Fix issues that are variants of those #1182 (#1184)

* Catch excessive objects in json being parsed, even if following a comment. * Include line info on excessive content for deserialisation.
JamesNK · Jan 18, 2017 · 8956d3c · 8956d3c
1 parent 76600dc
commit 8956d3c
Show file tree

Hide file tree

Showing 9 changed files with 137 additions and 10 deletions.
diff --git a/Src/Newtonsoft.Json.Tests/Linq/JArrayTests.cs b/Src/Newtonsoft.Json.Tests/Linq/JArrayTests.cs
@@ -556,6 +556,31 @@ public void Parse_NoComments()
             Assert.AreEqual(3, (int)a[2]);
         }
 
+        [Test]
+        public void Parse_ExcessiveContentJustComments()
+        {
+            string json = @"[1,2,3]/*comment*/
+//Another comment.";
+
+            JArray a = JArray.Parse(json);
+
+            Assert.AreEqual(3, a.Count);
+            Assert.AreEqual(1, (int)a[0]);
+            Assert.AreEqual(2, (int)a[1]);
+            Assert.AreEqual(3, (int)a[2]);
+        }
+
+        [Test]
+        public void Parse_ExcessiveContent()
+        {
+            string json = @"[1,2,3]/*comment*/
+//Another comment.
+[]";
+
+            ExceptionAssert.Throws<JsonReaderException>(() => JArray.Parse(json),
+                "Additional text encountered after finished reading JSON content: [. Path '', line 3, position 0.");
+        }
+
         [Test]
         public void Parse_LineInfo()
         {

diff --git a/Src/Newtonsoft.Json.Tests/Linq/JObjectTests.cs b/Src/Newtonsoft.Json.Tests/Linq/JObjectTests.cs
@@ -1994,5 +1994,30 @@ public void Parse_NoComments()
             Assert.AreEqual(2, (int)o["prop"][1]);
             Assert.AreEqual(3, (int)o["prop"][2]);
         }
+
+        [Test]
+        public void Parse_ExcessiveContentJustComments()
+        {
+            string json = @"{'prop':[1,2,3]}/*comment*/
+//Another comment.";
+
+            JObject o = JObject.Parse(json);
+
+            Assert.AreEqual(3, o["prop"].Count());
+            Assert.AreEqual(1, (int)o["prop"][0]);
+            Assert.AreEqual(2, (int)o["prop"][1]);
+            Assert.AreEqual(3, (int)o["prop"][2]);
+        }
+
+        [Test]
+        public void Parse_ExcessiveContent()
+        {
+            string json = @"{'prop':[1,2,3]}/*comment*/
+//Another comment.
+[]";
+
+            ExceptionAssert.Throws<JsonReaderException>(() => JObject.Parse(json),
+                "Additional text encountered after finished reading JSON content: [. Path '', line 3, position 0.");
+        }
     }
 }
diff --git a/Src/Newtonsoft.Json.Tests/Linq/JTokenTests.cs b/Src/Newtonsoft.Json.Tests/Linq/JTokenTests.cs
@@ -1264,5 +1264,30 @@ public void Parse_NoComments()
             Assert.AreEqual(2, (int)o["prop"][1]);
             Assert.AreEqual(3, (int)o["prop"][2]);
         }
+
+        [Test]
+        public void Parse_ExcessiveContentJustComments()
+        {
+            string json = @"{'prop':[1,2,3]}/*comment*/
+//Another comment.";
+
+            JToken o = JToken.Parse(json);
+
+            Assert.AreEqual(3, o["prop"].Count());
+            Assert.AreEqual(1, (int)o["prop"][0]);
+            Assert.AreEqual(2, (int)o["prop"][1]);
+            Assert.AreEqual(3, (int)o["prop"][2]);
+        }
+
+        [Test]
+        public void Parse_ExcessiveContent()
+        {
+            string json = @"{'prop':[1,2,3]}/*comment*/
+//Another comment.
+{}";
+
+            ExceptionAssert.Throws<JsonReaderException>(() => JToken.Parse(json),
+                "Additional text encountered after finished reading JSON content: {. Path '', line 3, position 0.");
+        }
     }
 }
diff --git a/Src/Newtonsoft.Json.Tests/Serialization/JsonSerializerTest.cs b/Src/Newtonsoft.Json.Tests/Serialization/JsonSerializerTest.cs
@@ -8253,7 +8253,52 @@ public void AdditionalContentAfterFinish()
                 reader.Read();
 
                 serializer.Deserialize(reader, typeof(MyType));
-            }, "Additional text found in JSON string after finishing deserializing object.");
+            }, "Additional text found in JSON string after finishing deserializing object. Path '[1]', line 1, position 5.");
+        }
+
+        [Test]
+        public void AdditionalContentAfterFinishCheckNotRequested()
+        {
+            string json = @"{ ""MyProperty"":{""Key"":""Value""}} A bunch of junk at the end of the json";
+
+            JsonSerializer serializer = new JsonSerializer();
+
+            var reader = new JsonTextReader(new StringReader(json));
+
+            MyType mt = (MyType)serializer.Deserialize(reader, typeof(MyType));
+            Assert.AreEqual(1, mt.MyProperty.Count);
+        }
+
+        [Test]
+        public void AdditionalContentAfterCommentsCheckNotRequested()
+        {
+            string json = @"{ ""MyProperty"":{""Key"":""Value""}} /*this is a comment */
+// this is also a comment
+This is just junk, though.";
+
+            JsonSerializer serializer = new JsonSerializer();
+
+            var reader = new JsonTextReader(new StringReader(json));
+
+            MyType mt = (MyType)serializer.Deserialize(reader, typeof(MyType));
+            Assert.AreEqual(1, mt.MyProperty.Count);
+        }
+
+        [Test]
+        public void AdditionalContentAfterComments()
+        {
+            string json = @"[{ ""MyProperty"":{""Key"":""Value""}} /*this is a comment */
+// this is also a comment
+,{}";
+
+            JsonSerializer serializer = new JsonSerializer();
+            serializer.CheckAdditionalContent = true;
+            var reader = new JsonTextReader(new StringReader(json));
+            reader.Read();
+            reader.Read();
+
+            ExceptionAssert.Throws<JsonSerializationException>(() => serializer.Deserialize(reader, typeof(MyType)),
+                "Additional text found in JSON string after finishing deserializing object. Path '[1]', line 3, position 2.");
         }
 
         [Test]

diff --git a/Src/Newtonsoft.Json/JsonConvert.cs b/Src/Newtonsoft.Json/JsonConvert.cs
@@ -962,9 +962,15 @@ public static void PopulateObject(string value, object target, JsonSerializerSet
             {
                 jsonSerializer.Populate(jsonReader, target);
 
-                if (jsonReader.Read() && jsonReader.TokenType != JsonToken.Comment)
+                if (settings != null && settings.CheckAdditionalContent)
                 {
-                    throw new JsonSerializationException("Additional text found in JSON string after finishing deserializing object.");
+                    while (jsonReader.Read())
+                    {
+                        if (jsonReader.TokenType != JsonToken.Comment)
+                        {
+                            throw JsonSerializationException.Create(jsonReader, "Additional text found in JSON string after finishing deserializing object.");
+                        }
+                    }
                 }
             }
         }

diff --git a/Src/Newtonsoft.Json/Linq/JArray.cs b/Src/Newtonsoft.Json/Linq/JArray.cs
@@ -176,9 +176,9 @@ internal override JToken CloneToken()
             {
                 JArray a = Load(reader, settings);
 
-                if (reader.Read() && reader.TokenType != JsonToken.Comment)
+                while (reader.Read())
                 {
-                    throw JsonReaderException.Create(reader, "Additional text found in JSON string after parsing content.");
+                    // Any content encountered here other than a comment will throw in the reader.
                 }
 
                 return a;

diff --git a/Src/Newtonsoft.Json/Linq/JObject.cs b/Src/Newtonsoft.Json/Linq/JObject.cs
@@ -426,9 +426,9 @@ public JToken this[string propertyName]
             {
                 JObject o = Load(reader, settings);
 
-                if (reader.Read() && reader.TokenType != JsonToken.Comment)
+                while (reader.Read())
                 {
-                    throw JsonReaderException.Create(reader, "Additional text found in JSON string after parsing content.");
+                    // Any content encountered here other than a comment will throw in the reader.
                 }
 
                 return o;

diff --git a/Src/Newtonsoft.Json/Linq/JToken.cs b/Src/Newtonsoft.Json/Linq/JToken.cs
@@ -2187,11 +2187,12 @@ public static JToken Parse(string json, JsonLoadSettings settings)
             {
                 JToken t = Load(reader, settings);
 
-                if (reader.Read() && reader.TokenType != JsonToken.Comment)
+                while (reader.Read())
                 {
-                    throw JsonReaderException.Create(reader, "Additional text found in JSON string after parsing content.");
+                    // Any content encountered here other than a comment will throw in the reader.
                 }
 
+
                 return t;
             }
         }

diff --git a/Src/Newtonsoft.Json/Serialization/JsonSerializerInternalReader.cs b/Src/Newtonsoft.Json/Serialization/JsonSerializerInternalReader.cs
@@ -173,7 +173,7 @@ public object Deserialize(JsonReader reader, Type objectType, bool checkAddition
                     {
                         if (reader.TokenType != JsonToken.Comment)
                         {
-                            throw new JsonSerializationException("Additional text found in JSON string after finishing deserializing object.");
+                            throw JsonSerializationException.Create(reader, "Additional text found in JSON string after finishing deserializing object.");
                         }
                     }
                 }
-Original file line number
+Diff line change
@@ Expand Up @@
                         {
                             if (reader.TokenType != JsonToken.Comment)
                             {
-                                throw new JsonSerializationException("Additional text found in JSON string after finishing deserializing object.");
+                                throw JsonSerializationException.Create(reader, "Additional text found in JSON string after finishing deserializing object.");
                             }
                         }
                     }
@@ Expand Down @@