fix trailer for illegal inputs (alibaba#1023) (alibaba#1050)

Co-authored-by: Huiba Li <huiba.lhb@alibaba-inc.com>

Author: zhenjiaseu

ecosystem/simple_dom.cpp

@@ -254,15 +254,32 @@ struct JHandler : public BaseReaderHandler<UTF8<>, JHandler> {
 // As some parsers don't support text length, they only support null
 // terminated strings, so we have to convert the last trailer to '\0',
 // while making the parser to treat it as the trailer.
-inline void fix_trail(char* text, size_t size, char trailer) {
-    auto i = estring_view(text, size).rfind(trailer);
-    if (i != estring_view::npos) text[i] = '\0';
+static bool fix_trail(estring_view text, char header, char trailer) {
+    auto i = text.rfind(trailer);
+    if (i == estring_view::npos)
+        LOG_ERROR_RETURN(EINVAL, false, "no trailer found");
+    for (char c: text.substr(i+1))
+        if (!isspace(c))
+            LOG_ERROR_RETURN(EINVAL, false, "illegal character after trailer");
+    size_t k = 0;
+    for (char c: text.substr(0, i+1)) {
+        if (!c)
+            LOG_ERROR_RETURN(EINVAL, false, "unexpected '\\0'");
+        if (c == header) ++k;
+        else if (c == trailer)
+                if (k-- == 0) goto failed;
+    }
+    if (k != 0) failed:
+        LOG_ERROR_RETURN(EINVAL, false, "unbalanced header/trailer");
+    auto c = &text[i];
+    *(char*)c = '\0';
+    return true;
 }
 
 static NodeImpl* parse_json(char* text, size_t size, int flags) {
     const auto kFlags = kParseNumbersAsStringsFlag | kParseBoolsAsStringFlag |
              kParseInsituFlag | kParseCommentsFlag | kParseTrailingCommasFlag;
-    fix_trail(text, size, '}');
+    if (!fix_trail({text, size}, '{', '}')) return nullptr;
     JHandler h(text, flags & DOC_FREE_TEXT_ON_DESTRUCTION);
     using Encoding = UTF8<>;
     GenericInsituStringStream<Encoding> s(text);
@@ -311,7 +328,7 @@ class XMLNode : public DocNode<XMLNode> {
 };
 
 static NodeImpl* parse_xml(char* text, size_t size, int flags) {
-    fix_trail(text, size, '>');
+    if (!fix_trail({text, size}, '<', '>')) return nullptr;
     xml_document<char> doc;
     doc.parse<0>(text);
     auto root = make_unique<XMLNode>(text, flags & DOC_FREE_TEXT_ON_DESTRUCTION);

ecosystem/test/test_simple_dom.cpp

@@ -218,6 +218,21 @@ TEST(simple_dom, json) {
     expect_eq_vals(doc["a"], {"1", "2", "3", "4"});
 }
 
+TEST(simple_dom, fix_trail) {
+    static char s0[] = R"({"a":"b"}})";
+    static char s1[] = R"({"a":"b")";
+    static char s2[] = R"({"a":"b"} 	  )";
+    static char s3[] = "{\"a\":\0\"b\"}";
+    static std::pair<estring_view, bool> json[] = {
+        {s0, false}, {s1, false}, {s2, true},
+        {{s3, sizeof(s3) - 1}, false},
+    };
+    for (auto x: json) {
+        auto doc = parse((char*)x.first.data(), x.first.size(), DOC_JSON);
+        EXPECT_EQ(!!doc, x.second);
+    }
+}
+
 TEST(simple_dom, yaml0) {
     static char yaml0[] = "{foo: 1, bar: [2, 3], john: doe}";
     auto doc = parse(yaml0, sizeof(yaml0)-1, DOC_YAML);