wasphin opened a new pull request, #3659: URL: https://github.com/apache/brpc/pull/3659
### What problem does this PR solve? Problem Summary: Couchbase manifest parsing currently accepts arbitrarily nested JSON and ignores bytes after an embedded NUL. ### What is changed and the side effects? Changed: - Validate manifest JSON with an iterative reader and a nesting limit of 100 before constructing the DOM. - Require the reader to consume the complete input and build the DOM iteratively. - Cover boundary depths, deeply nested arrays, quoted brackets, and embedded NULs. Side effects: - Performance effects: Adds one linear validation pass over each manifest. - Breaking backward compatibility: Manifests deeper than 100 levels or containing embedded NULs are rejected. No API signature changes. --- ### Check List: - [x] Changes compile locally. - [x] Added focused regression coverage. - Please follow [Contributor Covenant Code of Conduct](https://github.com/apache/brpc/blob/master/CODE_OF_CONDUCT.md). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
