You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by "RemoLiechti (via GitHub)" <gi...@apache.org> on 2024/03/14 10:04:18 UTC
[PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
RemoLiechti opened a new pull request, #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2
This PR mainly fixes the CVE-2022-47937-json, exploits that ended in out of memory or stackoverflows.
To achieve this, the re-licenced base library JSON-java (now public domain) was used as of version [20240303](https://github.com/stleary/JSON-java/releases/tag/20240303) and adapted to be backwards compatible without breaking changes.
Besides that, some additional maintenance was completed:
- junit tests were migrated to junit5
- parent pom updated to 52 along with all migration steps needed
Good to know:
The library lost the 'tidy' feature, which is no longer present. For backwards compatibility, the related methods (setTidy, is Tidy) were stubbed to avoid compilation errors or the need to recompile all depending projects.
Questions to reviewers:
1. There is a junit test (not committed to the repo) that validates the CVE exploits no longer working. Is there an interest to store that somewhere non public? If so, where and how.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "RemoLiechti (via GitHub)" <gi...@apache.org>.
RemoLiechti commented on PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2#issuecomment-2006204372
> @RemoLiechti - I realised I forgot one of the key points yesterday, sorry. Rather than removing the classes which are new in the latest version of https://github.com/stleary/JSON-java, can you rather make their visibility package-private? This limits the exposure of new code with smaller effort.
done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "RemoLiechti (via GitHub)" <gi...@apache.org>.
RemoLiechti commented on code in PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2#discussion_r1530240433
##########
src/main/java/org/apache/sling/commons/json/io/JSONWriter.java:
##########
@@ -243,134 +208,240 @@ public JSONWriter endObject() throws JSONException {
/**
* Append a key. The key will be associated with the next value. In an
* object, every value must be preceded by a key.
- * @param s A key string.
+ *
+ * @param string A key string.
* @return this
* @throws JSONException If the key is out of place. For example, keys
- * do not belong in arrays or if the key is null.
+ * do not belong in arrays or if the key is null.
*/
- public JSONWriter key(String s) throws JSONException {
- if (s == null) {
+ public JSONWriter key(String string) throws JSONException {
+ if (string == null) {
throw new JSONException("Null key.");
}
if (this.mode == 'k') {
try {
- if (this.comma) {
- this.writer.write(',');
+ JSONObject topObject = this.stack[this.top - 1];
+ // don't use the built in putOnce method to maintain Android support
+ if (topObject.has(string)) {
+ throw new JSONException("Duplicate key \"" + string + "\"");
}
- if (tidy) {
- this.writer.write('\n');
- this.writer.write(INDENTS[top]);
- }
- this.writer.write(JSONObject.quote(s));
- this.writer.write(':');
- if (tidy) {
- this.writer.write(' ');
+ topObject.put(string, true);
+ if (this.comma) {
+ this.writer.append(',');
}
+ this.writer.append(JSONObject.quote(string));
+ this.writer.append(':');
this.comma = false;
this.mode = 'o';
return this;
} catch (IOException e) {
+ // Android as of API 25 does not support this exception constructor
+ // however we won't worry about it. If an exception is happening here
+ // it will just throw a "Method not found" exception instead.
throw new JSONException(e);
}
}
throw new JSONException("Misplaced key.");
}
-
/**
* Begin appending a new object. All keys and values until the balancing
* <code>endObject</code> will be appended to this object. The
* <code>endObject</code> method must be called to mark the object's end.
+ *
* @return this
* @throws JSONException If the nesting is too deep, or if the object is
- * started in the wrong place (for example as a key or after the end of the
- * outermost array or object).
+ * started in the wrong place (for example as a key or
+ * after the end of the
+ * outermost array or object).
*/
public JSONWriter object() throws JSONException {
if (this.mode == 'i') {
this.mode = 'o';
}
if (this.mode == 'o' || this.mode == 'a') {
this.append("{");
- this.push('k');
+ this.push(new JSONObject());
this.comma = false;
return this;
}
throw new JSONException("Misplaced object.");
}
-
/**
* Pop an array or object scope.
+ *
* @param c The scope to close.
* @throws JSONException If nesting is wrong.
*/
private void pop(char c) throws JSONException {
- if (this.top <= 0 || this.stack[this.top - 1] != c) {
+ if (this.top <= 0) {
+ throw new JSONException("Nesting error.");
+ }
+ char m = this.stack[this.top - 1] == null ? 'a' : 'k';
+ if (m != c) {
throw new JSONException("Nesting error.");
}
this.top -= 1;
- this.mode = this.top == 0 ? 'd' : this.stack[this.top - 1];
+ this.mode = this.top == 0
+ ? 'd'
+ : this.stack[this.top - 1] == null
+ ? 'a'
+ : 'k';
}
/**
* Push an array or object scope.
- * @param c The scope to open.
+ *
+ * @param jo The scope to open.
* @throws JSONException If nesting is too deep.
*/
- private void push(char c) throws JSONException {
+ private void push(JSONObject jo) throws JSONException {
if (this.top >= maxdepth) {
- throw new JSONException("Nesting too deep (maximum is " + maxdepth + " levels)");
+ throw new JSONException("Nesting too deep.");
}
- this.stack[this.top] = c;
- this.mode = c;
+ this.stack[this.top] = jo;
+ this.mode = jo == null ? 'a' : 'k';
this.top += 1;
}
+ /**
+ * Make a JSON text of an Object value. If the object has an
+ * value.toJSONString() method, then that method will be used to produce the
+ * JSON text. The method is required to produce a strictly conforming text.
+ * If the object does not contain a toJSONString method (which is the most
+ * common case), then a text will be produced by other means. If the value
+ * is an array or Collection, then a JSONArray will be made from it and its
+ * toJSONString method will be called. If the value is a MAP, then a
+ * JSONObject will be made from it and its toJSONString method will be
+ * called. Otherwise, the value's toString method will be called, and the
+ * result will be quoted.
+ *
+ * <p>
+ * Warning: This method assumes that the data structure is acyclical.
+ *
+ * @param value
+ * The value to be serialized.
+ * @return a printable, displayable, transmittable representation of the
+ * object, beginning with <code>{</code> <small>(left
+ * brace)</small> and ending with <code>}</code> <small>(right
+ * brace)</small>.
+ * @throws JSONException
+ * If the value is or contains an invalid number.
+ */
+ public static String valueToString(Object value) throws JSONException {
+ if (value == null || value.equals(null)) {
+ return "null";
+ }
+ if (value instanceof JSONString) {
+ String object;
+ try {
+ object = ((JSONString) value).toJSONString();
+ } catch (Exception e) {
+ throw new JSONException(e);
+ }
+ if (object != null) {
+ return object;
+ }
+ throw new JSONException("Bad value from toJSONString: " + object);
+ }
+ if (value instanceof Number) {
+ // not all Numbers may match actual JSON Numbers. i.e. Fractions or Complex
+ final String numberAsString = JSONObject.numberToString((Number) value);
+ if (JSONObject.NUMBER_PATTERN.matcher(numberAsString).matches()) {
+ // Close enough to a JSON number that we will return it unquoted
+ return numberAsString;
+ }
+ // The Number value is not a valid JSON number.
+ // Instead we will quote it as a string
+ return JSONObject.quote(numberAsString);
+ }
+ if (value instanceof Boolean || value instanceof JSONObject
+ || value instanceof JSONArray) {
+ return value.toString();
+ }
+ if (value instanceof Map) {
+ Map<?, ?> map = (Map<?, ?>) value;
+ return new JSONObject(map).toString();
+ }
+ if (value instanceof Collection) {
+ Collection<?> coll = (Collection<?>) value;
+ return new JSONArray(coll).toString();
+ }
+ if (value.getClass().isArray()) {
+ return new JSONArray(value).toString();
+ }
+ if (value instanceof Enum<?>) {
+ return JSONObject.quote(((Enum<?>) value).name());
+ }
+ return JSONObject.quote(value.toString());
+ }
/**
* Append either the value <code>true</code> or the value
* <code>false</code>.
+ *
* @param b A boolean.
* @return this
- * @throws JSONException
+ * @throws JSONException if a called function has an error
*/
public JSONWriter value(boolean b) throws JSONException {
return this.append(b ? "true" : "false");
}
/**
* Append a double value.
+ *
* @param d A double.
* @return this
* @throws JSONException If the number is not finite.
*/
public JSONWriter value(double d) throws JSONException {
- return this.value(new Double(d));
+ return this.value(Double.valueOf(d));
}
/**
* Append a long value.
+ *
* @param l A long.
* @return this
- * @throws JSONException
+ * @throws JSONException if a called function has an error
*/
public JSONWriter value(long l) throws JSONException {
return this.append(Long.toString(l));
}
-
/**
* Append an object value.
- * @param o The object to append. It can be null, or a Boolean, Number,
- * String, JSONObject, or JSONArray, or an object with a toJSONString()
- * method.
+ *
+ * @param object The object to append. It can be null, or a Boolean, Number,
+ * String, JSONObject, or JSONArray, or an object that implements
+ * JSONString.
* @return this
* @throws JSONException If the value is out of sequence.
*/
- public JSONWriter value(Object o) throws JSONException {
- return this.append(JSONObject.valueToString(o));
+ public JSONWriter value(Object object) throws JSONException {
+ return this.append(valueToString(object));
+ }
+
+ /**
+ * @deprecated do not use, was removed from library and later stubbed
+ */
+ @Deprecated
+ public void setTidy(boolean tidy) {
+ // stubbed as this was removed from the library but still is referenced from
+ // customer code
+ }
+
+ /**
+ * @deprecated do not use, was removed from library and later stubbed
+ */
+ @Deprecated
+ public boolean isTidy() {
+ // stubbed as this was removed from the library but still is referenced from
+ // customer code
+ return true;
Review Comment:
see further below, done that.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "RemoLiechti (via GitHub)" <gi...@apache.org>.
RemoLiechti commented on code in PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2#discussion_r1530096007
##########
src/main/java/org/apache/sling/commons/json/JSONParserConfiguration.java:
##########
@@ -0,0 +1,29 @@
+package org.apache.sling.commons.json;
+
+import org.apache.sling.commons.json.util.ParserConfiguration;
+
+/**
+ * Configuration object for the JSON parser. The configuration is immutable.
+ */
+@Deprecated
+public class JSONParserConfiguration extends ParserConfiguration {
Review Comment:
done for JSONML, JSONMLParserConfioguration, Property, JSONPointer, JSONPointerException, XMLParserConfiguration, XMLXsiTypeConverter, JSONParserConfiguration and stated in the readme
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "rombert (via GitHub)" <gi...@apache.org>.
rombert commented on PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2#issuecomment-2006751804
@RemoLiechti - any reason to also not make the following classes package-private?
src/main/java/org/apache/sling/commons/json/JSONPropertyIgnore.java
src/main/java/org/apache/sling/commons/json/JSONPropertyName.java
src/main/java/org/apache/sling/commons/json/util/ParserConfiguration.java
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "rombert (via GitHub)" <gi...@apache.org>.
rombert commented on code in PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2#discussion_r1530053255
##########
src/main/java/org/apache/sling/commons/json/io/JSONWriter.java:
##########
@@ -243,134 +208,240 @@ public JSONWriter endObject() throws JSONException {
/**
* Append a key. The key will be associated with the next value. In an
* object, every value must be preceded by a key.
- * @param s A key string.
+ *
+ * @param string A key string.
* @return this
* @throws JSONException If the key is out of place. For example, keys
- * do not belong in arrays or if the key is null.
+ * do not belong in arrays or if the key is null.
*/
- public JSONWriter key(String s) throws JSONException {
- if (s == null) {
+ public JSONWriter key(String string) throws JSONException {
+ if (string == null) {
throw new JSONException("Null key.");
}
if (this.mode == 'k') {
try {
- if (this.comma) {
- this.writer.write(',');
+ JSONObject topObject = this.stack[this.top - 1];
+ // don't use the built in putOnce method to maintain Android support
+ if (topObject.has(string)) {
+ throw new JSONException("Duplicate key \"" + string + "\"");
}
- if (tidy) {
- this.writer.write('\n');
- this.writer.write(INDENTS[top]);
- }
- this.writer.write(JSONObject.quote(s));
- this.writer.write(':');
- if (tidy) {
- this.writer.write(' ');
+ topObject.put(string, true);
+ if (this.comma) {
+ this.writer.append(',');
}
+ this.writer.append(JSONObject.quote(string));
+ this.writer.append(':');
this.comma = false;
this.mode = 'o';
return this;
} catch (IOException e) {
+ // Android as of API 25 does not support this exception constructor
+ // however we won't worry about it. If an exception is happening here
+ // it will just throw a "Method not found" exception instead.
throw new JSONException(e);
}
}
throw new JSONException("Misplaced key.");
}
-
/**
* Begin appending a new object. All keys and values until the balancing
* <code>endObject</code> will be appended to this object. The
* <code>endObject</code> method must be called to mark the object's end.
+ *
* @return this
* @throws JSONException If the nesting is too deep, or if the object is
- * started in the wrong place (for example as a key or after the end of the
- * outermost array or object).
+ * started in the wrong place (for example as a key or
+ * after the end of the
+ * outermost array or object).
*/
public JSONWriter object() throws JSONException {
if (this.mode == 'i') {
this.mode = 'o';
}
if (this.mode == 'o' || this.mode == 'a') {
this.append("{");
- this.push('k');
+ this.push(new JSONObject());
this.comma = false;
return this;
}
throw new JSONException("Misplaced object.");
}
-
/**
* Pop an array or object scope.
+ *
* @param c The scope to close.
* @throws JSONException If nesting is wrong.
*/
private void pop(char c) throws JSONException {
- if (this.top <= 0 || this.stack[this.top - 1] != c) {
+ if (this.top <= 0) {
+ throw new JSONException("Nesting error.");
+ }
+ char m = this.stack[this.top - 1] == null ? 'a' : 'k';
+ if (m != c) {
throw new JSONException("Nesting error.");
}
this.top -= 1;
- this.mode = this.top == 0 ? 'd' : this.stack[this.top - 1];
+ this.mode = this.top == 0
+ ? 'd'
+ : this.stack[this.top - 1] == null
+ ? 'a'
+ : 'k';
}
/**
* Push an array or object scope.
- * @param c The scope to open.
+ *
+ * @param jo The scope to open.
* @throws JSONException If nesting is too deep.
*/
- private void push(char c) throws JSONException {
+ private void push(JSONObject jo) throws JSONException {
if (this.top >= maxdepth) {
- throw new JSONException("Nesting too deep (maximum is " + maxdepth + " levels)");
+ throw new JSONException("Nesting too deep.");
}
- this.stack[this.top] = c;
- this.mode = c;
+ this.stack[this.top] = jo;
+ this.mode = jo == null ? 'a' : 'k';
this.top += 1;
}
+ /**
+ * Make a JSON text of an Object value. If the object has an
+ * value.toJSONString() method, then that method will be used to produce the
+ * JSON text. The method is required to produce a strictly conforming text.
+ * If the object does not contain a toJSONString method (which is the most
+ * common case), then a text will be produced by other means. If the value
+ * is an array or Collection, then a JSONArray will be made from it and its
+ * toJSONString method will be called. If the value is a MAP, then a
+ * JSONObject will be made from it and its toJSONString method will be
+ * called. Otherwise, the value's toString method will be called, and the
+ * result will be quoted.
+ *
+ * <p>
+ * Warning: This method assumes that the data structure is acyclical.
+ *
+ * @param value
+ * The value to be serialized.
+ * @return a printable, displayable, transmittable representation of the
+ * object, beginning with <code>{</code> <small>(left
+ * brace)</small> and ending with <code>}</code> <small>(right
+ * brace)</small>.
+ * @throws JSONException
+ * If the value is or contains an invalid number.
+ */
+ public static String valueToString(Object value) throws JSONException {
+ if (value == null || value.equals(null)) {
+ return "null";
+ }
+ if (value instanceof JSONString) {
+ String object;
+ try {
+ object = ((JSONString) value).toJSONString();
+ } catch (Exception e) {
+ throw new JSONException(e);
+ }
+ if (object != null) {
+ return object;
+ }
+ throw new JSONException("Bad value from toJSONString: " + object);
+ }
+ if (value instanceof Number) {
+ // not all Numbers may match actual JSON Numbers. i.e. Fractions or Complex
+ final String numberAsString = JSONObject.numberToString((Number) value);
+ if (JSONObject.NUMBER_PATTERN.matcher(numberAsString).matches()) {
+ // Close enough to a JSON number that we will return it unquoted
+ return numberAsString;
+ }
+ // The Number value is not a valid JSON number.
+ // Instead we will quote it as a string
+ return JSONObject.quote(numberAsString);
+ }
+ if (value instanceof Boolean || value instanceof JSONObject
+ || value instanceof JSONArray) {
+ return value.toString();
+ }
+ if (value instanceof Map) {
+ Map<?, ?> map = (Map<?, ?>) value;
+ return new JSONObject(map).toString();
+ }
+ if (value instanceof Collection) {
+ Collection<?> coll = (Collection<?>) value;
+ return new JSONArray(coll).toString();
+ }
+ if (value.getClass().isArray()) {
+ return new JSONArray(value).toString();
+ }
+ if (value instanceof Enum<?>) {
+ return JSONObject.quote(((Enum<?>) value).name());
+ }
+ return JSONObject.quote(value.toString());
+ }
/**
* Append either the value <code>true</code> or the value
* <code>false</code>.
+ *
* @param b A boolean.
* @return this
- * @throws JSONException
+ * @throws JSONException if a called function has an error
*/
public JSONWriter value(boolean b) throws JSONException {
return this.append(b ? "true" : "false");
}
/**
* Append a double value.
+ *
* @param d A double.
* @return this
* @throws JSONException If the number is not finite.
*/
public JSONWriter value(double d) throws JSONException {
- return this.value(new Double(d));
+ return this.value(Double.valueOf(d));
}
/**
* Append a long value.
+ *
* @param l A long.
* @return this
- * @throws JSONException
+ * @throws JSONException if a called function has an error
*/
public JSONWriter value(long l) throws JSONException {
return this.append(Long.toString(l));
}
-
/**
* Append an object value.
- * @param o The object to append. It can be null, or a Boolean, Number,
- * String, JSONObject, or JSONArray, or an object with a toJSONString()
- * method.
+ *
+ * @param object The object to append. It can be null, or a Boolean, Number,
+ * String, JSONObject, or JSONArray, or an object that implements
+ * JSONString.
* @return this
* @throws JSONException If the value is out of sequence.
*/
- public JSONWriter value(Object o) throws JSONException {
- return this.append(JSONObject.valueToString(o));
+ public JSONWriter value(Object object) throws JSONException {
+ return this.append(valueToString(object));
+ }
+
+ /**
+ * @deprecated do not use, was removed from library and later stubbed
+ */
+ @Deprecated
+ public void setTidy(boolean tidy) {
+ // stubbed as this was removed from the library but still is referenced from
+ // customer code
+ }
+
+ /**
+ * @deprecated do not use, was removed from library and later stubbed
+ */
+ @Deprecated
+ public boolean isTidy() {
+ // stubbed as this was removed from the library but still is referenced from
+ // customer code
+ return true;
Review Comment:
I am not sure this is a really big concern, but it you want to be sure you could actually keep storing the `tidy` field but ignore it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "RemoLiechti (via GitHub)" <gi...@apache.org>.
RemoLiechti commented on code in PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2#discussion_r1530081352
##########
src/main/java/org/apache/sling/commons/json/io/JSONWriter.java:
##########
@@ -243,134 +213,248 @@ public JSONWriter endObject() throws JSONException {
/**
* Append a key. The key will be associated with the next value. In an
* object, every value must be preceded by a key.
- * @param s A key string.
+ *
+ * @param string A key string.
* @return this
* @throws JSONException If the key is out of place. For example, keys
- * do not belong in arrays or if the key is null.
+ * do not belong in arrays or if the key is null.
*/
- public JSONWriter key(String s) throws JSONException {
- if (s == null) {
+ public JSONWriter key(String string) throws JSONException {
+ if (string == null) {
throw new JSONException("Null key.");
}
if (this.mode == 'k') {
try {
- if (this.comma) {
- this.writer.write(',');
- }
- if (tidy) {
- this.writer.write('\n');
- this.writer.write(INDENTS[top]);
+ JSONObject topObject = this.stack[this.top - 1];
+ // don't use the built in putOnce method to maintain Android support
+ if (topObject.has(string)) {
+ throw new JSONException("Duplicate key \"" + string + "\"");
}
- this.writer.write(JSONObject.quote(s));
- this.writer.write(':');
- if (tidy) {
- this.writer.write(' ');
+ topObject.put(string, true);
+ if (this.comma) {
+ this.writer.append(',');
}
+ this.writer.append(JSONObject.quote(string));
+ this.writer.append(':');
this.comma = false;
this.mode = 'o';
return this;
} catch (IOException e) {
+ // Android as of API 25 does not support this exception constructor
+ // however we won't worry about it. If an exception is happening here
+ // it will just throw a "Method not found" exception instead.
throw new JSONException(e);
}
}
throw new JSONException("Misplaced key.");
}
-
/**
* Begin appending a new object. All keys and values until the balancing
* <code>endObject</code> will be appended to this object. The
* <code>endObject</code> method must be called to mark the object's end.
+ *
* @return this
* @throws JSONException If the nesting is too deep, or if the object is
- * started in the wrong place (for example as a key or after the end of the
- * outermost array or object).
+ * started in the wrong place (for example as a key or
+ * after the end of the
+ * outermost array or object).
*/
public JSONWriter object() throws JSONException {
if (this.mode == 'i') {
this.mode = 'o';
}
if (this.mode == 'o' || this.mode == 'a') {
this.append("{");
- this.push('k');
+ this.push(new JSONObject());
this.comma = false;
return this;
}
throw new JSONException("Misplaced object.");
}
-
/**
* Pop an array or object scope.
+ *
* @param c The scope to close.
* @throws JSONException If nesting is wrong.
*/
private void pop(char c) throws JSONException {
- if (this.top <= 0 || this.stack[this.top - 1] != c) {
+ if (this.top <= 0) {
+ throw new JSONException("Nesting error.");
+ }
+ char m = this.stack[this.top - 1] == null ? 'a' : 'k';
+ if (m != c) {
throw new JSONException("Nesting error.");
}
this.top -= 1;
- this.mode = this.top == 0 ? 'd' : this.stack[this.top - 1];
+ this.mode = this.top == 0
+ ? 'd'
+ : this.stack[this.top - 1] == null
+ ? 'a'
+ : 'k';
}
/**
* Push an array or object scope.
- * @param c The scope to open.
+ *
+ * @param jo The scope to open.
* @throws JSONException If nesting is too deep.
*/
- private void push(char c) throws JSONException {
+ private void push(JSONObject jo) throws JSONException {
if (this.top >= maxdepth) {
- throw new JSONException("Nesting too deep (maximum is " + maxdepth + " levels)");
+ throw new JSONException("Nesting too deep.");
}
- this.stack[this.top] = c;
- this.mode = c;
+ this.stack[this.top] = jo;
+ this.mode = jo == null ? 'a' : 'k';
this.top += 1;
}
+ /**
+ * Make a JSON text of an Object value. If the object has an
+ * value.toJSONString() method, then that method will be used to produce the
+ * JSON text. The method is required to produce a strictly conforming text.
+ * If the object does not contain a toJSONString method (which is the most
+ * common case), then a text will be produced by other means. If the value
+ * is an array or Collection, then a JSONArray will be made from it and its
+ * toJSONString method will be called. If the value is a MAP, then a
+ * JSONObject will be made from it and its toJSONString method will be
+ * called. Otherwise, the value's toString method will be called, and the
+ * result will be quoted.
+ *
+ * <p>
+ * Warning: This method assumes that the data structure is acyclical.
+ *
+ * @param value
+ * The value to be serialized.
+ * @return a printable, displayable, transmittable representation of the
+ * object, beginning with <code>{</code> <small>(left
+ * brace)</small> and ending with <code>}</code> <small>(right
+ * brace)</small>.
+ * @throws JSONException
+ * If the value is or contains an invalid number.
+ */
+ public static String valueToString(Object value) throws JSONException {
+ if (value == null || value.equals(null)) {
+ return "null";
+ }
+ if (value instanceof JSONString) {
+ String object;
+ try {
+ object = ((JSONString) value).toJSONString();
+ } catch (Exception e) {
+ throw new JSONException(e);
+ }
+ if (object != null) {
+ return object;
+ }
+ throw new JSONException("Bad value from toJSONString: " + object);
+ }
+ if (value instanceof Number) {
+ // not all Numbers may match actual JSON Numbers. i.e. Fractions or Complex
+ final String numberAsString = JSONObject.numberToString((Number) value);
+ if (JSONObject.NUMBER_PATTERN.matcher(numberAsString).matches()) {
+ // Close enough to a JSON number that we will return it unquoted
+ return numberAsString;
+ }
+ // The Number value is not a valid JSON number.
+ // Instead we will quote it as a string
+ return JSONObject.quote(numberAsString);
+ }
+ if (value instanceof Boolean || value instanceof JSONObject
+ || value instanceof JSONArray) {
+ return value.toString();
+ }
+ if (value instanceof Map) {
+ Map<?, ?> map = (Map<?, ?>) value;
+ return new JSONObject(map).toString();
+ }
+ if (value instanceof Collection) {
+ Collection<?> coll = (Collection<?>) value;
+ return new JSONArray(coll).toString();
+ }
+ if (value.getClass().isArray()) {
+ return new JSONArray(value).toString();
+ }
+ if (value instanceof Enum<?>) {
+ return JSONObject.quote(((Enum<?>) value).name());
+ }
+ return JSONObject.quote(value.toString());
+ }
/**
* Append either the value <code>true</code> or the value
* <code>false</code>.
+ *
* @param b A boolean.
* @return this
- * @throws JSONException
+ * @throws JSONException if a called function has an error
*/
public JSONWriter value(boolean b) throws JSONException {
return this.append(b ? "true" : "false");
}
/**
* Append a double value.
+ *
* @param d A double.
* @return this
* @throws JSONException If the number is not finite.
*/
public JSONWriter value(double d) throws JSONException {
- return this.value(new Double(d));
+ return this.value(Double.valueOf(d));
}
/**
* Append a long value.
+ *
* @param l A long.
* @return this
- * @throws JSONException
+ * @throws JSONException if a called function has an error
*/
public JSONWriter value(long l) throws JSONException {
return this.append(Long.toString(l));
}
-
/**
* Append an object value.
- * @param o The object to append. It can be null, or a Boolean, Number,
- * String, JSONObject, or JSONArray, or an object with a toJSONString()
- * method.
+ *
+ * @param object The object to append. It can be null, or a Boolean, Number,
+ * String, JSONObject, or JSONArray, or an object that implements
+ * JSONString.
* @return this
* @throws JSONException If the value is out of sequence.
*/
- public JSONWriter value(Object o) throws JSONException {
- return this.append(JSONObject.valueToString(o));
+ public JSONWriter value(Object object) throws JSONException {
+ return this.append(valueToString(object));
+ }
+
+ /**
+ * @deprecated do not use, was removed from library and later stubbed
+ */
+ @Deprecated
+ public void setTidy(boolean tidy) {
+ // stubbed as this was removed from the library but still is referenced from
+ // customer code
+ if (!tidyWarningLogged) {
Review Comment:
done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "RemoLiechti (via GitHub)" <gi...@apache.org>.
RemoLiechti commented on PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2#issuecomment-2007011192
> @RemoLiechti - any reason to also not make the following classes package-private?
>
> src/main/java/org/apache/sling/commons/json/JSONPropertyIgnore.java src/main/java/org/apache/sling/commons/json/JSONPropertyName.java src/main/java/org/apache/sling/commons/json/util/ParserConfiguration.java
used in tests, must remain public, except we would start move tests around but this would make it more complicated when we want to take over a newer version from the json-java library.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "rombert (via GitHub)" <gi...@apache.org>.
rombert commented on code in PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2#discussion_r1526401966
##########
pom.xml:
##########
@@ -79,55 +127,73 @@
<groupId>javax.jcr</groupId>
<artifactId>jcr</artifactId>
<version>2.0</version>
- <optional>true</optional>
+ <optional>true</optional>
+ <scope>provided</scope>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
+ <scope>provided</scope>
</dependency>
<dependency>
- <!-- A recent version is required to use Sling mocks in tests, if that's a problem we'll need to change them -->
+ <!-- A recent version is required to use Sling mocks in tests, if that's a problem we'll need to change them -->
<groupId>org.apache.sling</groupId>
<artifactId>org.apache.sling.api</artifactId>
<version>2.3.0</version>
<optional>true</optional>
+ <scope>provided</scope>
</dependency>
<dependency>
<groupId>org.apache.sling</groupId>
<artifactId>org.apache.sling.commons.testing</artifactId>
<version>2.0.22</version>
<scope>test</scope>
<exclusions>
- <exclusion>
Review Comment:
Please revert this whitespace-only change, it makes checking the history more difficult.
##########
pom.xml:
##########
@@ -79,55 +127,73 @@
<groupId>javax.jcr</groupId>
<artifactId>jcr</artifactId>
<version>2.0</version>
- <optional>true</optional>
+ <optional>true</optional>
+ <scope>provided</scope>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
+ <scope>provided</scope>
</dependency>
<dependency>
- <!-- A recent version is required to use Sling mocks in tests, if that's a problem we'll need to change them -->
Review Comment:
Please revert this whitespace-only change, it makes checking the history more difficult.
##########
pom.xml:
##########
@@ -9,68 +9,116 @@
License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS
OF ANY KIND, either express or implied. See the License for the specific
language governing permissions and limitations under the License. -->
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.apache.sling</groupId>
- <artifactId>sling</artifactId>
- <version>30</version>
+ <artifactId>sling-bundle-parent</artifactId>
+ <version>52</version>
<relativePath />
</parent>
<artifactId>org.apache.sling.commons.json</artifactId>
- <packaging>bundle</packaging>
<version>2.0.21-SNAPSHOT</version>
<name>Apache Sling JSON Library</name>
<description>Apache Sling JSON Library</description>
<scm>
- <connection>scm:svn:http://svn.apache.org/repos/asf/sling/trunk/bundles/commons/json</connection>
- <developerConnection>scm:svn:https://svn.apache.org/repos/asf/sling/trunk/bundles/commons/json</developerConnection>
- <url>http://svn.apache.org/viewvc/sling/trunk/bundles/commons/json</url>
+ <connection>scm:git:https://github.com/apache/sling-org-apache-sling-commons-json</connection>
+ <developerConnection>scm:git:https://github.com/apache/sling-org-apache-sling-commons-json</developerConnection>
+ <url>https://github.com/apache/sling-org-apache-sling-commons-json</url>
</scm>
+ <properties>
Review Comment:
These are not needed. If you need to override the default Java version, set the `sling.java.version` property to `8`.
##########
pom.xml:
##########
@@ -79,55 +127,73 @@
<groupId>javax.jcr</groupId>
<artifactId>jcr</artifactId>
<version>2.0</version>
- <optional>true</optional>
Review Comment:
Please revert this whitespace-only change, it makes checking the history more difficult.
##########
.gitignore:
##########
@@ -0,0 +1,6 @@
+.vscode
+target
+src/test/java/org/apache/sling/commons/json/CVE.java
Review Comment:
Please use a standard .gitignore file from one of our repos, e.g. https://github.com/apache/sling-org-apache-sling-api/blob/master/.gitignore . This makes it compatible with multiple IDEs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "RemoLiechti (via GitHub)" <gi...@apache.org>.
RemoLiechti commented on PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2#issuecomment-2003390151
> I was wondering whether we really need to import the full code of the external library. I see annotations have been added, new classes, etc.
>
> I would prefer to only import the classes that we have had before, if at all possible. We don't want to add any new features or incentivise our users to keep using this bundle.
>
we can get rid of
- JSONML
- JSONMLParserConfioguration
- Property
- JSONMLTest
- PropertyTest
All others are heavily referenced from JSONObject and JSONArray, and sparsely some others.
To keep things simpler, I suggest to stick with the code base.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "RemoLiechti (via GitHub)" <gi...@apache.org>.
RemoLiechti commented on code in PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2#discussion_r1529837103
##########
src/main/java/org/apache/sling/commons/json/io/JSONWriter.java:
##########
@@ -243,134 +208,240 @@ public JSONWriter endObject() throws JSONException {
/**
* Append a key. The key will be associated with the next value. In an
* object, every value must be preceded by a key.
- * @param s A key string.
+ *
+ * @param string A key string.
* @return this
* @throws JSONException If the key is out of place. For example, keys
- * do not belong in arrays or if the key is null.
+ * do not belong in arrays or if the key is null.
*/
- public JSONWriter key(String s) throws JSONException {
- if (s == null) {
+ public JSONWriter key(String string) throws JSONException {
+ if (string == null) {
throw new JSONException("Null key.");
}
if (this.mode == 'k') {
try {
- if (this.comma) {
- this.writer.write(',');
+ JSONObject topObject = this.stack[this.top - 1];
+ // don't use the built in putOnce method to maintain Android support
+ if (topObject.has(string)) {
+ throw new JSONException("Duplicate key \"" + string + "\"");
}
- if (tidy) {
- this.writer.write('\n');
- this.writer.write(INDENTS[top]);
- }
- this.writer.write(JSONObject.quote(s));
- this.writer.write(':');
- if (tidy) {
- this.writer.write(' ');
+ topObject.put(string, true);
+ if (this.comma) {
+ this.writer.append(',');
}
+ this.writer.append(JSONObject.quote(string));
+ this.writer.append(':');
this.comma = false;
this.mode = 'o';
return this;
} catch (IOException e) {
+ // Android as of API 25 does not support this exception constructor
+ // however we won't worry about it. If an exception is happening here
+ // it will just throw a "Method not found" exception instead.
throw new JSONException(e);
}
}
throw new JSONException("Misplaced key.");
}
-
/**
* Begin appending a new object. All keys and values until the balancing
* <code>endObject</code> will be appended to this object. The
* <code>endObject</code> method must be called to mark the object's end.
+ *
* @return this
* @throws JSONException If the nesting is too deep, or if the object is
- * started in the wrong place (for example as a key or after the end of the
- * outermost array or object).
+ * started in the wrong place (for example as a key or
+ * after the end of the
+ * outermost array or object).
*/
public JSONWriter object() throws JSONException {
if (this.mode == 'i') {
this.mode = 'o';
}
if (this.mode == 'o' || this.mode == 'a') {
this.append("{");
- this.push('k');
+ this.push(new JSONObject());
this.comma = false;
return this;
}
throw new JSONException("Misplaced object.");
}
-
/**
* Pop an array or object scope.
+ *
* @param c The scope to close.
* @throws JSONException If nesting is wrong.
*/
private void pop(char c) throws JSONException {
- if (this.top <= 0 || this.stack[this.top - 1] != c) {
+ if (this.top <= 0) {
+ throw new JSONException("Nesting error.");
+ }
+ char m = this.stack[this.top - 1] == null ? 'a' : 'k';
+ if (m != c) {
throw new JSONException("Nesting error.");
}
this.top -= 1;
- this.mode = this.top == 0 ? 'd' : this.stack[this.top - 1];
+ this.mode = this.top == 0
+ ? 'd'
+ : this.stack[this.top - 1] == null
+ ? 'a'
+ : 'k';
}
/**
* Push an array or object scope.
- * @param c The scope to open.
+ *
+ * @param jo The scope to open.
* @throws JSONException If nesting is too deep.
*/
- private void push(char c) throws JSONException {
+ private void push(JSONObject jo) throws JSONException {
if (this.top >= maxdepth) {
- throw new JSONException("Nesting too deep (maximum is " + maxdepth + " levels)");
+ throw new JSONException("Nesting too deep.");
}
- this.stack[this.top] = c;
- this.mode = c;
+ this.stack[this.top] = jo;
+ this.mode = jo == null ? 'a' : 'k';
this.top += 1;
}
+ /**
+ * Make a JSON text of an Object value. If the object has an
+ * value.toJSONString() method, then that method will be used to produce the
+ * JSON text. The method is required to produce a strictly conforming text.
+ * If the object does not contain a toJSONString method (which is the most
+ * common case), then a text will be produced by other means. If the value
+ * is an array or Collection, then a JSONArray will be made from it and its
+ * toJSONString method will be called. If the value is a MAP, then a
+ * JSONObject will be made from it and its toJSONString method will be
+ * called. Otherwise, the value's toString method will be called, and the
+ * result will be quoted.
+ *
+ * <p>
+ * Warning: This method assumes that the data structure is acyclical.
+ *
+ * @param value
+ * The value to be serialized.
+ * @return a printable, displayable, transmittable representation of the
+ * object, beginning with <code>{</code> <small>(left
+ * brace)</small> and ending with <code>}</code> <small>(right
+ * brace)</small>.
+ * @throws JSONException
+ * If the value is or contains an invalid number.
+ */
+ public static String valueToString(Object value) throws JSONException {
+ if (value == null || value.equals(null)) {
+ return "null";
+ }
+ if (value instanceof JSONString) {
+ String object;
+ try {
+ object = ((JSONString) value).toJSONString();
+ } catch (Exception e) {
+ throw new JSONException(e);
+ }
+ if (object != null) {
+ return object;
+ }
+ throw new JSONException("Bad value from toJSONString: " + object);
+ }
+ if (value instanceof Number) {
+ // not all Numbers may match actual JSON Numbers. i.e. Fractions or Complex
+ final String numberAsString = JSONObject.numberToString((Number) value);
+ if (JSONObject.NUMBER_PATTERN.matcher(numberAsString).matches()) {
+ // Close enough to a JSON number that we will return it unquoted
+ return numberAsString;
+ }
+ // The Number value is not a valid JSON number.
+ // Instead we will quote it as a string
+ return JSONObject.quote(numberAsString);
+ }
+ if (value instanceof Boolean || value instanceof JSONObject
+ || value instanceof JSONArray) {
+ return value.toString();
+ }
+ if (value instanceof Map) {
+ Map<?, ?> map = (Map<?, ?>) value;
+ return new JSONObject(map).toString();
+ }
+ if (value instanceof Collection) {
+ Collection<?> coll = (Collection<?>) value;
+ return new JSONArray(coll).toString();
+ }
+ if (value.getClass().isArray()) {
+ return new JSONArray(value).toString();
+ }
+ if (value instanceof Enum<?>) {
+ return JSONObject.quote(((Enum<?>) value).name());
+ }
+ return JSONObject.quote(value.toString());
+ }
/**
* Append either the value <code>true</code> or the value
* <code>false</code>.
+ *
* @param b A boolean.
* @return this
- * @throws JSONException
+ * @throws JSONException if a called function has an error
*/
public JSONWriter value(boolean b) throws JSONException {
return this.append(b ? "true" : "false");
}
/**
* Append a double value.
+ *
* @param d A double.
* @return this
* @throws JSONException If the number is not finite.
*/
public JSONWriter value(double d) throws JSONException {
- return this.value(new Double(d));
+ return this.value(Double.valueOf(d));
}
/**
* Append a long value.
+ *
* @param l A long.
* @return this
- * @throws JSONException
+ * @throws JSONException if a called function has an error
*/
public JSONWriter value(long l) throws JSONException {
return this.append(Long.toString(l));
}
-
/**
* Append an object value.
- * @param o The object to append. It can be null, or a Boolean, Number,
- * String, JSONObject, or JSONArray, or an object with a toJSONString()
- * method.
+ *
+ * @param object The object to append. It can be null, or a Boolean, Number,
+ * String, JSONObject, or JSONArray, or an object that implements
+ * JSONString.
* @return this
* @throws JSONException If the value is out of sequence.
*/
- public JSONWriter value(Object o) throws JSONException {
- return this.append(JSONObject.valueToString(o));
+ public JSONWriter value(Object object) throws JSONException {
+ return this.append(valueToString(object));
+ }
+
+ /**
+ * @deprecated do not use, was removed from library and later stubbed
+ */
+ @Deprecated
+ public void setTidy(boolean tidy) {
+ // stubbed as this was removed from the library but still is referenced from
+ // customer code
+ }
+
+ /**
+ * @deprecated do not use, was removed from library and later stubbed
+ */
+ @Deprecated
+ public boolean isTidy() {
+ // stubbed as this was removed from the library but still is referenced from
+ // customer code
+ return true;
Review Comment:
my thought here, why true, was: in rare cases where a consumer of the json wants to display it on the UI for some reason (developer tools or whatever), they may check for tidyness and only show it when tidy. By assuming it to be tidy, it would at least be shown or further processed for the potential cases, while false could trigger a tidy function first, which isnt supported any longer so, depending on the client code, could end in a loop, as it never becomes tidy.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "rombert (via GitHub)" <gi...@apache.org>.
rombert commented on code in PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2#discussion_r1528904590
##########
src/main/java/org/apache/sling/commons/json/io/JSONWriter.java:
##########
@@ -243,134 +208,240 @@ public JSONWriter endObject() throws JSONException {
/**
* Append a key. The key will be associated with the next value. In an
* object, every value must be preceded by a key.
- * @param s A key string.
+ *
+ * @param string A key string.
* @return this
* @throws JSONException If the key is out of place. For example, keys
- * do not belong in arrays or if the key is null.
+ * do not belong in arrays or if the key is null.
*/
- public JSONWriter key(String s) throws JSONException {
- if (s == null) {
+ public JSONWriter key(String string) throws JSONException {
+ if (string == null) {
throw new JSONException("Null key.");
}
if (this.mode == 'k') {
try {
- if (this.comma) {
- this.writer.write(',');
+ JSONObject topObject = this.stack[this.top - 1];
+ // don't use the built in putOnce method to maintain Android support
+ if (topObject.has(string)) {
+ throw new JSONException("Duplicate key \"" + string + "\"");
}
- if (tidy) {
- this.writer.write('\n');
- this.writer.write(INDENTS[top]);
- }
- this.writer.write(JSONObject.quote(s));
- this.writer.write(':');
- if (tidy) {
- this.writer.write(' ');
+ topObject.put(string, true);
+ if (this.comma) {
+ this.writer.append(',');
}
+ this.writer.append(JSONObject.quote(string));
+ this.writer.append(':');
this.comma = false;
this.mode = 'o';
return this;
} catch (IOException e) {
+ // Android as of API 25 does not support this exception constructor
+ // however we won't worry about it. If an exception is happening here
+ // it will just throw a "Method not found" exception instead.
throw new JSONException(e);
}
}
throw new JSONException("Misplaced key.");
}
-
/**
* Begin appending a new object. All keys and values until the balancing
* <code>endObject</code> will be appended to this object. The
* <code>endObject</code> method must be called to mark the object's end.
+ *
* @return this
* @throws JSONException If the nesting is too deep, or if the object is
- * started in the wrong place (for example as a key or after the end of the
- * outermost array or object).
+ * started in the wrong place (for example as a key or
+ * after the end of the
+ * outermost array or object).
*/
public JSONWriter object() throws JSONException {
if (this.mode == 'i') {
this.mode = 'o';
}
if (this.mode == 'o' || this.mode == 'a') {
this.append("{");
- this.push('k');
+ this.push(new JSONObject());
this.comma = false;
return this;
}
throw new JSONException("Misplaced object.");
}
-
/**
* Pop an array or object scope.
+ *
* @param c The scope to close.
* @throws JSONException If nesting is wrong.
*/
private void pop(char c) throws JSONException {
- if (this.top <= 0 || this.stack[this.top - 1] != c) {
+ if (this.top <= 0) {
+ throw new JSONException("Nesting error.");
+ }
+ char m = this.stack[this.top - 1] == null ? 'a' : 'k';
+ if (m != c) {
throw new JSONException("Nesting error.");
}
this.top -= 1;
- this.mode = this.top == 0 ? 'd' : this.stack[this.top - 1];
+ this.mode = this.top == 0
+ ? 'd'
+ : this.stack[this.top - 1] == null
+ ? 'a'
+ : 'k';
}
/**
* Push an array or object scope.
- * @param c The scope to open.
+ *
+ * @param jo The scope to open.
* @throws JSONException If nesting is too deep.
*/
- private void push(char c) throws JSONException {
+ private void push(JSONObject jo) throws JSONException {
if (this.top >= maxdepth) {
- throw new JSONException("Nesting too deep (maximum is " + maxdepth + " levels)");
+ throw new JSONException("Nesting too deep.");
}
- this.stack[this.top] = c;
- this.mode = c;
+ this.stack[this.top] = jo;
+ this.mode = jo == null ? 'a' : 'k';
this.top += 1;
}
+ /**
+ * Make a JSON text of an Object value. If the object has an
+ * value.toJSONString() method, then that method will be used to produce the
+ * JSON text. The method is required to produce a strictly conforming text.
+ * If the object does not contain a toJSONString method (which is the most
+ * common case), then a text will be produced by other means. If the value
+ * is an array or Collection, then a JSONArray will be made from it and its
+ * toJSONString method will be called. If the value is a MAP, then a
+ * JSONObject will be made from it and its toJSONString method will be
+ * called. Otherwise, the value's toString method will be called, and the
+ * result will be quoted.
+ *
+ * <p>
+ * Warning: This method assumes that the data structure is acyclical.
+ *
+ * @param value
+ * The value to be serialized.
+ * @return a printable, displayable, transmittable representation of the
+ * object, beginning with <code>{</code> <small>(left
+ * brace)</small> and ending with <code>}</code> <small>(right
+ * brace)</small>.
+ * @throws JSONException
+ * If the value is or contains an invalid number.
+ */
+ public static String valueToString(Object value) throws JSONException {
+ if (value == null || value.equals(null)) {
+ return "null";
+ }
+ if (value instanceof JSONString) {
+ String object;
+ try {
+ object = ((JSONString) value).toJSONString();
+ } catch (Exception e) {
+ throw new JSONException(e);
+ }
+ if (object != null) {
+ return object;
+ }
+ throw new JSONException("Bad value from toJSONString: " + object);
+ }
+ if (value instanceof Number) {
+ // not all Numbers may match actual JSON Numbers. i.e. Fractions or Complex
+ final String numberAsString = JSONObject.numberToString((Number) value);
+ if (JSONObject.NUMBER_PATTERN.matcher(numberAsString).matches()) {
+ // Close enough to a JSON number that we will return it unquoted
+ return numberAsString;
+ }
+ // The Number value is not a valid JSON number.
+ // Instead we will quote it as a string
+ return JSONObject.quote(numberAsString);
+ }
+ if (value instanceof Boolean || value instanceof JSONObject
+ || value instanceof JSONArray) {
+ return value.toString();
+ }
+ if (value instanceof Map) {
+ Map<?, ?> map = (Map<?, ?>) value;
+ return new JSONObject(map).toString();
+ }
+ if (value instanceof Collection) {
+ Collection<?> coll = (Collection<?>) value;
+ return new JSONArray(coll).toString();
+ }
+ if (value.getClass().isArray()) {
+ return new JSONArray(value).toString();
+ }
+ if (value instanceof Enum<?>) {
+ return JSONObject.quote(((Enum<?>) value).name());
+ }
+ return JSONObject.quote(value.toString());
+ }
/**
* Append either the value <code>true</code> or the value
* <code>false</code>.
+ *
* @param b A boolean.
* @return this
- * @throws JSONException
+ * @throws JSONException if a called function has an error
*/
public JSONWriter value(boolean b) throws JSONException {
return this.append(b ? "true" : "false");
}
/**
* Append a double value.
+ *
* @param d A double.
* @return this
* @throws JSONException If the number is not finite.
*/
public JSONWriter value(double d) throws JSONException {
- return this.value(new Double(d));
+ return this.value(Double.valueOf(d));
}
/**
* Append a long value.
+ *
* @param l A long.
* @return this
- * @throws JSONException
+ * @throws JSONException if a called function has an error
*/
public JSONWriter value(long l) throws JSONException {
return this.append(Long.toString(l));
}
-
/**
* Append an object value.
- * @param o The object to append. It can be null, or a Boolean, Number,
- * String, JSONObject, or JSONArray, or an object with a toJSONString()
- * method.
+ *
+ * @param object The object to append. It can be null, or a Boolean, Number,
+ * String, JSONObject, or JSONArray, or an object that implements
+ * JSONString.
* @return this
* @throws JSONException If the value is out of sequence.
*/
- public JSONWriter value(Object o) throws JSONException {
- return this.append(JSONObject.valueToString(o));
+ public JSONWriter value(Object object) throws JSONException {
+ return this.append(valueToString(object));
+ }
+
+ /**
+ * @deprecated do not use, was removed from library and later stubbed
+ */
+ @Deprecated
+ public void setTidy(boolean tidy) {
+ // stubbed as this was removed from the library but still is referenced from
Review Comment:
Please log a WARN when this is invoked, but only the first time. You can mention that it was disabled "for security reasons"
##########
src/main/java/org/apache/sling/commons/json/io/JSONWriter.java:
##########
@@ -243,134 +208,240 @@ public JSONWriter endObject() throws JSONException {
/**
* Append a key. The key will be associated with the next value. In an
* object, every value must be preceded by a key.
- * @param s A key string.
+ *
+ * @param string A key string.
* @return this
* @throws JSONException If the key is out of place. For example, keys
- * do not belong in arrays or if the key is null.
+ * do not belong in arrays or if the key is null.
*/
- public JSONWriter key(String s) throws JSONException {
- if (s == null) {
+ public JSONWriter key(String string) throws JSONException {
+ if (string == null) {
throw new JSONException("Null key.");
}
if (this.mode == 'k') {
try {
- if (this.comma) {
- this.writer.write(',');
+ JSONObject topObject = this.stack[this.top - 1];
+ // don't use the built in putOnce method to maintain Android support
+ if (topObject.has(string)) {
+ throw new JSONException("Duplicate key \"" + string + "\"");
}
- if (tidy) {
- this.writer.write('\n');
- this.writer.write(INDENTS[top]);
- }
- this.writer.write(JSONObject.quote(s));
- this.writer.write(':');
- if (tidy) {
- this.writer.write(' ');
+ topObject.put(string, true);
+ if (this.comma) {
+ this.writer.append(',');
}
+ this.writer.append(JSONObject.quote(string));
+ this.writer.append(':');
this.comma = false;
this.mode = 'o';
return this;
} catch (IOException e) {
+ // Android as of API 25 does not support this exception constructor
+ // however we won't worry about it. If an exception is happening here
+ // it will just throw a "Method not found" exception instead.
throw new JSONException(e);
}
}
throw new JSONException("Misplaced key.");
}
-
/**
* Begin appending a new object. All keys and values until the balancing
* <code>endObject</code> will be appended to this object. The
* <code>endObject</code> method must be called to mark the object's end.
+ *
* @return this
* @throws JSONException If the nesting is too deep, or if the object is
- * started in the wrong place (for example as a key or after the end of the
- * outermost array or object).
+ * started in the wrong place (for example as a key or
+ * after the end of the
+ * outermost array or object).
*/
public JSONWriter object() throws JSONException {
if (this.mode == 'i') {
this.mode = 'o';
}
if (this.mode == 'o' || this.mode == 'a') {
this.append("{");
- this.push('k');
+ this.push(new JSONObject());
this.comma = false;
return this;
}
throw new JSONException("Misplaced object.");
}
-
/**
* Pop an array or object scope.
+ *
* @param c The scope to close.
* @throws JSONException If nesting is wrong.
*/
private void pop(char c) throws JSONException {
- if (this.top <= 0 || this.stack[this.top - 1] != c) {
+ if (this.top <= 0) {
+ throw new JSONException("Nesting error.");
+ }
+ char m = this.stack[this.top - 1] == null ? 'a' : 'k';
+ if (m != c) {
throw new JSONException("Nesting error.");
}
this.top -= 1;
- this.mode = this.top == 0 ? 'd' : this.stack[this.top - 1];
+ this.mode = this.top == 0
+ ? 'd'
+ : this.stack[this.top - 1] == null
+ ? 'a'
+ : 'k';
}
/**
* Push an array or object scope.
- * @param c The scope to open.
+ *
+ * @param jo The scope to open.
* @throws JSONException If nesting is too deep.
*/
- private void push(char c) throws JSONException {
+ private void push(JSONObject jo) throws JSONException {
if (this.top >= maxdepth) {
- throw new JSONException("Nesting too deep (maximum is " + maxdepth + " levels)");
+ throw new JSONException("Nesting too deep.");
}
- this.stack[this.top] = c;
- this.mode = c;
+ this.stack[this.top] = jo;
+ this.mode = jo == null ? 'a' : 'k';
this.top += 1;
}
+ /**
+ * Make a JSON text of an Object value. If the object has an
+ * value.toJSONString() method, then that method will be used to produce the
+ * JSON text. The method is required to produce a strictly conforming text.
+ * If the object does not contain a toJSONString method (which is the most
+ * common case), then a text will be produced by other means. If the value
+ * is an array or Collection, then a JSONArray will be made from it and its
+ * toJSONString method will be called. If the value is a MAP, then a
+ * JSONObject will be made from it and its toJSONString method will be
+ * called. Otherwise, the value's toString method will be called, and the
+ * result will be quoted.
+ *
+ * <p>
+ * Warning: This method assumes that the data structure is acyclical.
+ *
+ * @param value
+ * The value to be serialized.
+ * @return a printable, displayable, transmittable representation of the
+ * object, beginning with <code>{</code> <small>(left
+ * brace)</small> and ending with <code>}</code> <small>(right
+ * brace)</small>.
+ * @throws JSONException
+ * If the value is or contains an invalid number.
+ */
+ public static String valueToString(Object value) throws JSONException {
+ if (value == null || value.equals(null)) {
+ return "null";
+ }
+ if (value instanceof JSONString) {
+ String object;
+ try {
+ object = ((JSONString) value).toJSONString();
+ } catch (Exception e) {
+ throw new JSONException(e);
+ }
+ if (object != null) {
+ return object;
+ }
+ throw new JSONException("Bad value from toJSONString: " + object);
+ }
+ if (value instanceof Number) {
+ // not all Numbers may match actual JSON Numbers. i.e. Fractions or Complex
+ final String numberAsString = JSONObject.numberToString((Number) value);
+ if (JSONObject.NUMBER_PATTERN.matcher(numberAsString).matches()) {
+ // Close enough to a JSON number that we will return it unquoted
+ return numberAsString;
+ }
+ // The Number value is not a valid JSON number.
+ // Instead we will quote it as a string
+ return JSONObject.quote(numberAsString);
+ }
+ if (value instanceof Boolean || value instanceof JSONObject
+ || value instanceof JSONArray) {
+ return value.toString();
+ }
+ if (value instanceof Map) {
+ Map<?, ?> map = (Map<?, ?>) value;
+ return new JSONObject(map).toString();
+ }
+ if (value instanceof Collection) {
+ Collection<?> coll = (Collection<?>) value;
+ return new JSONArray(coll).toString();
+ }
+ if (value.getClass().isArray()) {
+ return new JSONArray(value).toString();
+ }
+ if (value instanceof Enum<?>) {
+ return JSONObject.quote(((Enum<?>) value).name());
+ }
+ return JSONObject.quote(value.toString());
+ }
/**
* Append either the value <code>true</code> or the value
* <code>false</code>.
+ *
* @param b A boolean.
* @return this
- * @throws JSONException
+ * @throws JSONException if a called function has an error
*/
public JSONWriter value(boolean b) throws JSONException {
return this.append(b ? "true" : "false");
}
/**
* Append a double value.
+ *
* @param d A double.
* @return this
* @throws JSONException If the number is not finite.
*/
public JSONWriter value(double d) throws JSONException {
- return this.value(new Double(d));
+ return this.value(Double.valueOf(d));
}
/**
* Append a long value.
+ *
* @param l A long.
* @return this
- * @throws JSONException
+ * @throws JSONException if a called function has an error
*/
public JSONWriter value(long l) throws JSONException {
return this.append(Long.toString(l));
}
-
/**
* Append an object value.
- * @param o The object to append. It can be null, or a Boolean, Number,
- * String, JSONObject, or JSONArray, or an object with a toJSONString()
- * method.
+ *
+ * @param object The object to append. It can be null, or a Boolean, Number,
+ * String, JSONObject, or JSONArray, or an object that implements
+ * JSONString.
* @return this
* @throws JSONException If the value is out of sequence.
*/
- public JSONWriter value(Object o) throws JSONException {
- return this.append(JSONObject.valueToString(o));
+ public JSONWriter value(Object object) throws JSONException {
+ return this.append(valueToString(object));
+ }
+
+ /**
+ * @deprecated do not use, was removed from library and later stubbed
+ */
+ @Deprecated
+ public void setTidy(boolean tidy) {
+ // stubbed as this was removed from the library but still is referenced from
+ // customer code
+ }
+
+ /**
+ * @deprecated do not use, was removed from library and later stubbed
+ */
+ @Deprecated
+ public boolean isTidy() {
+ // stubbed as this was removed from the library but still is referenced from
+ // customer code
+ return true;
Review Comment:
Technically speaking this should return false, because the tidy mode is never enabled.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "rombert (via GitHub)" <gi...@apache.org>.
rombert commented on code in PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2#discussion_r1530058522
##########
src/main/java/org/apache/sling/commons/json/JSONParserConfiguration.java:
##########
@@ -0,0 +1,29 @@
+package org.apache.sling.commons.json;
+
+import org.apache.sling.commons.json.util.ParserConfiguration;
+
+/**
+ * Configuration object for the JSON parser. The configuration is immutable.
+ */
+@Deprecated
+public class JSONParserConfiguration extends ParserConfiguration {
Review Comment:
This is a new class that was not part of the API in the previous release of the bundle. Can we also make it package-protected? Same goes for classes that were not here before.
##########
src/main/java/org/apache/sling/commons/json/io/JSONWriter.java:
##########
@@ -243,134 +213,248 @@ public JSONWriter endObject() throws JSONException {
/**
* Append a key. The key will be associated with the next value. In an
* object, every value must be preceded by a key.
- * @param s A key string.
+ *
+ * @param string A key string.
* @return this
* @throws JSONException If the key is out of place. For example, keys
- * do not belong in arrays or if the key is null.
+ * do not belong in arrays or if the key is null.
*/
- public JSONWriter key(String s) throws JSONException {
- if (s == null) {
+ public JSONWriter key(String string) throws JSONException {
+ if (string == null) {
throw new JSONException("Null key.");
}
if (this.mode == 'k') {
try {
- if (this.comma) {
- this.writer.write(',');
- }
- if (tidy) {
- this.writer.write('\n');
- this.writer.write(INDENTS[top]);
+ JSONObject topObject = this.stack[this.top - 1];
+ // don't use the built in putOnce method to maintain Android support
+ if (topObject.has(string)) {
+ throw new JSONException("Duplicate key \"" + string + "\"");
}
- this.writer.write(JSONObject.quote(s));
- this.writer.write(':');
- if (tidy) {
- this.writer.write(' ');
+ topObject.put(string, true);
+ if (this.comma) {
+ this.writer.append(',');
}
+ this.writer.append(JSONObject.quote(string));
+ this.writer.append(':');
this.comma = false;
this.mode = 'o';
return this;
} catch (IOException e) {
+ // Android as of API 25 does not support this exception constructor
+ // however we won't worry about it. If an exception is happening here
+ // it will just throw a "Method not found" exception instead.
throw new JSONException(e);
}
}
throw new JSONException("Misplaced key.");
}
-
/**
* Begin appending a new object. All keys and values until the balancing
* <code>endObject</code> will be appended to this object. The
* <code>endObject</code> method must be called to mark the object's end.
+ *
* @return this
* @throws JSONException If the nesting is too deep, or if the object is
- * started in the wrong place (for example as a key or after the end of the
- * outermost array or object).
+ * started in the wrong place (for example as a key or
+ * after the end of the
+ * outermost array or object).
*/
public JSONWriter object() throws JSONException {
if (this.mode == 'i') {
this.mode = 'o';
}
if (this.mode == 'o' || this.mode == 'a') {
this.append("{");
- this.push('k');
+ this.push(new JSONObject());
this.comma = false;
return this;
}
throw new JSONException("Misplaced object.");
}
-
/**
* Pop an array or object scope.
+ *
* @param c The scope to close.
* @throws JSONException If nesting is wrong.
*/
private void pop(char c) throws JSONException {
- if (this.top <= 0 || this.stack[this.top - 1] != c) {
+ if (this.top <= 0) {
+ throw new JSONException("Nesting error.");
+ }
+ char m = this.stack[this.top - 1] == null ? 'a' : 'k';
+ if (m != c) {
throw new JSONException("Nesting error.");
}
this.top -= 1;
- this.mode = this.top == 0 ? 'd' : this.stack[this.top - 1];
+ this.mode = this.top == 0
+ ? 'd'
+ : this.stack[this.top - 1] == null
+ ? 'a'
+ : 'k';
}
/**
* Push an array or object scope.
- * @param c The scope to open.
+ *
+ * @param jo The scope to open.
* @throws JSONException If nesting is too deep.
*/
- private void push(char c) throws JSONException {
+ private void push(JSONObject jo) throws JSONException {
if (this.top >= maxdepth) {
- throw new JSONException("Nesting too deep (maximum is " + maxdepth + " levels)");
+ throw new JSONException("Nesting too deep.");
}
- this.stack[this.top] = c;
- this.mode = c;
+ this.stack[this.top] = jo;
+ this.mode = jo == null ? 'a' : 'k';
this.top += 1;
}
+ /**
+ * Make a JSON text of an Object value. If the object has an
+ * value.toJSONString() method, then that method will be used to produce the
+ * JSON text. The method is required to produce a strictly conforming text.
+ * If the object does not contain a toJSONString method (which is the most
+ * common case), then a text will be produced by other means. If the value
+ * is an array or Collection, then a JSONArray will be made from it and its
+ * toJSONString method will be called. If the value is a MAP, then a
+ * JSONObject will be made from it and its toJSONString method will be
+ * called. Otherwise, the value's toString method will be called, and the
+ * result will be quoted.
+ *
+ * <p>
+ * Warning: This method assumes that the data structure is acyclical.
+ *
+ * @param value
+ * The value to be serialized.
+ * @return a printable, displayable, transmittable representation of the
+ * object, beginning with <code>{</code> <small>(left
+ * brace)</small> and ending with <code>}</code> <small>(right
+ * brace)</small>.
+ * @throws JSONException
+ * If the value is or contains an invalid number.
+ */
+ public static String valueToString(Object value) throws JSONException {
+ if (value == null || value.equals(null)) {
+ return "null";
+ }
+ if (value instanceof JSONString) {
+ String object;
+ try {
+ object = ((JSONString) value).toJSONString();
+ } catch (Exception e) {
+ throw new JSONException(e);
+ }
+ if (object != null) {
+ return object;
+ }
+ throw new JSONException("Bad value from toJSONString: " + object);
+ }
+ if (value instanceof Number) {
+ // not all Numbers may match actual JSON Numbers. i.e. Fractions or Complex
+ final String numberAsString = JSONObject.numberToString((Number) value);
+ if (JSONObject.NUMBER_PATTERN.matcher(numberAsString).matches()) {
+ // Close enough to a JSON number that we will return it unquoted
+ return numberAsString;
+ }
+ // The Number value is not a valid JSON number.
+ // Instead we will quote it as a string
+ return JSONObject.quote(numberAsString);
+ }
+ if (value instanceof Boolean || value instanceof JSONObject
+ || value instanceof JSONArray) {
+ return value.toString();
+ }
+ if (value instanceof Map) {
+ Map<?, ?> map = (Map<?, ?>) value;
+ return new JSONObject(map).toString();
+ }
+ if (value instanceof Collection) {
+ Collection<?> coll = (Collection<?>) value;
+ return new JSONArray(coll).toString();
+ }
+ if (value.getClass().isArray()) {
+ return new JSONArray(value).toString();
+ }
+ if (value instanceof Enum<?>) {
+ return JSONObject.quote(((Enum<?>) value).name());
+ }
+ return JSONObject.quote(value.toString());
+ }
/**
* Append either the value <code>true</code> or the value
* <code>false</code>.
+ *
* @param b A boolean.
* @return this
- * @throws JSONException
+ * @throws JSONException if a called function has an error
*/
public JSONWriter value(boolean b) throws JSONException {
return this.append(b ? "true" : "false");
}
/**
* Append a double value.
+ *
* @param d A double.
* @return this
* @throws JSONException If the number is not finite.
*/
public JSONWriter value(double d) throws JSONException {
- return this.value(new Double(d));
+ return this.value(Double.valueOf(d));
}
/**
* Append a long value.
+ *
* @param l A long.
* @return this
- * @throws JSONException
+ * @throws JSONException if a called function has an error
*/
public JSONWriter value(long l) throws JSONException {
return this.append(Long.toString(l));
}
-
/**
* Append an object value.
- * @param o The object to append. It can be null, or a Boolean, Number,
- * String, JSONObject, or JSONArray, or an object with a toJSONString()
- * method.
+ *
+ * @param object The object to append. It can be null, or a Boolean, Number,
+ * String, JSONObject, or JSONArray, or an object that implements
+ * JSONString.
* @return this
* @throws JSONException If the value is out of sequence.
*/
- public JSONWriter value(Object o) throws JSONException {
- return this.append(JSONObject.valueToString(o));
+ public JSONWriter value(Object object) throws JSONException {
+ return this.append(valueToString(object));
+ }
+
+ /**
+ * @deprecated do not use, was removed from library and later stubbed
+ */
+ @Deprecated
+ public void setTidy(boolean tidy) {
+ // stubbed as this was removed from the library but still is referenced from
+ // customer code
+ if (!tidyWarningLogged) {
Review Comment:
Continuing the discussion here: if you're concerned about people relying on the value of `tidy` why don't we
- restore the field, have the setter and getter work as usual
- ignore the field everywhere
- log a warning when the tidy parameter is true, the tidy field is false and a warning has never been logged before
This should be zero-risk (getter/setter behaviour unchanged) and logs the warnings only when applicable.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "RemoLiechti (via GitHub)" <gi...@apache.org>.
RemoLiechti commented on PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2#issuecomment-2006497233
> * whitespace pom.xml changes addressed
done
> * inline comments about the set/get tidy methods
see my comment on the isTidy()
added single warning log when API is used
> * listing the changes you made to the external libraries so we don't forget how to do this if we need to apply updates again. Given how much you added, I think a single external file would work, either README.md, package-info.java, or whatever you prefer
Done in readme.md
> * making sure the required Java version is 8; it was previously 7 but we don't need to require 7 IMO. However, the bundle built from your PR currently requires Java 11 which is not desired `Require-Capability: osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=11))"`
done, is now Require-Capability: osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"
> * updating the LICENSE/NOTICE file as per https://www.apache.org/legal/resolved#handling-public-domain-licensed-works ; feel free to leave this out if you are unable to figure out in time, we can probably ask for guidance
Added licence and notice file according to https://infra.apache.org/licensing-howto.html
also put JSONML, JSONMLParserConfioguration and Property to package-private.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "RemoLiechti (via GitHub)" <gi...@apache.org>.
RemoLiechti commented on PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2#issuecomment-2007122489
> LGTM, thanks. Please create a Jira as well and paste it here, I will then merge the code and start a release vote.
https://issues.apache.org/jira/browse/SLING-12268
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "rombert (via GitHub)" <gi...@apache.org>.
rombert merged PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "rombert (via GitHub)" <gi...@apache.org>.
rombert commented on PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2#issuecomment-2006070004
@RemoLiechti - I realised I forgot one of the key points yesterday, sorry. Rather than removing the classes which are new in the latest version of https://github.com/stleary/JSON-java, can you rather make their visibility package-private? This limits the exposure of new code with smaller effort.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "rombert (via GitHub)" <gi...@apache.org>.
rombert commented on PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2#issuecomment-1997084835
Thanks for the PR @RemoLiechti , quite a lot to process :-) My first note would be that we still need the `@Deprecated` annotation to be set on all classes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2022-47937-json, migrate to junit5, parentPom 52 [sling-org-apache-sling-commons-json]
Posted by "RemoLiechti (via GitHub)" <gi...@apache.org>.
RemoLiechti commented on PR #2:
URL: https://github.com/apache/sling-org-apache-sling-commons-json/pull/2#issuecomment-1997147262
> Thanks for the PR @RemoLiechti , quite a lot to process :-) My first note would be that we still need the `@Deprecated` annotation to be set on all classes.
good catch, done.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@sling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org