Add stricter verifications while reading lists in Json Codec

Author: adwsingh

codecs/json-codec/src/main/java/software/amazon/smithy/java/json/jackson/JacksonJsonDeserializer.java

@@ -6,6 +6,7 @@
 package software.amazon.smithy.java.json.jackson;
 
 import static com.fasterxml.jackson.core.JsonToken.END_ARRAY;
+import static com.fasterxml.jackson.core.JsonToken.END_OBJECT;
 import static com.fasterxml.jackson.core.JsonToken.VALUE_NULL;
 
 import com.fasterxml.jackson.core.Base64Variants;
@@ -274,9 +275,19 @@ public <T> void readStruct(Schema schema, T state, StructMemberConsumer<T> struc
     @Override
     public <T> void readList(Schema schema, T state, ListMemberConsumer<T> listMemberConsumer) {
         try {
-            for (var token = parser.nextToken(); token != END_ARRAY; token = parser.nextToken()) {
+            if (!parser.isExpectedStartArrayToken()) {
+                throw new SerializationException("Expected a list, but found " + describeToken());
+            }
+            boolean notEoa;
+            for (
+                    var token = parser.nextToken();
+                    (notEoa = (token != END_ARRAY)) && token != END_OBJECT && token != null;
+                    token = parser.nextToken()) {
                 listMemberConsumer.accept(state, this);
             }
+            if (notEoa) {
+                throw new SerializationException("Expected end of list, but found " + describeToken());
+            }
         } catch (Exception e) {
             throw new SerializationException(e);
         }

codecs/json-codec/src/test/java/software/amazon/smithy/java/json/JsonDeserializerTest.java

@@ -223,6 +223,84 @@ public void deserializesList() {
         }
     }
 
+    @Test
+    public void deserializesEmptyList() {
+        try (var codec = JsonCodec.builder().build()) {
+            var de = codec.createDeserializer("[]".getBytes(StandardCharsets.UTF_8));
+            List<String> values = new ArrayList<>();
+
+            de.readList(PreludeSchemas.DOCUMENT, null, (ignore, listDe) -> {
+                values.add(listDe.readString(PreludeSchemas.STRING));
+            });
+
+            assertThat(values, hasSize(0));
+        }
+    }
+
+    @Test
+    public void throwsWhenReadListGetsObject() {
+        try (var codec = JsonCodec.builder().build()) {
+            var de = codec.createDeserializer("{\"foo\":\"bar\"}".getBytes(StandardCharsets.UTF_8));
+            List<String> values = new ArrayList<>();
+
+            var e = Assertions.assertThrows(SerializationException.class, () -> {
+                de.readList(PreludeSchemas.DOCUMENT, values, (list, listDe) -> {
+                    list.add(listDe.readString(PreludeSchemas.STRING));
+                });
+            });
+
+            assertThat(e.getMessage(), equalTo("Expected a list, but found Object value"));
+        }
+    }
+
+    @Test
+    public void throwsWhenReadListGetsString() {
+        try (var codec = JsonCodec.builder().build()) {
+            var de = codec.createDeserializer("\"not a list\"".getBytes(StandardCharsets.UTF_8));
+            List<String> values = new ArrayList<>();
+
+            var e = Assertions.assertThrows(SerializationException.class, () -> {
+                de.readList(PreludeSchemas.DOCUMENT, values, (list, listDe) -> {
+                    list.add(listDe.readString(PreludeSchemas.STRING));
+                });
+            });
+
+            assertThat(e.getMessage(), equalTo("Expected a list, but found String value"));
+        }
+    }
+
+    @Test
+    public void throwsWhenReadListGetsEmptyObject() {
+        try (var codec = JsonCodec.builder().build()) {
+            var de = codec.createDeserializer("{}".getBytes(StandardCharsets.UTF_8));
+            List<String> values = new ArrayList<>();
+
+            var e = Assertions.assertThrows(SerializationException.class, () -> {
+                de.readList(PreludeSchemas.DOCUMENT, values, (list, listDe) -> {
+                    list.add(listDe.readString(PreludeSchemas.STRING));
+                });
+            });
+
+            assertThat(e.getMessage(), equalTo("Expected a list, but found Object value"));
+        }
+    }
+
+    @Test
+    public void throwsOnUnfinishedList() {
+        try (var codec = JsonCodec.builder().build()) {
+            var de = codec.createDeserializer("[{}".getBytes(StandardCharsets.UTF_8));
+            List<String> values = new ArrayList<>();
+
+            var e = Assertions.assertThrows(SerializationException.class, () -> {
+                de.readList(PreludeSchemas.DOCUMENT, values, (list, listDe) -> {
+                    list.add(listDe.readString(PreludeSchemas.STRING));
+                });
+            });
+
+            assertThat(e.getMessage(), equalTo("Expected end of list, but found Object value"));
+        }
+    }
+
     @Test
     public void deserializesMap() {
         try (var codec = JsonCodec.builder().build()) {