Add trusted common JSON mapper

EaseCation · Sep 2, 2023 · c258290 · c258290
1 parent 7eca366
commit c258290
Show file tree

Hide file tree

Showing 8 changed files with 22 additions and 5 deletions.
diff --git a/pom.xml b/pom.xml
@@ -13,7 +13,7 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <junit.jupiter.version>5.10.0</junit.jupiter.version>
         <log4j2.version>2.20.0</log4j2.version>
-        <jackson.version>2.14.3</jackson.version>
+        <jackson.version>2.15.2</jackson.version>
         <jline.version>3.23.0</jline.version>
         <!-- 本地测试服务端插件目录 -->
         <dir.api>../../_api</dir.api>

diff --git a/src/main/java/cn/nukkit/block/Block.java b/src/main/java/cn/nukkit/block/Block.java
@@ -126,7 +126,7 @@ public static void init() {
 
         BlockEntry[] propertiesTable; // auto-generated
         try (InputStream stream = Server.class.getClassLoader().getResourceAsStream("block_properties_table.json")) {
-            propertiesTable = JsonUtil.COMMON_JSON_MAPPER.readValue(stream, BlockEntry[].class);
+            propertiesTable = JsonUtil.TRUSTED_JSON_MAPPER.readValue(stream, BlockEntry[].class);
         } catch (NullPointerException | IOException e) {
             throw new AssertionError("Unable to load block_properties_table.json", e);
         }

diff --git a/src/main/java/cn/nukkit/level/Level.java b/src/main/java/cn/nukkit/level/Level.java
@@ -3119,15 +3119,15 @@ public int getBiomeId(int x, int z) {
     }
 
     public void setBiomeId(int x, int z, int biomeId) {
-        this.getChunk(x >> 4, z >> 4, true).setBiomeId(x & 0x0f, z & 0x0f, biomeId & 0x0f);
+        this.getChunk(x >> 4, z >> 4, true).setBiomeId(x & 0x0f, z & 0x0f, biomeId);
     }
 
     public int getHeightMap(int x, int z) {
         return this.getChunk(x >> 4, z >> 4, true).getHeightMap(x & 0x0f, z & 0x0f);
     }
 
     private void setHeightMap(int x, int z, int value) {
-        this.getChunk(x >> 4, z >> 4, true).setHeightMap(x & 0x0f, z & 0x0f, value & 0x0f);
+        this.getChunk(x >> 4, z >> 4, true).setHeightMap(x & 0x0f, z & 0x0f, value);
     }
 
     public Map<Long, BaseFullChunk> getChunks() {

diff --git a/src/main/java/cn/nukkit/plugin/PluginBase.java b/src/main/java/cn/nukkit/plugin/PluginBase.java
@@ -239,6 +239,8 @@ public void reloadConfig() {
         if (configStream != null) {
             LoadSettings settings = LoadSettings.builder()
                     .setParseComments(false)
+                    .setMaxAliasesForCollections(Integer.MAX_VALUE)
+                    .setCodePointLimit(Integer.MAX_VALUE)
                     .build();
             Load yaml = new Load(settings);
             try {

diff --git a/src/main/java/cn/nukkit/plugin/PluginDescription.java b/src/main/java/cn/nukkit/plugin/PluginDescription.java
@@ -125,6 +125,8 @@ public PluginDescription(Map<String, Object> yamlMap) {
     public PluginDescription(String yamlString) {
         LoadSettings settings = LoadSettings.builder()
                 .setParseComments(false)
+                .setMaxAliasesForCollections(Integer.MAX_VALUE)
+                .setCodePointLimit(Integer.MAX_VALUE)
                 .build();
         Load yaml = new Load(settings);
         this.loadMap((Map<String, Object>) yaml.loadFromString(yamlString));

diff --git a/src/main/java/cn/nukkit/resourcepacks/PackManifest.java b/src/main/java/cn/nukkit/resourcepacks/PackManifest.java
@@ -29,7 +29,7 @@ public class PackManifest {
     private List<SubPack> subpacks = Collections.emptyList();
 
     public static PackManifest load(InputStream stream) throws IOException {
-        return JsonUtil.COMMON_JSON_MAPPER.readValue(stream, PackManifest.class);
+        return JsonUtil.TRUSTED_JSON_MAPPER.readValue(stream, PackManifest.class);
     }
 
     public boolean isValid() {

diff --git a/src/main/java/cn/nukkit/utils/Config.java b/src/main/java/cn/nukkit/utils/Config.java
@@ -560,6 +560,8 @@ private void parseContent(String content) {
             case Config.YAML:
                 LoadSettings settings = LoadSettings.builder()
                         .setParseComments(false)
+                        .setMaxAliasesForCollections(Integer.MAX_VALUE)
+                        .setCodePointLimit(Integer.MAX_VALUE)
                         .build();
                 Load yaml = new Load(settings);
                 this.config = new ConfigSection((LinkedHashMap<String, Object>) yaml.loadFromString(content));

diff --git a/src/main/java/cn/nukkit/utils/JsonUtil.java b/src/main/java/cn/nukkit/utils/JsonUtil.java
@@ -1,5 +1,6 @@
 package cn.nukkit.utils;
 
+import com.fasterxml.jackson.core.StreamReadConstraints;
 import com.fasterxml.jackson.core.json.JsonReadFeature;
 import com.fasterxml.jackson.databind.DeserializationFeature;
 import com.fasterxml.jackson.databind.json.JsonMapper;
@@ -13,4 +14,14 @@ public class JsonUtil {
             .addModule(new Jdk8Module())
             .addModule(new GuavaModule())
             .build();
+    public static final JsonMapper TRUSTED_JSON_MAPPER = COMMON_JSON_MAPPER.copy();
+
+    static {
+        TRUSTED_JSON_MAPPER.getFactory()
+                .setStreamReadConstraints(StreamReadConstraints.builder()
+                        .maxNestingDepth(Integer.MAX_VALUE)
+                        .maxNumberLength(Integer.MAX_VALUE)
+                        .maxStringLength(Integer.MAX_VALUE)
+                        .build());
+    }
 }