@@ -206,6 +206,10 @@ instance HasResolution a => ToJSON (Fixed a) where
206 toJSON = Number . realToFrac
206 toJSON = Number . realToFrac
207 {-# INLINE toJSON #-}
207 {-# INLINE toJSON #-}
209+-- | /WARNING:/ Only parse fixed-precision numbers from trusted input
210+-- since an attacker could easily fill up the memory of the target
211+-- system by specifying a scientific number with a big exponent like
209instance HasResolution a => FromJSON (Fixed a) where
213instance HasResolution a => FromJSON (Fixed a) where
210 parseJSON = withScientific "Fixed" $ pure . realToFrac
214 parseJSON = withScientific "Fixed" $ pure . realToFrac
211 {-# INLINE parseJSON #-}
215 {-# INLINE parseJSON #-}