[SLING-10342] The recursion selector value for the JsonRenderServlet should be limited to real numbers

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Servlets Get 2.1.40
• Fix Version/s: Servlets Get 2.1.42
• Component/s: Servlets
• Assignee: Karl Pauls
• Reporter: Karl Pauls
• Created: 29/Apr/21 14:43
• Updated: 07/Jul/21 11:43
• Resolved: 29/Apr/21 14:59

Description

The JsonRenderServlet recursion selector is supposed to be:

"-1" | "infinity" | [0-9]+

Following SLING-2324, a value > Integer.MAX_VALUE is considered to be "infinity".

However, we don't enforce that the value is not a negative number (besides the allowed "-1") nor do we prevent it from being a numeric which is not real numbers (i.e., not matching [0-9]+).

We should make sure we only accept: "-1" | "infinity" | [0-9]+

Issue Links

• Blocked: SLING-10591 Non latin characters can be used as recursion level in JsonRenderer
• is related to: SLING-10591 Non latin characters can be used as recursion level in JsonRenderer