[MESOS-3698] JSON parsing allows non-whitespace trailing characters

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.26.0
• Labels: mesosphere
• Sprint: Mesosphere Sprint 21
• Story Points: 1
• Assignee: Greg Mann
• Reporter: Greg Mann
• Shepherd: Adam B
• Created: 11/Oct/15 01:55
• Updated: 26/Nov/18 12:20
• Resolved: 26/Nov/18 12:20

Description

Picojson supports a streaming mode in which a stream containing a series of JSON values can be repeatedly parsed. For this reason, it does not return an error when passed a string containing a valid JSON value followed by non-whitespace trailing characters.

However, in addition to the four-argument picojson::parse() that we're using, picojson contains a two-argument parse() function (https://github.com/kazuho/picojson/blob/master/picojson.h#L938-L942) which accepts a std::string and should probably validate its input to ensure it doesn't contain trailing characters. A pull request has been filed for this change at https://github.com/kazuho/picojson/pull/70 and if it's merged, we can switch to the two-argument function call. In the meantime, we should provide such input validation ourselves in JSON::parse().

Issue Links

• is related to: MESOS-2467 Allow --resources flag to take JSON.