{"action":"created","issue":{"url":"https://api.github.com/repos/FasterXML/jackson-modules-java8/issues/90","repository_url":"https://api.github.com/repos/FasterXML/jackson-modules-java8","labels_url":"https://api.github.com/repos/FasterXML/jackson-modules-java8/issues/90/labels{/name}","comments_url":"https://api.github.com/repos/FasterXML/jackson-modules-java8/issues/90/comments","events_url":"https://api.github.com/repos/FasterXML/jackson-modules-java8/issues/90/events","html_url":"https://github.com/FasterXML/jackson-modules-java8/issues/90","id":373300249,"node_id":"MDU6SXNzdWUzNzMzMDAyNDk=","number":90,"title":"Performance issue with malicious `BigDecimal` input, `InstantDeserializer`, `DurationDeserializer`","user":{"login":"cowtowncoder","id":55065,"node_id":"MDQ6VXNlcjU1MDY1","avatar_url":"https://avatars0.githubusercontent.com/u/55065?v=4","gravatar_id":"","url":"https://api.github.com/users/cowtowncoder","html_url":"https://github.com/cowtowncoder","followers_url":"https://api.github.com/users/cowtowncoder/followers","following_url":"https://api.github.com/users/cowtowncoder/following{/other_user}","gists_url":"https://api.github.com/users/cowtowncoder/gists{/gist_id}","starred_url":"https://api.github.com/users/cowtowncoder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cowtowncoder/subscriptions","organizations_url":"https://api.github.com/users/cowtowncoder/orgs","repos_url":"https://api.github.com/users/cowtowncoder/repos","events_url":"https://api.github.com/users/cowtowncoder/events{/privacy}","received_events_url":"https://api.github.com/users/cowtowncoder/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/FasterXML/jackson-modules-java8/milestones/13","html_url":"https://github.com/FasterXML/jackson-modules-java8/milestone/13","labels_url":"https://api.github.com/repos/FasterXML/jackson-modules-java8/milestones/13/labels","id":3763821,"node_id":"MDk6TWlsZXN0b25lMzc2MzgyMQ==","number":13,"title":"2.9.8","description":null,"creator":{"login":"cowtowncoder","id":55065,"node_id":"MDQ6VXNlcjU1MDY1","avatar_url":"https://avatars0.githubusercontent.com/u/55065?v=4","gravatar_id":"","url":"https://api.github.com/users/cowtowncoder","html_url":"https://github.com/cowtowncoder","followers_url":"https://api.github.com/users/cowtowncoder/followers","following_url":"https://api.github.com/users/cowtowncoder/following{/other_user}","gists_url":"https://api.github.com/users/cowtowncoder/gists{/gist_id}","starred_url":"https://api.github.com/users/cowtowncoder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cowtowncoder/subscriptions","organizations_url":"https://api.github.com/users/cowtowncoder/orgs","repos_url":"https://api.github.com/users/cowtowncoder/repos","events_url":"https://api.github.com/users/cowtowncoder/events{/privacy}","received_events_url":"https://api.github.com/users/cowtowncoder/received_events","type":"User","site_admin":false},"open_issues":0,"closed_issues":1,"state":"open","created_at":"2018-10-24T04:35:47Z","updated_at":"2018-10-24T15:41:28Z","due_on":null,"closed_at":null},"comments":4,"created_at":"2018-10-24T04:28:13Z","updated_at":"2018-12-16T22:50:19Z","closed_at":"2018-10-24T15:41:27Z","author_association":"MEMBER","body":"(note: moved from https://github.com/FasterXML/jackson-databind/issues/2141 reported by @plokhotnyuk)\r\n\r\nIt looks the same as: https://github.com/playframework/play-json/issues/180\r\n\r\nReproduced by the following commit: https://github.com/plokhotnyuk/jsoniter-scala/pull/153/commits/0d53faf5093b492867b550f2cec55ff0b5cc62de\r\n\r\nThe security bug is in `InstantDeserializer` and `DurationDeserializer` of the `jackson-datatype-jsr310` artifact:\r\n```\r\n    protected T _fromDecimal(DeserializationContext context, BigDecimal value)\r\n    {\r\n        long seconds = value.longValue();   // <- hangs in case of 10000000e100000000 \r\n        int nanoseconds = DecimalUtils.extractNanosecondDecimal(value, seconds);\r\n        return fromNanoseconds.apply(new FromDecimalArguments(\r\n                seconds, nanoseconds, getZone(context)));\r\n    }\r\n```\r\n\r\nW/A is to use custom serializers for all types that are parsed with `InstantDeserializer` and `DurationDeserializer` by registering them after (or instead of) registration of the `JavaTimeModule` module.\r\n"},"comment":{"url":"https://api.github.com/repos/FasterXML/jackson-modules-java8/issues/comments/447684043","html_url":"https://github.com/FasterXML/jackson-modules-java8/issues/90#issuecomment-447684043","issue_url":"https://api.github.com/repos/FasterXML/jackson-modules-java8/issues/90","id":447684043,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NzY4NDA0Mw==","user":{"login":"ddillard","id":9905204,"node_id":"MDQ6VXNlcjk5MDUyMDQ=","avatar_url":"https://avatars1.githubusercontent.com/u/9905204?v=4","gravatar_id":"","url":"https://api.github.com/users/ddillard","html_url":"https://github.com/ddillard","followers_url":"https://api.github.com/users/ddillard/followers","following_url":"https://api.github.com/users/ddillard/following{/other_user}","gists_url":"https://api.github.com/users/ddillard/gists{/gist_id}","starred_url":"https://api.github.com/users/ddillard/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ddillard/subscriptions","organizations_url":"https://api.github.com/users/ddillard/orgs","repos_url":"https://api.github.com/users/ddillard/repos","events_url":"https://api.github.com/users/ddillard/events{/privacy}","received_events_url":"https://api.github.com/users/ddillard/received_events","type":"User","site_admin":false},"created_at":"2018-12-16T22:50:19Z","updated_at":"2018-12-16T22:50:19Z","author_association":"NONE","body":"@cowtowncoder Ok, I'll submit a request and post here when it's approved.  Usually takes a few weeks to get one and given the holidays I wouldn't be surprised if takes a bit longer."}}
{"actor":{"display_login":"ddillard"}}