " << std::string(star_end_string, buf_end));
ASSERT_MES_AND_THROW("Invalid word in JSON entry");
}
}
}