This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch 3.6.x-fixes in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 005ec01d28e1d7dd1496c5b4d0cf3a49b3b46e11 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Tue Jun 2 15:40:50 2026 +0100 Properly handle nested arrays in json parsing (#3168) * Properly handle nested arrays in json parsing * Fixup (cherry picked from commit 2dff3201be0d8457532ffaf3b17e9b013697425e) (cherry picked from commit 1f3e9ab383ee7494fa2a9463c3551bca3fb765b1) --- .../cxf/jaxrs/json/basic/JsonMapObjectReaderWriter.java | 17 +++++++++++++++++ .../jaxrs/json/basic/JsonMapObjectReaderWriterTest.java | 7 +++++++ 2 files changed, 24 insertions(+) diff --git a/rt/rs/extensions/json-basic/src/main/java/org/apache/cxf/jaxrs/json/basic/JsonMapObjectReaderWriter.java b/rt/rs/extensions/json-basic/src/main/java/org/apache/cxf/jaxrs/json/basic/JsonMapObjectReaderWriter.java index f83e48ad3ad..117c6692c4c 100644 --- a/rt/rs/extensions/json-basic/src/main/java/org/apache/cxf/jaxrs/json/basic/JsonMapObjectReaderWriter.java +++ b/rt/rs/extensions/json-basic/src/main/java/org/apache/cxf/jaxrs/json/basic/JsonMapObjectReaderWriter.java @@ -245,6 +245,7 @@ public class JsonMapObjectReaderWriter { } if (json.charAt(sepIndex + j) == OBJECT_START) { int closingIndex = getClosingIndex(json, OBJECT_START, OBJECT_END, sepIndex + j); + closingIndex = requireClosingIndex(closingIndex, OBJECT_START, OBJECT_END); String newJson = json.substring(sepIndex + j + 1, closingIndex); MapSettable nextMap = new MapSettable(); readJsonObjectAsSettable(nextMap, newJson, depth + 1); @@ -252,6 +253,7 @@ public class JsonMapObjectReaderWriter { i = closingIndex + 1; } else if (json.charAt(sepIndex + j) == ARRAY_START) { int closingIndex = getClosingIndex(json, ARRAY_START, ARRAY_END, sepIndex + j); + closingIndex = requireClosingIndex(closingIndex, ARRAY_START, ARRAY_END); String newJson = json.substring(sepIndex + j + 1, closingIndex); values.put(name, internalFromJsonAsList(name, newJson, depth + 1)); i = closingIndex + 1; @@ -281,10 +283,16 @@ public class JsonMapObjectReaderWriter { } if (json.charAt(i) == OBJECT_START) { int closingIndex = getClosingIndex(json, OBJECT_START, OBJECT_END, i); + closingIndex = requireClosingIndex(closingIndex, OBJECT_START, OBJECT_END); MapSettable nextMap = new MapSettable(); readJsonObjectAsSettable(nextMap, json.substring(i + 1, closingIndex), depth + 1); values.add(nextMap.map); i = closingIndex + 1; + } else if (json.charAt(i) == ARRAY_START) { + int closingIndex = getClosingIndex(json, ARRAY_START, ARRAY_END, i); + closingIndex = requireClosingIndex(closingIndex, ARRAY_START, ARRAY_END); + values.add(internalFromJsonAsList(name, json.substring(i + 1, closingIndex), depth + 1)); + i = closingIndex + 1; } else { int commaIndex = getCommaIndex(json, i); Object value = readPrimitiveValue(name, json, i, commaIndex); @@ -339,6 +347,15 @@ public class JsonMapObjectReaderWriter { return closingIndex; } + private static int requireClosingIndex(int closingIndex, char openChar, char closeChar) { + if (closingIndex == -1) { + throw new UncheckedIOException(new IOException( + "Error in parsing json: missing closing '" + closeChar + + "' for '" + openChar + "'")); + } + return closingIndex; + } + protected static int getNextSepCharIndex(String json, char curlyBracketChar, int from) { int nextCurlyBracketIndex = -1; boolean inString = false; diff --git a/rt/rs/extensions/json-basic/src/test/java/org/apache/cxf/jaxrs/json/basic/JsonMapObjectReaderWriterTest.java b/rt/rs/extensions/json-basic/src/test/java/org/apache/cxf/jaxrs/json/basic/JsonMapObjectReaderWriterTest.java index 805f56b5c2f..124a9b1669a 100644 --- a/rt/rs/extensions/json-basic/src/test/java/org/apache/cxf/jaxrs/json/basic/JsonMapObjectReaderWriterTest.java +++ b/rt/rs/extensions/json-basic/src/test/java/org/apache/cxf/jaxrs/json/basic/JsonMapObjectReaderWriterTest.java @@ -382,6 +382,13 @@ public class JsonMapObjectReaderWriterTest { assertInvalidNumericLiteral("NaN"); } + @Test + public void testNestedArrayValueParsesSuccessfully() { + Map<String, Object> map = new JsonMapObjectReaderWriter().fromJson("{\"a\":[[]]}"); + assertEquals(1, map.size()); + assertEquals(Collections.singletonList(Collections.emptyList()), map.get("a")); + } + private void assertInvalidNumericLiteral(String value) { JsonMapObjectReaderWriter jsonMapObjectReaderWriter = new JsonMapObjectReaderWriter(); try {
