git.iko.soy/typeable/aeson
on master help sign in
Avoid (10 ^ e) on fromScientific

On [1], @basvandijk noted that fromScientific used 10 ^ e. This operation could lead to a DOS due to a large exponent. This commit changes the implementation to always use formatScientificBuilder, even when base10Exponent s >= 0. The code from the scientific package already takes care when pretty printing huge numbers. Note that using just scientificBuilder wouldn't be enough since we'd change the formatting of large integers to that of a large Double. This commit does not change the output format at all, and all tests are green. [1] https://github.com/bos/aeson/issues/246#issuecomment-93599848

commitbd8eeacc0655615120143fd5bb789c9ef1ffa10f authorFelipe Lessa <felipe.lessa@gmail.com> dateWed 29 Apr 2015, 14:16 (11 years ago) parentfc09fa6
1 file changed+6−7
compare with master
unifiedsplit
Data/Aeson/Encode.hs+6−7
Data/Aeson/Encode.hs+6−7
@@ -29,10 +29,9 @@ module Data.Aeson.Encode
2929
3030import Data.Aeson.Types (Value(..))
3131import Data.Monoid (mappend)
32−import Data.Scientific (Scientific, coefficient, base10Exponent)
32+import Data.Scientific (FPFormat(..), Scientific, base10Exponent)
3333import Data.Text.Lazy.Builder
34−import Data.Text.Lazy.Builder.Int (decimal)
35−import Data.Text.Lazy.Builder.Scientific (scientificBuilder)
34+import Data.Text.Lazy.Builder.Scientific (formatScientificBuilder)
3635import Numeric (showHex)
3736import qualified Data.HashMap.Strict as H
3837import qualified Data.Text as T
@@ -97,11 +96,11 @@ string s = {-# SCC "string" #-} singleton '"' <> quote s <> singleton '"'
9796 where h = showHex (fromEnum c) ""
9897
9998fromScientific :: Scientific -> Builder
100−fromScientific s
101− | e < 0 = scientificBuilder s
102− | otherwise = decimal (coefficient s * 10 ^ e)
99+fromScientific s = formatScientificBuilder format prec s
103100 where
104− e = base10Exponent s
101+ (format, prec)
102+ | base10Exponent s < 0 = (Generic, Nothing)
103+ | otherwise = (Fixed, Just 0)
105104
106105(<>) :: Builder -> Builder -> Builder
107106(<>) = mappend