Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use 256-bit limitation for mantissa length when parsing floating point numbers #1302

Merged
merged 7 commits into from
Feb 11, 2025
+258 −198
Merged

Use 256-bit limitation for mantissa length when parsing floating point numbers #1302

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
b2c1577
More efficient parsing of floats and doubles
plokhotnyuk Feb 10, 2025
53bc002
Code clean up
plokhotnyuk Feb 10, 2025
b68cb41
More test coverage for `SafeNumbers.scala`
plokhotnyuk Feb 11, 2025
c844714
Use 256-bit limitation for mantissa length when parsing floating poin…
plokhotnyuk Feb 11, 2025
3f5dfe3
Use 256-bit limitation for mantissa length when parsing floating poin…
plokhotnyuk Feb 11, 2025
6f892d0
Clean up error messages when parsing big numbers
plokhotnyuk Feb 11, 2025
bedb22b
Add more assertions for parsing of big numbers
plokhotnyuk Feb 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,4 +94,4 @@ circe 4529 ( 7456) 2037 (1533)

This attack is very effective in schemas with lots of numbers, causing ops/sec to be halved with a 33% increase in memory usage.

`zio-json` is resistant to a wide range of number based attacks because it uses a from-scratch number parser that will exit early when the number of bits of any number exceeds 128 bits, which can be customized by the system property `zio.json.number.bits`.
`zio-json` is resistant to a wide range of number based attacks because it uses a from-scratch number parser that will exit early when the number of bits of any number exceeds 256 bits.
Loading
Loading