|
| 1 | +package com.fasterxml.jackson.dataformat.smile.constraints; |
| 2 | + |
| 3 | +import java.io.ByteArrayInputStream; |
| 4 | +import java.io.ByteArrayOutputStream; |
| 5 | + |
| 6 | +import com.fasterxml.jackson.core.JsonGenerator; |
| 7 | +import com.fasterxml.jackson.core.JsonParser; |
| 8 | +import com.fasterxml.jackson.core.JsonToken; |
| 9 | +import com.fasterxml.jackson.core.StreamReadConstraints; |
| 10 | +import com.fasterxml.jackson.core.exc.StreamConstraintsException; |
| 11 | + |
| 12 | +import org.junit.jupiter.api.Test; |
| 13 | + |
| 14 | +import com.fasterxml.jackson.dataformat.smile.SmileFactory; |
| 15 | +import com.fasterxml.jackson.dataformat.smile.async.AsyncReaderWrapper; |
| 16 | +import com.fasterxml.jackson.dataformat.smile.async.AsyncTestBase; |
| 17 | + |
| 18 | +import static org.junit.jupiter.api.Assertions.*; |
| 19 | + |
| 20 | +// [dataformats-binary#726]: `maxNameLength` was not enforced by Smile parsers |
| 21 | +public class LongNameSmileReadTest extends AsyncTestBase |
| 22 | +{ |
| 23 | + private final static int MAX_NAME_LEN = 1000; |
| 24 | + |
| 25 | + private final SmileFactory F_VANILLA = new SmileFactory(); |
| 26 | + |
| 27 | + private final SmileFactory F_CONSTRAINED = SmileFactory.builder() |
| 28 | + .streamReadConstraints(StreamReadConstraints.builder() |
| 29 | + .maxNameLength(MAX_NAME_LEN) |
| 30 | + .build()) |
| 31 | + .build(); |
| 32 | + |
| 33 | + // Names of 64 bytes or less use the "short name" encodings, which are |
| 34 | + // length-bounded by the format itself; anything longer uses the "long |
| 35 | + // name" encoding, which was unbounded before the fix. |
| 36 | + |
| 37 | + // Two separate checks guard the long-name path, and the sizes below are |
| 38 | + // chosen to exercise both: |
| 39 | + // |
| 40 | + // * "just over" fits within the already-allocated decode buffer, so it is |
| 41 | + // only caught by the exact check made once the whole name is known; |
| 42 | + // * the larger ones fill the buffer and are caught incrementally, while |
| 43 | + // it is being grown, before the whole name has been buffered. |
| 44 | + private final static int LEN_JUST_OVER = MAX_NAME_LEN + 20; |
| 45 | + private final static int LEN_OVER = MAX_NAME_LEN + 100; |
| 46 | + private final static int LEN_WAY_OVER = 400_000; |
| 47 | + |
| 48 | + @Test |
| 49 | + public void testLongNameBlocking() throws Exception |
| 50 | + { |
| 51 | + for (boolean stream : new boolean[] { true, false }) { |
| 52 | + for (int len : new int[] { LEN_JUST_OVER, LEN_OVER, LEN_WAY_OVER }) { |
| 53 | + _verifyFails(_nameDoc(len), stream); |
| 54 | + } |
| 55 | + } |
| 56 | + } |
| 57 | + |
| 58 | + @Test |
| 59 | + public void testLongNameAsync() throws Exception |
| 60 | + { |
| 61 | + // vary feed sizes to exercise both the single-chunk and the |
| 62 | + // split-across-feeds paths |
| 63 | + for (int bytesPerFeed : new int[] { 1, 7, 1000, 100_000 }) { |
| 64 | + for (int len : new int[] { LEN_JUST_OVER, LEN_OVER, LEN_WAY_OVER }) { |
| 65 | + _verifyFailsAsync(_nameDoc(len), bytesPerFeed); |
| 66 | + } |
| 67 | + } |
| 68 | + } |
| 69 | + |
| 70 | + // Names at or below the limit must still be accepted |
| 71 | + @Test |
| 72 | + public void testNameWithinLimitBlocking() throws Exception |
| 73 | + { |
| 74 | + for (boolean stream : new boolean[] { true, false }) { |
| 75 | + for (int len : new int[] { 100, MAX_NAME_LEN }) { |
| 76 | + _verifyPasses(_nameDoc(len), _name(len), stream); |
| 77 | + } |
| 78 | + } |
| 79 | + } |
| 80 | + |
| 81 | + @Test |
| 82 | + public void testNameWithinLimitAsync() throws Exception |
| 83 | + { |
| 84 | + for (int bytesPerFeed : new int[] { 1, 7, 1000, 100_000 }) { |
| 85 | + for (int len : new int[] { 100, MAX_NAME_LEN }) { |
| 86 | + _verifyPassesAsync(_nameDoc(len), _name(len), bytesPerFeed); |
| 87 | + } |
| 88 | + } |
| 89 | + } |
| 90 | + |
| 91 | + // The checks made while the decode buffer is grown are what keep an |
| 92 | + // over-long name from being buffered -- and decoded -- in full before it |
| 93 | + // gets rejected. Whether parsing fails does not show this, since the final |
| 94 | + // check would catch the name either way; what shows it is the length the |
| 95 | + // failure reports, which is how much had been read when it gave up. For a |
| 96 | + // name this far over the limit that has to be a small fraction of the whole. |
| 97 | + @Test |
| 98 | + public void testLongNameRejectedBeforeBufferedInFull() throws Exception |
| 99 | + { |
| 100 | + final byte[] doc = _nameDoc(LEN_WAY_OVER); |
| 101 | + |
| 102 | + for (boolean stream : new boolean[] { true, false }) { |
| 103 | + int reported = _verifyFails(doc, stream); |
| 104 | + assertTrue(reported < (LEN_WAY_OVER / 4), |
| 105 | + "Should have given up well before reading all "+LEN_WAY_OVER |
| 106 | + +" bytes of name, but reported length was "+reported); |
| 107 | + } |
| 108 | + for (int bytesPerFeed : new int[] { 1, 100_000 }) { |
| 109 | + int reported = _verifyFailsAsync(doc, bytesPerFeed); |
| 110 | + assertTrue(reported < (LEN_WAY_OVER / 4), |
| 111 | + "Should have given up well before reading all "+LEN_WAY_OVER |
| 112 | + +" bytes of name, but reported length was "+reported); |
| 113 | + } |
| 114 | + } |
| 115 | + |
| 116 | + // The symbol table is per-factory and shared by all parsers it creates, so |
| 117 | + // a name decoded by one parser can be served to the next straight from the |
| 118 | + // table, without being decoded again. The length check therefore has to |
| 119 | + // happen before the lookup rather than during decoding -- otherwise only |
| 120 | + // the very first occurrence of a name would ever be checked. |
| 121 | + // Both directions matter: repeated legal names must keep working, and |
| 122 | + // repeated over-long ones must be rejected every time. |
| 123 | + @Test |
| 124 | + public void testRepeatedNamesViaSymbolTable() throws Exception |
| 125 | + { |
| 126 | + // both sizes fit the already-allocated buffer, so the lookup, and not |
| 127 | + // the incremental check, is what these have to get past |
| 128 | + final byte[] okDoc = _nameDoc(MAX_NAME_LEN); |
| 129 | + final byte[] badDoc = _nameDoc(LEN_JUST_OVER); |
| 130 | + |
| 131 | + // repeated across parsers of the same factory: 2nd one is a cache hit |
| 132 | + for (int i = 0; i < 2; ++i) { |
| 133 | + _verifyPasses(okDoc, _name(MAX_NAME_LEN), true); |
| 134 | + _verifyFails(badDoc, true); |
| 135 | + } |
| 136 | + } |
| 137 | + |
| 138 | + // @return Name length the failure reported |
| 139 | + private int _verifyFails(byte[] doc, boolean stream) throws Exception |
| 140 | + { |
| 141 | + try (JsonParser p = stream |
| 142 | + ? F_CONSTRAINED.createParser(new ByteArrayInputStream(doc)) |
| 143 | + : F_CONSTRAINED.createParser(doc, 0, doc.length)) { |
| 144 | + while (p.nextToken() != null) { } |
| 145 | + fail("expected StreamConstraintsException"); |
| 146 | + return -1; |
| 147 | + } catch (StreamConstraintsException e) { |
| 148 | + return _verifyNameLengthException(e); |
| 149 | + } |
| 150 | + } |
| 151 | + |
| 152 | + // @return Name length the failure reported |
| 153 | + private int _verifyFailsAsync(byte[] doc, int bytesPerFeed) throws Exception |
| 154 | + { |
| 155 | + AsyncReaderWrapper p = asyncForBytes(F_CONSTRAINED, bytesPerFeed, doc, 0); |
| 156 | + try { |
| 157 | + while (p.nextToken() != null) { } |
| 158 | + fail("expected StreamConstraintsException (bytesPerFeed: "+bytesPerFeed+")"); |
| 159 | + return -1; |
| 160 | + } catch (StreamConstraintsException e) { |
| 161 | + return _verifyNameLengthException(e); |
| 162 | + } |
| 163 | + } |
| 164 | + |
| 165 | + private int _verifyNameLengthException(StreamConstraintsException e) |
| 166 | + { |
| 167 | + final String msg = e.getMessage(); |
| 168 | + assertTrue(msg.contains("Name length ("), "Unexpected message: "+msg); |
| 169 | + assertTrue(msg.contains("exceeds the maximum allowed ("+MAX_NAME_LEN), |
| 170 | + "Unexpected message: "+msg); |
| 171 | + int start = msg.indexOf('(') + 1; |
| 172 | + return Integer.parseInt(msg.substring(start, msg.indexOf(')', start))); |
| 173 | + } |
| 174 | + |
| 175 | + private void _verifyPasses(byte[] doc, String expName, boolean stream) throws Exception |
| 176 | + { |
| 177 | + try (JsonParser p = stream |
| 178 | + ? F_CONSTRAINED.createParser(new ByteArrayInputStream(doc)) |
| 179 | + : F_CONSTRAINED.createParser(doc, 0, doc.length)) { |
| 180 | + assertToken(JsonToken.START_OBJECT, p.nextToken()); |
| 181 | + assertToken(JsonToken.FIELD_NAME, p.nextToken()); |
| 182 | + assertEquals(expName, p.currentName()); |
| 183 | + assertToken(JsonToken.VALUE_STRING, p.nextToken()); |
| 184 | + assertToken(JsonToken.END_OBJECT, p.nextToken()); |
| 185 | + assertNull(p.nextToken()); |
| 186 | + } |
| 187 | + } |
| 188 | + |
| 189 | + private void _verifyPassesAsync(byte[] doc, String expName, int bytesPerFeed) throws Exception |
| 190 | + { |
| 191 | + AsyncReaderWrapper p = asyncForBytes(F_CONSTRAINED, bytesPerFeed, doc, 0); |
| 192 | + assertToken(JsonToken.START_OBJECT, p.nextToken()); |
| 193 | + assertToken(JsonToken.FIELD_NAME, p.nextToken()); |
| 194 | + assertEquals(expName, p.currentName()); |
| 195 | + assertToken(JsonToken.VALUE_STRING, p.nextToken()); |
| 196 | + assertToken(JsonToken.END_OBJECT, p.nextToken()); |
| 197 | + assertNull(p.nextToken()); |
| 198 | + } |
| 199 | + |
| 200 | + private byte[] _nameDoc(int nameLen) throws Exception |
| 201 | + { |
| 202 | + ByteArrayOutputStream bytes = new ByteArrayOutputStream(nameLen + 100); |
| 203 | + try (JsonGenerator g = F_VANILLA.createGenerator(bytes)) { |
| 204 | + g.writeStartObject(); |
| 205 | + g.writeFieldName(_name(nameLen)); |
| 206 | + g.writeString("v"); |
| 207 | + g.writeEndObject(); |
| 208 | + } |
| 209 | + return bytes.toByteArray(); |
| 210 | + } |
| 211 | + |
| 212 | + // ASCII name, so byte length == character length |
| 213 | + private String _name(int len) |
| 214 | + { |
| 215 | + StringBuilder sb = new StringBuilder(len); |
| 216 | + for (int i = 0; i < len; ++i) { |
| 217 | + sb.append((char) ('a' + (i % 26))); |
| 218 | + } |
| 219 | + return sb.toString(); |
| 220 | + } |
| 221 | +} |
0 commit comments