From: Jacob Champion <jchampion@postgresql.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: oauth: Limit JSON parsing depth in the client
Date: Fri, 23 May 2025 20:09:25 +0000
Message-ID: <E1uIYho-000Saz-1w@gemulon.postgresql.org> (raw)
oauth: Limit JSON parsing depth in the client
Check the ctx->nested level as we go, to prevent a server from running
the client out of stack space.
The limit we choose when communicating with authorization servers can't
be overly strict, since those servers will continue to add extensions in
their JSON documents which we need to correctly ignore. For the SASL
communication, we can be more conservative, since there are no defined
extensions (and the peer is probably more Postgres code).
Reviewed-by: Aleksander Alekseev <aleksander@timescale.com>
Discussion: https://postgr.es/m/CAOYmi%2Bm71aRUEi0oQE9ciBnBS8xVtMn3CifaPu2kmJzUfhOZgA%40mail.gmail.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/cbc8fd0c9aec01f451af5e4eeb0eb2c5d5e47eb2
Modified Files
--------------
src/interfaces/libpq-oauth/oauth-curl.c | 26 ++++++++++++++++++
src/interfaces/libpq/fe-auth-oauth.c | 25 +++++++++++++++++
src/test/modules/oauth_validator/t/001_server.pl | 20 ++++++++++++++
src/test/modules/oauth_validator/t/oauth_server.py | 31 +++++++++++++++++-----
4 files changed, 96 insertions(+), 6 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: jchampion@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: oauth: Limit JSON parsing depth in the client
In-Reply-To: <E1uIYho-000Saz-1w@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox