[CXF-8434] JsonMapObjectReaderWriter doesn't escape double quotes

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 3.4.1
• Component/s: JAX-RS
• Estimated Complexity: Unknown
• Assignee: Unassigned
• Reporter: Alonso Gonzalez
• Created: 08/Mar/21 18:18
• Updated: 08/Mar/21 18:50
• Resolved: 08/Mar/21 18:47

Description

JsonMapObjectReaderWriter doesn't escape double quotes when writing String values. The writer appends values using 'out.append(value.toString());' without any checks.

If the value of a JWT claim contains double quotes, it's possible to manipulate the serialized JSON. This is especially problematic if user supplied values are part of the JWT.

 

I've added an example program where the expiration of a token is set 5 minutes and a second claim named "additionalClaim" has the value: <<a","exp":9999999999,"b":"x>>

JsonMapObjectReaderWriter serializes this as:

{"exp":1615227615,"additionalClaim":"a","exp":9999999999,"b":"x"}

If the used JWT parser (like CXF itself) implements a "last key occurence wins" strategy. The expiration of the parsed JWT will be 9999999999.

 

 

Thus, if a 

Issue Links

• is duplicated by: CXF-8435 JsonMapObjectReaderWriter doesn't escape double quotes