aeson 2.2.5.0 → 2.2.5.1
raw patch · 4 files changed
+36/−24 lines, 4 filesnew-uploaderPVP ok
version bump matches the API change (PVP)
API changes (from Hackage documentation)
Files
- aeson.cabal +1/−1
- changelog.md +15/−4
- src/Data/Aeson/Types/FromJSON.hs +5/−10
- tests/UnitTests.hs +15/−9
aeson.cabal view
@@ -1,6 +1,6 @@ cabal-version: 2.2 name: aeson-version: 2.2.5.0+version: 2.2.5.1 license: BSD-3-Clause license-file: LICENSE category: Text, Web, JSON
changelog.md view
@@ -1,5 +1,16 @@ For the latest version of this document, please see [https://github.com/haskell/aeson/blob/master/changelog.md](https://github.com/haskell/aeson/blob/master/changelog.md). +### 2.2.5.1 - 2026-08-29++Fix a DoS vulnerability caused by parsing large numbers (advisory [HSEC-2026-0007](https://haskell.github.io/security-advisories/advisory/HSEC-2026-0007.html)). Backported from 2.3.0.0 to ease migration.++* Fix parsing of fractional numbers to reject exponents smaller than -1024.+ This change affects `FromJSON` instances of `Fixed`, `DiffTime`, and `NominalDiffTime`,+ rejecting more inputs. Error messages for `Ratio` and integral types are also slightly different+ due to reusing the same bounding logic.+* In `text-iso8601-0.1.1.2`:+ - Reject years of more than 15 digits.+ ### 2.2.5.0 * Support `semialign-1.4`@@ -34,7 +45,7 @@ One gotcha is that internal `Text` values (in `Key`s or `Value` `String`s) will most likely retain the original input `Text` value (its underlying `Array`). It shouldn't be an issue if the `Value` is then decoded to something else so these- `Text` values disapper, but if not (e.g. `Object` keys survive)+ `Text` values disappear, but if not (e.g. `Object` keys survive) then users might want to use `Data.Text.copy`. ### 2.2.0.0@@ -54,7 +65,7 @@ In addition to `Maybe` (and `Option`) fields the `Data.Monoid.First` and `Data.Monoid.Last` are also omitted, as well as the most newtype wrappers, when their wrap omittable type (e.g. newtypes in `Data.Monoid` and `Data.Semigroup`, `Identity`, `Const`, `Tagged`, `Compose`).- Additionall "boring" types like `()` and `Proxy` are omitted as well.+ Additionally "boring" types like `()` and `Proxy` are omitted as well. As the omitting is now uniform, type arguments are also omitted (also in `Generic1` derived instance). Resolves issues:@@ -72,7 +83,7 @@ * Move `Data.Aeson.Parser` module into separate [`attoparsec-aeson`](https://hackage.haskell.org/package/attoparsec-aeson) package, as these parsers are not used by `aeson` itself anymore. * Use [`text-iso8601`](https://hackage.haskell.org/package/text-iso8601) package for parsing `time` types. These are slightly faster than previously used (copy of) `attoparsec-iso8601`. Formats accepted is slightly changed:- - The space between time and timezone offset (in `UTCTime` and `ZonedTime`) is disallowed. ISO8601 explictly forbidds it.+ - The space between time and timezone offset (in `UTCTime` and `ZonedTime`) is disallowed. ISO8601 explicitly forbids it. - The timezone offsets can be in range -23:59..23:59. This is how Python, joda-time etc seems to do. (Previously the range was -12..+14) * Remove internal `Data.Aeson.Internal` and `Data.Aeson.Internal.Time` modules. Everything from the former is exported elsewhere (`Data.Aeson.Types`), the latter was truly internal.@@ -235,7 +246,7 @@ parseJSON = gParseJSON defaultOptions { rejectUnknownFields = True } ``` -* `FromJSON` instance of `Ratio a` now parses numbers in addtion to+* `FromJSON` instance of `Ratio a` now parses numbers in addition to standard `{numerator=..., denumerator=...}` encoding. Thanks to Aleksey Khudyakov.
src/Data/Aeson/Types/FromJSON.hs view
@@ -796,11 +796,13 @@ withBoundedScientific_ :: (Parser a -> Parser a) -> (Scientific -> Parser a) -> Value -> Parser a withBoundedScientific_ whenFail f (Number scientific) = if exp10 > 1024- then whenFail (fail msg)+ then whenFail (fail (msg "greater than 1024"))+ else if exp10 < -1024+ then whenFail (fail (msg "less than -1024")) else f scientific where exp10 = base10Exponent scientific- msg = "found a number with exponent " ++ show exp10 ++ ", but it must not be greater than 1024"+ msg req = "found a number with exponent " ++ show exp10 ++ ", but it must not be " ++ req withBoundedScientific_ whenFail _ v = whenFail (typeMismatch "Number" v) @@ -1706,14 +1708,7 @@ _ -> Scientific.toRealFloat <$> parseScientificText t instance (FromJSON a, Integral a) => FromJSON (Ratio a) where- parseJSON (Number x)- | exp10 <= 1024- , exp10 >= -1024 = return $! realToFrac x- | otherwise = prependContext "Ratio" $ fail msg- where- exp10 = base10Exponent x- msg = "found a number with exponent " ++ show exp10- ++ ", but it must not be greater than 1024 or less than -1024"+ parseJSON n@(Number _) = withBoundedScientific "Ratio" (($!) pure . realToFrac) n parseJSON o = objParser o where objParser = withObject "Rational" $ \obj -> do
tests/UnitTests.hs view
@@ -38,6 +38,7 @@ , Value(..), camelTo, camelTo2 , defaultOptions, formatPath, formatRelativePath, omitNothingFields, parse) import Data.Char (toUpper, GeneralCategory(Control,Surrogate), generalCategory)+import Data.Fixed (Nano) import Data.HashMap.Strict (HashMap) import Data.Kind (Type) import Data.List (isSuffixOf)@@ -458,17 +459,22 @@ (eitherDecode "1.37" :: Either String Rational) bigRationalDecoding :: Assertion-bigRationalDecoding =- assertEqual "Decoding an Integer with a large exponent should fail"- (Left "Error in $: parsing Ratio failed, found a number with exponent 2000, but it must not be greater than 1024 or less than -1024")+bigRationalDecoding = do+ assertEqual "Decoding a Rational with a large exponent should fail"+ (Left "Error in $: parsing Ratio failed, found a number with exponent 2000, but it must not be greater than 1024") ((eitherDecode :: L.ByteString -> Either String Rational) "1e2000")--smallRationalDecoding :: Assertion-smallRationalDecoding =- assertEqual "Decoding an Integer with a large exponent should fail"- (Left "Error in $: parsing Ratio failed, found a number with exponent -2000, but it must not be greater than 1024 or less than -1024")+ assertEqual "Decoding a Rational with a small exponent should fail"+ (Left "Error in $: parsing Ratio failed, found a number with exponent -2000, but it must not be less than -1024") ((eitherDecode :: L.ByteString -> Either String Rational) "1e-2000") +bigFixedDecoding :: Assertion+bigFixedDecoding = do+ assertEqual "Decoding a Fixed with a large exponent should fail"+ (Left "Error in $: parsing Fixed failed, found a number with exponent 9999, but it must not be greater than 1024")+ ((eitherDecode :: L.ByteString -> Either String Nano) "1e9999")+ assertEqual "Decoding a Fixed with a small exponent should fail"+ (Left "Error in $: parsing Fixed failed, found a number with exponent -9999, but it must not be less than -1024")+ ((eitherDecode :: L.ByteString -> Either String Nano) "1e-9999") bigScientificExponent :: Assertion bigScientificExponent =@@ -555,7 +561,7 @@ , testCase "Ratio with denominator 0" ratioDenominator0 , testCase "Rational parses number" rationalNumber , testCase "Big rational" bigRationalDecoding- , testCase "Small rational" smallRationalDecoding+ , testCase "Big fixed" bigFixedDecoding , testCase "Big scientific exponent" bigScientificExponent , testCase "Big integer decoding" bigIntegerDecoding , testCase "Big natural decoding" bigNaturalDecoding