diff --git a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/json/BasicJsonParser.java b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/json/BasicJsonParser.java index da029cdce4..dad9038123 100644 --- a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/json/BasicJsonParser.java +++ b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/json/BasicJsonParser.java @@ -67,7 +67,7 @@ public class BasicJsonParser extends AbstractJsonParser { return parseListInternal(nesting + 1, json); } if (json.startsWith("{")) { - return parseMapInternal(nesting, json); + return parseMapInternal(nesting + 1, json); } if (json.startsWith("\"")) { return trimTrailingCharacter(trimLeadingCharacter(json, '"'), '"'); diff --git a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/json/AbstractJsonParserTests.java b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/json/AbstractJsonParserTests.java index 2ef4b49c57..2d1a234de4 100644 --- a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/json/AbstractJsonParserTests.java +++ b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/json/AbstractJsonParserTests.java @@ -205,4 +205,12 @@ abstract class AbstractJsonParserTests { assertThatExceptionOfType(JsonParseException.class).isThrownBy(() -> this.parser.parseList(input)); } + @Test // gh-32029 + void deeplyNestedMap() throws IOException { + String input = StreamUtils.copyToString( + AbstractJsonParserTests.class.getResourceAsStream("deeply-nested-map-json.txt"), + StandardCharsets.UTF_8); + assertThatExceptionOfType(JsonParseException.class).isThrownBy(() -> this.parser.parseList(input)); + } + } diff --git a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/json/YamlJsonParserTests.java b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/json/YamlJsonParserTests.java index d51b3e51c4..9ce5025993 100644 --- a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/json/YamlJsonParserTests.java +++ b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/json/YamlJsonParserTests.java @@ -66,4 +66,9 @@ class YamlJsonParserTests extends AbstractJsonParserTests { void largeMalformed() throws IOException { } + @Override + @Disabled("SnakeYaml does not protect against deeply nested JSON") + void deeplyNestedMap() throws IOException { + } + } diff --git a/spring-boot-project/spring-boot/src/test/resources/org/springframework/boot/json/deeply-nested-map-json.txt b/spring-boot-project/spring-boot/src/test/resources/org/springframework/boot/json/deeply-nested-map-json.txt new file mode 100644 index 0000000000..39b2bfa8a4 --- /dev/null +++ b/spring-boot-project/spring-boot/src/test/resources/org/springframework/boot/json/deeply-nested-map-json.txt @@ -0,0 +1 @@ +[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"�� \ No newline at end of file