Reject NaN with payload while parsing JSON

This commit drops support for parsing NaN with payload in JSON like
`NaN123` and fixes CVE-2024-53427. Other JSON extensions like `NaN` and
`Infinity` are still supported. Fixes #3023, fixes #3196, fixes #3246.
This commit is contained in:
itchyny committed 2025-03-05 07:43:54 +09:00
1 parent a8ce2ff09a
commit a09a4dfd55
3 files changed
+15 -11

No files matched your search

-7
View File
@@ -669,13 +669,6 @@ if ! x=$($JQ -cn "$(printf '[\r\n1,# comment\r\n2,# comment\\\r\ncomment\r\n3\r\
exit 1
fi
# CVE-2023-50268: No stack overflow comparing a nan with a large payload
if $JQ -ne 'have_decnum'; then
$VALGRIND $Q $JQ '1 != .' <<\EOF >/dev/null
Nan4000
EOF
fi
# Allow passing the inline jq script before -- #2919
if ! r=$($JQ --args -rn -- '$ARGS.positional[0]' bar) || [ "$r" != bar ]; then
echo "passing the inline script after -- didn't work"