secure-json-parse 0.1.1

prototype-poisoning-safe JSON parsing of untrusted input
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146

//! protoAction: error (default), remove, ignore. Plus whitespace and unicode
//! key variants that decode to the literal `__proto__`.

mod common;

use common::*;
use secure_json_parse::{parse, Action, Error, Options};
use serde_json::json;

#[test]
fn remove_strips_proto() {
    let v = parse(PROTO, &proto_remove()).unwrap().unwrap();
    assert_eq!(v, json!({"a": 5, "b": 6}));
}

#[test]
fn remove_strips_nested_proto() {
    let v = parse(PROTO_NESTED, &proto_remove()).unwrap().unwrap();
    assert_eq!(
        v,
        json!({"a": 5, "b": 6, "c": {"d": 0, "e": "text", "f": {"g": 2}}})
    );
}

#[test]
fn ignore_keeps_proto() {
    // Ignore is identical to a plain parse: the __proto__ key stays.
    let v = parse(PROTO, &proto_ignore()).unwrap().unwrap();
    let raw: serde_json::Value = serde_json::from_str(PROTO).unwrap();
    assert_eq!(v, raw);
}

#[test]
fn proto_as_value_does_not_trip() {
    let v = parse(PROTO_VALUE, &Options::default()).unwrap().unwrap();
    assert_eq!(v, json!({"a": 5, "b": "__proto__"}));
}

#[test]
fn error_on_proto_default() {
    assert!(matches!(
        parse(PROTO, &Options::default()),
        Err(Error::ForbiddenProperty)
    ));
}

#[test]
fn error_on_proto_explicit() {
    let opts = Options::default().proto_action(Action::Error);
    assert!(matches!(parse(PROTO, &opts), Err(Error::ForbiddenProperty)));
}

#[test]
fn error_on_proto_whitespace_variants() {
    // Whitespace between the key and colon does not change detection.
    let variants = [
        r#"{ "a": 5, "b": 6, "__proto__": { "x": 7 } }"#,
        "{ \"a\": 5, \"b\": 6, \"__proto__\" : { \"x\": 7 } }",
        "{ \"a\": 5, \"b\": 6, \"__proto__\" \n\r\t : { \"x\": 7 } }",
        "{ \"a\": 5, \"b\": 6, \"__proto__\" \n \r \t : { \"x\": 7 } }",
    ];
    for v in variants {
        assert!(
            matches!(parse(v, &Options::default()), Err(Error::ForbiddenProperty)),
            "expected error for {v:?}"
        );
    }
}

#[test]
fn error_on_proto_unicode_variants() {
    // Each input escapes some or all of __proto__ with \uXXXX. serde_json
    // decodes them to the literal key, which the walk then detects.
    let variants = [
        r#"{ "a": 5, "b": 6, "\u005f_proto__": { "x": 7 } }"#,
        r#"{ "a": 5, "b": 6, "_\u005fp\u0072oto__": { "x": 7 } }"#,
        r#"{ "a": 5, "b": 6, "\u005f\u005f\u0070\u0072\u006f\u0074\u006f\u005f\u005f": { "x": 7 } }"#,
        r#"{ "a": 5, "b": 6, "\u005F_proto__": { "x": 7 } }"#,
        r#"{ "a": 5, "b": 6, "_\u005Fp\u0072oto__": { "x": 7 } }"#,
        r#"{ "a": 5, "b": 6, "\u005F\u005F\u0070\u0072\u006F\u0074\u006F\u005F\u005F": { "x": 7 } }"#,
    ];
    for v in variants {
        assert!(
            matches!(parse(v, &Options::default()), Err(Error::ForbiddenProperty)),
            "expected error for {v:?}"
        );
    }
}

#[test]
fn nested_proto_errors_by_default() {
    assert!(matches!(
        parse(PROTO_NESTED, &Options::default()),
        Err(Error::ForbiddenProperty)
    ));
}

#[test]
fn first_and_last_key_position_both_detected() {
    let first = r#"{"__proto__": {"x": 1}, "a": 2}"#;
    let last = r#"{"a": 2, "__proto__": {"x": 1}}"#;
    for v in [first, last] {
        assert!(matches!(
            parse(v, &Options::default()),
            Err(Error::ForbiddenProperty)
        ));
    }
}

#[test]
fn non_object_proto_value_still_errors() {
    // Detection keys on the property name, not the value shape. A scalar, null,
    // or array value for __proto__ is a violation just like an object value.
    let inputs = [
        r#"{"__proto__": 5}"#,
        r#"{"__proto__": "x"}"#,
        r#"{"__proto__": true}"#,
        r#"{"__proto__": null}"#,
        r#"{"__proto__": [1, 2]}"#,
    ];
    for text in inputs {
        assert!(
            matches!(
                parse(text, &Options::default()),
                Err(Error::ForbiddenProperty)
            ),
            "expected error for {text:?}"
        );
    }
}

#[test]
fn non_object_proto_value_is_removed() {
    // Remove strips the __proto__ key whatever its value, keeping siblings.
    let cases = [
        (r#"{"a": 1, "__proto__": 5}"#, json!({"a": 1})),
        (r#"{"a": 1, "__proto__": "x"}"#, json!({"a": 1})),
        (r#"{"a": 1, "__proto__": null}"#, json!({"a": 1})),
        (r#"{"a": 1, "__proto__": [1, 2]}"#, json!({"a": 1})),
        (r#"{"a": 1, "__proto__": true}"#, json!({"a": 1})),
    ];
    for (text, expected) in cases {
        let v = parse(text, &proto_remove()).unwrap().unwrap();
        assert_eq!(v, expected, "for {text:?}");
    }
}