{"action":"created","comment":{"url":"https://api.github.com/repos/dropwizard/dropwizard/pulls/comments/221473529","pull_request_review_id":160128671,"id":221473529,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIyMTQ3MzUyOQ==","diff_hunk":"@@ -0,0 +1,123 @@\n+/*\n+ * Copyright 2013 FasterXML.com\n+ *\n+ * Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n+ * not use this file except in compliance with the License. You may obtain\n+ * a copy of the License at\n+ *\n+ *     http://www.apache.org/licenses/LICENSE-2.0\n+ *\n+ * Unless required by applicable law or agreed to in writing, software\n+ * distributed under the License is distributed on an \"AS IS\" BASIS,\n+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n+ * See the license for the specific language governing permissions and\n+ * limitations under the license.\n+ */\n+package io.dropwizard.jackson;\n+\n+import com.fasterxml.jackson.core.JsonParser;\n+import com.fasterxml.jackson.core.JsonToken;\n+import com.fasterxml.jackson.core.JsonTokenId;\n+import com.fasterxml.jackson.databind.DeserializationContext;\n+import com.fasterxml.jackson.databind.DeserializationFeature;\n+import com.fasterxml.jackson.databind.JsonMappingException;\n+import com.fasterxml.jackson.databind.deser.std.StdScalarDeserializer;\n+import com.fasterxml.jackson.datatype.jsr310.DecimalUtils;\n+\n+import javax.annotation.Nullable;\n+import java.io.IOException;\n+import java.math.BigDecimal;\n+import java.time.DateTimeException;\n+import java.time.Duration;\n+import java.util.Arrays;\n+\n+/**\n+ * This class is taken from the jackson-jsr310 module and modified to reject big decimal\n+ * values. Unfortunatelly, `DurationDeserializer` has a private constructor and\n+ * can't be extended, so we have to copy.\n+ */\n+public class SafeDurationDeserializer extends StdScalarDeserializer<Duration> {","path":"dropwizard-jackson/src/main/java/io/dropwizard/jackson/SafeDurationDeserializer.java","position":19,"original_position":39,"commit_id":"8fb0e7f91f6b30469f932ab68410dfbb67c7f7b7","original_commit_id":"bf687d9a32e82e5c84f58b4648af8bb1d76956da","user":{"login":"arteam","id":1717632,"node_id":"MDQ6VXNlcjE3MTc2MzI=","avatar_url":"https://avatars0.githubusercontent.com/u/1717632?v=4","gravatar_id":"","url":"https://api.github.com/users/arteam","html_url":"https://github.com/arteam","followers_url":"https://api.github.com/users/arteam/followers","following_url":"https://api.github.com/users/arteam/following{/other_user}","gists_url":"https://api.github.com/users/arteam/gists{/gist_id}","starred_url":"https://api.github.com/users/arteam/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arteam/subscriptions","organizations_url":"https://api.github.com/users/arteam/orgs","repos_url":"https://api.github.com/users/arteam/repos","events_url":"https://api.github.com/users/arteam/events{/privacy}","received_events_url":"https://api.github.com/users/arteam/received_events","type":"User","site_admin":false},"body":"I haven't, but that makes a hell of a lot sense to me. I had presumed `DurationDeserializer.INSTANCE` is package protected.","created_at":"2018-09-30T21:08:08Z","updated_at":"2018-09-30T21:08:09Z","html_url":"https://github.com/dropwizard/dropwizard/pull/2511#discussion_r221473529","pull_request_url":"https://api.github.com/repos/dropwizard/dropwizard/pulls/2511","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/dropwizard/dropwizard/pulls/comments/221473529"},"html":{"href":"https://github.com/dropwizard/dropwizard/pull/2511#discussion_r221473529"},"pull_request":{"href":"https://api.github.com/repos/dropwizard/dropwizard/pulls/2511"}},"in_reply_to_id":221473129},"pull_request":{"url":"https://api.github.com/repos/dropwizard/dropwizard/pulls/2511","id":219217098,"node_id":"MDExOlB1bGxSZXF1ZXN0MjE5MjE3MDk4","html_url":"https://github.com/dropwizard/dropwizard/pull/2511","diff_url":"https://github.com/dropwizard/dropwizard/pull/2511.diff","patch_url":"https://github.com/dropwizard/dropwizard/pull/2511.patch","issue_url":"https://api.github.com/repos/dropwizard/dropwizard/issues/2511","number":2511,"state":"open","locked":false,"title":"Add safe Jackson deserializers to prevent a DoS attack","user":{"login":"arteam","id":1717632,"node_id":"MDQ6VXNlcjE3MTc2MzI=","avatar_url":"https://avatars0.githubusercontent.com/u/1717632?v=4","gravatar_id":"","url":"https://api.github.com/users/arteam","html_url":"https://github.com/arteam","followers_url":"https://api.github.com/users/arteam/followers","following_url":"https://api.github.com/users/arteam/following{/other_user}","gists_url":"https://api.github.com/users/arteam/gists{/gist_id}","starred_url":"https://api.github.com/users/arteam/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arteam/subscriptions","organizations_url":"https://api.github.com/users/arteam/orgs","repos_url":"https://api.github.com/users/arteam/repos","events_url":"https://api.github.com/users/arteam/events{/privacy}","received_events_url":"https://api.github.com/users/arteam/received_events","type":"User","site_admin":false},"body":"Jackson uses `BigDecimal` for deserialization of `java.time` instants and durations. The problem is that if the users sets a very big number in the scientific notation (like `1e1000000000`), it takes forever to convert `BigDecimal` to `BigInteger`, and then to convert it to a long value. An example of the stack trace:\r\n\r\n```java\r\n@Test(timeout = 2000)\r\npublic void parseBigDecimal(){\r\n    new BigDecimal(\"1e1000000000\").longValue();\r\n}\r\n\r\norg.junit.runners.model.TestTimedOutException: test timed out after 2000 milliseconds\r\n\tat java.math.BigInteger.squareToomCook3(BigInteger.java:2074)\r\n\tat java.math.BigInteger.square(BigInteger.java:1899)\r\n\tat java.math.BigInteger.squareToomCook3(BigInteger.java:2053)\r\n\tat java.math.BigInteger.square(BigInteger.java:1899)\r\n\tat java.math.BigInteger.squareToomCook3(BigInteger.java:2051)\r\n\tat java.math.BigInteger.square(BigInteger.java:1899)\r\n\tat java.math.BigInteger.squareToomCook3(BigInteger.java:2049)\r\n\tat java.math.BigInteger.square(BigInteger.java:1899)\r\n\tat java.math.BigInteger.squareToomCook3(BigInteger.java:2049)\r\n\tat java.math.BigInteger.square(BigInteger.java:1899)\r\n\tat java.math.BigInteger.squareToomCook3(BigInteger.java:2055)\r\n\tat java.math.BigInteger.square(BigInteger.java:1899)\r\n\tat java.math.BigInteger.squareToomCook3(BigInteger.java:2049)\r\n\tat java.math.BigInteger.square(BigInteger.java:1899)\r\n\tat java.math.BigInteger.pow(BigInteger.java:2306)\r\n\tat java.math.BigDecimal.bigTenToThe(BigDecimal.java:3543)\r\n\tat java.math.BigDecimal.bigMultiplyPowerTen(BigDecimal.java:3676)\r\n\tat java.math.BigDecimal.setScale(BigDecimal.java:2445)\r\n\tat java.math.BigDecimal.toBigInteger(BigDecimal.java:3025)\r\n```\r\n\r\nA fix would be to reject big decimal values outside of the Instant and Duration ranges.\r\n\r\nSee:\r\n[1] https://github.com/FasterXML/jackson-databind/issues/2141\r\n[2] https://reddit.com/r/java/comments/9jyv58/lowbandwidth_dos_vulnerability_in_jacksons/","created_at":"2018-09-30T17:45:23Z","updated_at":"2018-09-30T21:08:09Z","closed_at":null,"merged_at":null,"merge_commit_sha":"07a9ba1dc82adebfe49cdb830ef906ad572ef212","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":236695,"node_id":"MDU6TGFiZWwyMzY2OTU=","url":"https://api.github.com/repos/dropwizard/dropwizard/labels/bug","name":"bug","color":"e10c02","default":true},{"id":145625143,"node_id":"MDU6TGFiZWwxNDU2MjUxNDM=","url":"https://api.github.com/repos/dropwizard/dropwizard/labels/security","name":"security","color":"5319e7","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/dropwizard/dropwizard/pulls/2511/commits","review_comments_url":"https://api.github.com/repos/dropwizard/dropwizard/pulls/2511/comments","review_comment_url":"https://api.github.com/repos/dropwizard/dropwizard/pulls/comments{/number}","comments_url":"https://api.github.com/repos/dropwizard/dropwizard/issues/2511/comments","statuses_url":"https://api.github.com/repos/dropwizard/dropwizard/statuses/8fb0e7f91f6b30469f932ab68410dfbb67c7f7b7","head":{"label":"dropwizard:safe-jackson-deserializer","ref":"safe-jackson-deserializer","sha":"8fb0e7f91f6b30469f932ab68410dfbb67c7f7b7","user":{"login":"dropwizard","id":5478557,"node_id":"MDEyOk9yZ2FuaXphdGlvbjU0Nzg1NTc=","avatar_url":"https://avatars3.githubusercontent.com/u/5478557?v=4","gravatar_id":"","url":"https://api.github.com/users/dropwizard","html_url":"https://github.com/dropwizard","followers_url":"https://api.github.com/users/dropwizard/followers","following_url":"https://api.github.com/users/dropwizard/following{/other_user}","gists_url":"https://api.github.com/users/dropwizard/gists{/gist_id}","starred_url":"https://api.github.com/users/dropwizard/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dropwizard/subscriptions","organizations_url":"https://api.github.com/users/dropwizard/orgs","repos_url":"https://api.github.com/users/dropwizard/repos","events_url":"https://api.github.com/users/dropwizard/events{/privacy}","received_events_url":"https://api.github.com/users/dropwizard/received_events","type":"Organization","site_admin":false},"repo":{"id":1272129,"node_id":"MDEwOlJlcG9zaXRvcnkxMjcyMTI5","name":"dropwizard","full_name":"dropwizard/dropwizard","private":false,"owner":{"login":"dropwizard","id":5478557,"node_id":"MDEyOk9yZ2FuaXphdGlvbjU0Nzg1NTc=","avatar_url":"https://avatars3.githubusercontent.com/u/5478557?v=4","gravatar_id":"","url":"https://api.github.com/users/dropwizard","html_url":"https://github.com/dropwizard","followers_url":"https://api.github.com/users/dropwizard/followers","following_url":"https://api.github.com/users/dropwizard/following{/other_user}","gists_url":"https://api.github.com/users/dropwizard/gists{/gist_id}","starred_url":"https://api.github.com/users/dropwizard/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dropwizard/subscriptions","organizations_url":"https://api.github.com/users/dropwizard/orgs","repos_url":"https://api.github.com/users/dropwizard/repos","events_url":"https://api.github.com/users/dropwizard/events{/privacy}","received_events_url":"https://api.github.com/users/dropwizard/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/dropwizard/dropwizard","description":"A damn simple library for building production-ready RESTful web services.","fork":false,"url":"https://api.github.com/repos/dropwizard/dropwizard","forks_url":"https://api.github.com/repos/dropwizard/dropwizard/forks","keys_url":"https://api.github.com/repos/dropwizard/dropwizard/keys{/key_id}","collaborators_url":"https://api.github.com/repos/dropwizard/dropwizard/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/dropwizard/dropwizard/teams","hooks_url":"https://api.github.com/repos/dropwizard/dropwizard/hooks","issue_events_url":"https://api.github.com/repos/dropwizard/dropwizard/issues/events{/number}","events_url":"https://api.github.com/repos/dropwizard/dropwizard/events","assignees_url":"https://api.github.com/repos/dropwizard/dropwizard/assignees{/user}","branches_url":"https://api.github.com/repos/dropwizard/dropwizard/branches{/branch}","tags_url":"https://api.github.com/repos/dropwizard/dropwizard/tags","blobs_url":"https://api.github.com/repos/dropwizard/dropwizard/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/dropwizard/dropwizard/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/dropwizard/dropwizard/git/refs{/sha}","trees_url":"https://api.github.com/repos/dropwizard/dropwizard/git/trees{/sha}","statuses_url":"https://api.github.com/repos/dropwizard/dropwizard/statuses/{sha}","languages_url":"https://api.github.com/repos/dropwizard/dropwizard/languages","stargazers_url":"https://api.github.com/repos/dropwizard/dropwizard/stargazers","contributors_url":"https://api.github.com/repos/dropwizard/dropwizard/contributors","subscribers_url":"https://api.github.com/repos/dropwizard/dropwizard/subscribers","subscription_url":"https://api.github.com/repos/dropwizard/dropwizard/subscription","commits_url":"https://api.github.com/repos/dropwizard/dropwizard/commits{/sha}","git_commits_url":"https://api.github.com/repos/dropwizard/dropwizard/git/commits{/sha}","comments_url":"https://api.github.com/repos/dropwizard/dropwizard/comments{/number}","issue_comment_url":"https://api.github.com/repos/dropwizard/dropwizard/issues/comments{/number}","contents_url":"https://api.github.com/repos/dropwizard/dropwizard/contents/{+path}","compare_url":"https://api.github.com/repos/dropwizard/dropwizard/compare/{base}...{head}","merges_url":"https://api.github.com/repos/dropwizard/dropwizard/merges","archive_url":"https://api.github.com/repos/dropwizard/dropwizard/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/dropwizard/dropwizard/downloads","issues_url":"https://api.github.com/repos/dropwizard/dropwizard/issues{/number}","pulls_url":"https://api.github.com/repos/dropwizard/dropwizard/pulls{/number}","milestones_url":"https://api.github.com/repos/dropwizard/dropwizard/milestones{/number}","notifications_url":"https://api.github.com/repos/dropwizard/dropwizard/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/dropwizard/dropwizard/labels{/name}","releases_url":"https://api.github.com/repos/dropwizard/dropwizard/releases{/id}","deployments_url":"https://api.github.com/repos/dropwizard/dropwizard/deployments","created_at":"2011-01-19T19:52:29Z","updated_at":"2018-09-30T09:16:15Z","pushed_at":"2018-09-30T21:05:58Z","git_url":"git://github.com/dropwizard/dropwizard.git","ssh_url":"git@github.com:dropwizard/dropwizard.git","clone_url":"https://github.com/dropwizard/dropwizard.git","svn_url":"https://github.com/dropwizard/dropwizard","homepage":"https://www.dropwizard.io","size":73662,"stargazers_count":6833,"watchers_count":6833,"language":"Java","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":2919,"mirror_url":null,"archived":false,"open_issues_count":105,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":2919,"open_issues":105,"watchers":6833,"default_branch":"master"}},"base":{"label":"dropwizard:release/1.3.x","ref":"release/1.3.x","sha":"8781a3168c017022d512ab0a46363554e6fa257d","user":{"login":"dropwizard","id":5478557,"node_id":"MDEyOk9yZ2FuaXphdGlvbjU0Nzg1NTc=","avatar_url":"https://avatars3.githubusercontent.com/u/5478557?v=4","gravatar_id":"","url":"https://api.github.com/users/dropwizard","html_url":"https://github.com/dropwizard","followers_url":"https://api.github.com/users/dropwizard/followers","following_url":"https://api.github.com/users/dropwizard/following{/other_user}","gists_url":"https://api.github.com/users/dropwizard/gists{/gist_id}","starred_url":"https://api.github.com/users/dropwizard/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dropwizard/subscriptions","organizations_url":"https://api.github.com/users/dropwizard/orgs","repos_url":"https://api.github.com/users/dropwizard/repos","events_url":"https://api.github.com/users/dropwizard/events{/privacy}","received_events_url":"https://api.github.com/users/dropwizard/received_events","type":"Organization","site_admin":false},"repo":{"id":1272129,"node_id":"MDEwOlJlcG9zaXRvcnkxMjcyMTI5","name":"dropwizard","full_name":"dropwizard/dropwizard","private":false,"owner":{"login":"dropwizard","id":5478557,"node_id":"MDEyOk9yZ2FuaXphdGlvbjU0Nzg1NTc=","avatar_url":"https://avatars3.githubusercontent.com/u/5478557?v=4","gravatar_id":"","url":"https://api.github.com/users/dropwizard","html_url":"https://github.com/dropwizard","followers_url":"https://api.github.com/users/dropwizard/followers","following_url":"https://api.github.com/users/dropwizard/following{/other_user}","gists_url":"https://api.github.com/users/dropwizard/gists{/gist_id}","starred_url":"https://api.github.com/users/dropwizard/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dropwizard/subscriptions","organizations_url":"https://api.github.com/users/dropwizard/orgs","repos_url":"https://api.github.com/users/dropwizard/repos","events_url":"https://api.github.com/users/dropwizard/events{/privacy}","received_events_url":"https://api.github.com/users/dropwizard/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/dropwizard/dropwizard","description":"A damn simple library for building production-ready RESTful web services.","fork":false,"url":"https://api.github.com/repos/dropwizard/dropwizard","forks_url":"https://api.github.com/repos/dropwizard/dropwizard/forks","keys_url":"https://api.github.com/repos/dropwizard/dropwizard/keys{/key_id}","collaborators_url":"https://api.github.com/repos/dropwizard/dropwizard/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/dropwizard/dropwizard/teams","hooks_url":"https://api.github.com/repos/dropwizard/dropwizard/hooks","issue_events_url":"https://api.github.com/repos/dropwizard/dropwizard/issues/events{/number}","events_url":"https://api.github.com/repos/dropwizard/dropwizard/events","assignees_url":"https://api.github.com/repos/dropwizard/dropwizard/assignees{/user}","branches_url":"https://api.github.com/repos/dropwizard/dropwizard/branches{/branch}","tags_url":"https://api.github.com/repos/dropwizard/dropwizard/tags","blobs_url":"https://api.github.com/repos/dropwizard/dropwizard/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/dropwizard/dropwizard/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/dropwizard/dropwizard/git/refs{/sha}","trees_url":"https://api.github.com/repos/dropwizard/dropwizard/git/trees{/sha}","statuses_url":"https://api.github.com/repos/dropwizard/dropwizard/statuses/{sha}","languages_url":"https://api.github.com/repos/dropwizard/dropwizard/languages","stargazers_url":"https://api.github.com/repos/dropwizard/dropwizard/stargazers","contributors_url":"https://api.github.com/repos/dropwizard/dropwizard/contributors","subscribers_url":"https://api.github.com/repos/dropwizard/dropwizard/subscribers","subscription_url":"https://api.github.com/repos/dropwizard/dropwizard/subscription","commits_url":"https://api.github.com/repos/dropwizard/dropwizard/commits{/sha}","git_commits_url":"https://api.github.com/repos/dropwizard/dropwizard/git/commits{/sha}","comments_url":"https://api.github.com/repos/dropwizard/dropwizard/comments{/number}","issue_comment_url":"https://api.github.com/repos/dropwizard/dropwizard/issues/comments{/number}","contents_url":"https://api.github.com/repos/dropwizard/dropwizard/contents/{+path}","compare_url":"https://api.github.com/repos/dropwizard/dropwizard/compare/{base}...{head}","merges_url":"https://api.github.com/repos/dropwizard/dropwizard/merges","archive_url":"https://api.github.com/repos/dropwizard/dropwizard/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/dropwizard/dropwizard/downloads","issues_url":"https://api.github.com/repos/dropwizard/dropwizard/issues{/number}","pulls_url":"https://api.github.com/repos/dropwizard/dropwizard/pulls{/number}","milestones_url":"https://api.github.com/repos/dropwizard/dropwizard/milestones{/number}","notifications_url":"https://api.github.com/repos/dropwizard/dropwizard/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/dropwizard/dropwizard/labels{/name}","releases_url":"https://api.github.com/repos/dropwizard/dropwizard/releases{/id}","deployments_url":"https://api.github.com/repos/dropwizard/dropwizard/deployments","created_at":"2011-01-19T19:52:29Z","updated_at":"2018-09-30T09:16:15Z","pushed_at":"2018-09-30T21:05:58Z","git_url":"git://github.com/dropwizard/dropwizard.git","ssh_url":"git@github.com:dropwizard/dropwizard.git","clone_url":"https://github.com/dropwizard/dropwizard.git","svn_url":"https://github.com/dropwizard/dropwizard","homepage":"https://www.dropwizard.io","size":73662,"stargazers_count":6833,"watchers_count":6833,"language":"Java","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":2919,"mirror_url":null,"archived":false,"open_issues_count":105,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":2919,"open_issues":105,"watchers":6833,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/dropwizard/dropwizard/pulls/2511"},"html":{"href":"https://github.com/dropwizard/dropwizard/pull/2511"},"issue":{"href":"https://api.github.com/repos/dropwizard/dropwizard/issues/2511"},"comments":{"href":"https://api.github.com/repos/dropwizard/dropwizard/issues/2511/comments"},"review_comments":{"href":"https://api.github.com/repos/dropwizard/dropwizard/pulls/2511/comments"},"review_comment":{"href":"https://api.github.com/repos/dropwizard/dropwizard/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/dropwizard/dropwizard/pulls/2511/commits"},"statuses":{"href":"https://api.github.com/repos/dropwizard/dropwizard/statuses/8fb0e7f91f6b30469f932ab68410dfbb67c7f7b7"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"arteam"}}