Security fix for create_additions problem 1.6.8

CHANGES

@@ -1,3 +1,8 @@
+2013-02-04 (1.6.8)
+  * Security fix for JSON create_additions default value. It should not be
+    possible to create additions unless
+    explicitely requested by setting the create_additions argument to true or
+    using the JSON.load/dump interface.
 2012-04-27 (1.6.7)
   * Fix possible crash when trying to parse nil value.
 2012-02-11 (1.6.6)

Gemfile

@@ -6,10 +6,6 @@ gemspec :name => 'json'
 gemspec :name => 'json_pure'
 gemspec :name => 'json-java'
 
-group :development, :test do
-  gem 'simplecov', :platform => :mri_19
-end
-
-group :test do
-  gem 'test-unit', '2.4.7', :platform => :mri_19
-end
+gem 'utils'
+gem 'test-unit'
+gem 'debugger', :platform => :mri_19

VERSION

@@ -1 +1 @@
-1.6.7
+1.6.8

ext/json/ext/parser/parser.c

@@ -1680,7 +1680,7 @@ static VALUE cParser_initialize(int argc, VALUE *argv, VALUE self)
             if (option_given_p(opts, tmp)) {
                 json->create_additions = RTEST(rb_hash_aref(opts, tmp));
             } else {
-                json->create_additions = 1;
+                json->create_additions = 0;
             }
             tmp = ID2SYM(i_create_id);
             if (option_given_p(opts, tmp)) {

ext/json/ext/parser/parser.rl

@@ -664,7 +664,7 @@ static VALUE cParser_initialize(int argc, VALUE *argv, VALUE self)
             if (option_given_p(opts, tmp)) {
                 json->create_additions = RTEST(rb_hash_aref(opts, tmp));
             } else {
-                json->create_additions = 1;
+                json->create_additions = 0;
             }
             tmp = ID2SYM(i_create_id);
             if (option_given_p(opts, tmp)) {

java/src/json/ext/Parser.java

@@ -166,7 +166,7 @@ public IRubyObject initialize(ThreadContext context, IRubyObject[] args) {
         this.symbolizeNames  = opts.getBool("symbolize_names", false);
         this.quirksMode      = opts.getBool("quirks_mode", false);
         this.createId        = opts.getString("create_id", getCreateId(context));
-        this.createAdditions = opts.getBool("create_additions", true);
+        this.createAdditions = opts.getBool("create_additions", false);
         this.objectClass     = opts.getClass("object_class", runtime.getHash());
         this.arrayClass      = opts.getClass("array_class", runtime.getArray());
         this.match_string    = opts.getHash("match_string");
@@ -1617,14 +1617,14 @@ void parseArray(ParserResult res, int p, int pe) {
             }
 
 
-// line 1623 "Parser.java"
+// line 1621 "Parser.java"
 	{
 	cs = JSON_array_start;
 	}
 
-// line 714 "Parser.rl"
+// line 712 "Parser.rl"
 
-// line 1630 "Parser.java"
+// line 1628 "Parser.java"
 	{
 	int _klen;
 	int _trans = 0;
@@ -1728,7 +1728,7 @@ else if ( data[p] > _JSON_array_trans_keys[_mid+1] )
                 { p += 1; _goto_targ = 5; if (true)  continue _goto;}
             }
 	break;
-// line 1734 "Parser.java"
+// line 1732 "Parser.java"
 			}
 		}
 	}
@@ -1748,7 +1748,7 @@ else if ( data[p] > _JSON_array_trans_keys[_mid+1] )
 	break; }
 	}
 
-// line 715 "Parser.rl"
+// line 713 "Parser.rl"
 
             if (cs >= JSON_array_first_final) {
                 res.update(result, p + 1);
@@ -1758,7 +1758,7 @@ else if ( data[p] > _JSON_array_trans_keys[_mid+1] )
         }
 
 
-// line 1764 "Parser.java"
+// line 1762 "Parser.java"
 private static byte[] init__JSON_object_actions_0()
 {
 	return new byte [] {
@@ -1881,7 +1881,7 @@ private static byte[] init__JSON_object_trans_actions_0()
 static final int JSON_object_en_main = 1;
 
 
-// line 774 "Parser.rl"
+// line 772 "Parser.rl"
 
 
         void parseObject(ParserResult res, int p, int pe) {
@@ -1906,14 +1906,14 @@ void parseObject(ParserResult res, int p, int pe) {
             }
 
 
-// line 1912 "Parser.java"
+// line 1910 "Parser.java"
 	{
 	cs = JSON_object_start;
 	}
 
-// line 798 "Parser.rl"
+// line 796 "Parser.rl"
 
-// line 1919 "Parser.java"
+// line 1917 "Parser.java"
 	{
 	int _klen;
 	int _trans = 0;
@@ -1994,7 +1994,7 @@ else if ( data[p] > _JSON_object_trans_keys[_mid+1] )
 			switch ( _JSON_object_actions[_acts++] )
 			{
 	case 0:
-// line 729 "Parser.rl"
+// line 727 "Parser.rl"
 	{
                 parseValue(res, p, pe);
                 if (res.result == null) {
@@ -2011,7 +2011,7 @@ else if ( data[p] > _JSON_object_trans_keys[_mid+1] )
             }
 	break;
 	case 1:
-// line 744 "Parser.rl"
+// line 742 "Parser.rl"
 	{
                 parseString(res, p, pe);
                 if (res.result == null) {
@@ -2031,13 +2031,13 @@ else if ( data[p] > _JSON_object_trans_keys[_mid+1] )
             }
 	break;
 	case 2:
-// line 762 "Parser.rl"
+// line 760 "Parser.rl"
 	{
                 p--;
                 { p += 1; _goto_targ = 5; if (true)  continue _goto;}
             }
 	break;
-// line 2043 "Parser.java"
+// line 2041 "Parser.java"
 			}
 		}
 	}
@@ -2057,7 +2057,7 @@ else if ( data[p] > _JSON_object_trans_keys[_mid+1] )
 	break; }
 	}
 
-// line 799 "Parser.rl"
+// line 797 "Parser.rl"
 
             if (cs < JSON_object_first_final) {
                 res.update(null, p + 1);
@@ -2090,7 +2090,7 @@ else if ( data[p] > _JSON_object_trans_keys[_mid+1] )
         }
 
 
-// line 2096 "Parser.java"
+// line 2094 "Parser.java"
 private static byte[] init__JSON_actions_0()
 {
 	return new byte [] {
@@ -2194,7 +2194,7 @@ private static byte[] init__JSON_trans_actions_0()
 static final int JSON_en_main = 1;
 
 
-// line 864 "Parser.rl"
+// line 862 "Parser.rl"
 
 
         public IRubyObject parseStrict() {
@@ -2204,16 +2204,16 @@ public IRubyObject parseStrict() {
             ParserResult res = new ParserResult();
 
 
-// line 2210 "Parser.java"
+// line 2208 "Parser.java"
 	{
 	cs = JSON_start;
 	}
 
-// line 873 "Parser.rl"
+// line 871 "Parser.rl"
             p = byteList.begin();
             pe = p + byteList.length();
 
-// line 2219 "Parser.java"
+// line 2217 "Parser.java"
 	{
 	int _klen;
 	int _trans = 0;
@@ -2294,7 +2294,7 @@ else if ( data[p] > _JSON_trans_keys[_mid+1] )
 			switch ( _JSON_actions[_acts++] )
 			{
 	case 0:
-// line 836 "Parser.rl"
+// line 834 "Parser.rl"
 	{
                 currentNesting = 1;
                 parseObject(res, p, pe);
@@ -2308,7 +2308,7 @@ else if ( data[p] > _JSON_trans_keys[_mid+1] )
             }
 	break;
 	case 1:
-// line 848 "Parser.rl"
+// line 846 "Parser.rl"
 	{
                 currentNesting = 1;
                 parseArray(res, p, pe);
@@ -2321,7 +2321,7 @@ else if ( data[p] > _JSON_trans_keys[_mid+1] )
                 }
             }
 	break;
-// line 2327 "Parser.java"
+// line 2325 "Parser.java"
 			}
 		}
 	}
@@ -2341,7 +2341,7 @@ else if ( data[p] > _JSON_trans_keys[_mid+1] )
 	break; }
 	}
 
-// line 876 "Parser.rl"
+// line 874 "Parser.rl"
 
             if (cs >= JSON_first_final && p == pe) {
                 return result;
@@ -2351,7 +2351,7 @@ else if ( data[p] > _JSON_trans_keys[_mid+1] )
         }
 
 
-// line 2357 "Parser.java"
+// line 2355 "Parser.java"
 private static byte[] init__JSON_quirks_mode_actions_0()
 {
 	return new byte [] {
@@ -2454,7 +2454,7 @@ private static byte[] init__JSON_quirks_mode_trans_actions_0()
 static final int JSON_quirks_mode_en_main = 1;
 
 
-// line 904 "Parser.rl"
+// line 902 "Parser.rl"
 
 
         public IRubyObject parseQuirksMode() {
@@ -2464,16 +2464,16 @@ public IRubyObject parseQuirksMode() {
             ParserResult res = new ParserResult();
 
 
-// line 2470 "Parser.java"
+// line 2468 "Parser.java"
 	{
 	cs = JSON_quirks_mode_start;
 	}
 
-// line 913 "Parser.rl"
+// line 911 "Parser.rl"
             p = byteList.begin();
             pe = p + byteList.length();
 
-// line 2479 "Parser.java"
+// line 2477 "Parser.java"
 	{
 	int _klen;
 	int _trans = 0;
@@ -2554,7 +2554,7 @@ else if ( data[p] > _JSON_quirks_mode_trans_keys[_mid+1] )
 			switch ( _JSON_quirks_mode_actions[_acts++] )
 			{
 	case 0:
-// line 890 "Parser.rl"
+// line 888 "Parser.rl"
 	{
                 parseValue(res, p, pe);
                 if (res.result == null) {
@@ -2566,7 +2566,7 @@ else if ( data[p] > _JSON_quirks_mode_trans_keys[_mid+1] )
                 }
             }
 	break;
-// line 2572 "Parser.java"
+// line 2570 "Parser.java"
 			}
 		}
 	}
@@ -2586,7 +2586,7 @@ else if ( data[p] > _JSON_quirks_mode_trans_keys[_mid+1] )
 	break; }
 	}
 
-// line 916 "Parser.rl"
+// line 914 "Parser.rl"
 
             if (cs >= JSON_quirks_mode_first_final && p == pe) {
                 return result;

java/src/json/ext/Parser.rl

@@ -164,7 +164,7 @@ public class Parser extends RubyObject {
         this.symbolizeNames  = opts.getBool("symbolize_names", false);
         this.quirksMode      = opts.getBool("quirks_mode", false);
         this.createId        = opts.getString("create_id", getCreateId(context));
-        this.createAdditions = opts.getBool("create_additions", true);
+        this.createAdditions = opts.getBool("create_additions", false);
         this.objectClass     = opts.getClass("object_class", runtime.getHash());
         this.arrayClass      = opts.getClass("array_class", runtime.getArray());
         this.match_string    = opts.getHash("match_string");

json.gemspec

@@ -2,21 +2,21 @@
 
 Gem::Specification.new do |s|
   s.name = "json"
-  s.version = "1.6.7"
+  s.version = "1.6.8"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Florian Frank"]
-  s.date = "2012-04-28"
+  s.date = "2013-02-10"
   s.description = "This is a JSON implementation as a Ruby extension in C."
   s.email = "[email protected]"
-  s.extensions = ["ext/json/ext/parser/extconf.rb", "ext/json/ext/generator/extconf.rb"]
+  s.extensions = ["ext/json/ext/generator/extconf.rb", "ext/json/ext/parser/extconf.rb"]
   s.extra_rdoc_files = ["README.rdoc"]
   s.files = [".gitignore", ".travis.yml", "CHANGES", "COPYING", "COPYING-json-jruby", "GPL", "Gemfile", "README-json-jruby.markdown", "README.rdoc", "Rakefile", "TODO", "VERSION", "data/example.json", "data/index.html", "data/prototype.js", "diagrams/.keep", "ext/json/ext/fbuffer/fbuffer.h", "ext/json/ext/generator/extconf.rb", "ext/json/ext/generator/generator.c", "ext/json/ext/generator/generator.h", "ext/json/ext/parser/extconf.rb", "ext/json/ext/parser/parser.c", "ext/json/ext/parser/parser.h", "ext/json/ext/parser/parser.rl", "install.rb", "java/src/json/ext/ByteListTranscoder.java", "java/src/json/ext/Generator.java", "java/src/json/ext/GeneratorMethods.java", "java/src/json/ext/GeneratorService.java", "java/src/json/ext/GeneratorState.java", "java/src/json/ext/OptionsReader.java", "java/src/json/ext/Parser.java", "java/src/json/ext/Parser.rl", "java/src/json/ext/ParserService.java", "java/src/json/ext/RuntimeInfo.java", "java/src/json/ext/StringDecoder.java", "java/src/json/ext/StringEncoder.java", "java/src/json/ext/Utils.java", "json-java.gemspec", "json.gemspec", "json_pure.gemspec", "lib/json.rb", "lib/json/add/bigdecimal.rb", "lib/json/add/complex.rb", "lib/json/add/core.rb", "lib/json/add/date.rb", "lib/json/add/date_time.rb", "lib/json/add/exception.rb", "lib/json/add/ostruct.rb", "lib/json/add/range.rb", "lib/json/add/rational.rb", "lib/json/add/regexp.rb", "lib/json/add/struct.rb", "lib/json/add/symbol.rb", "lib/json/add/time.rb", "lib/json/common.rb", "lib/json/ext.rb", "lib/json/ext/.keep", "lib/json/light_object.rb", "lib/json/pure.rb", "lib/json/pure/generator.rb", "lib/json/pure/parser.rb", "lib/json/version.rb", "tests/fixtures/fail1.json", "tests/fixtures/fail10.json", "tests/fixtures/fail11.json", "tests/fixtures/fail12.json", "tests/fixtures/fail13.json", "tests/fixtures/fail14.json", "tests/fixtures/fail18.json", "tests/fixtures/fail19.json", "tests/fixtures/fail2.json", "tests/fixtures/fail20.json", "tests/fixtures/fail21.json", "tests/fixtures/fail22.json", "tests/fixtures/fail23.json", "tests/fixtures/fail24.json", "tests/fixtures/fail25.json", "tests/fixtures/fail27.json", "tests/fixtures/fail28.json", "tests/fixtures/fail3.json", "tests/fixtures/fail4.json", "tests/fixtures/fail5.json", "tests/fixtures/fail6.json", "tests/fixtures/fail7.json", "tests/fixtures/fail8.json", "tests/fixtures/fail9.json", "tests/fixtures/pass1.json", "tests/fixtures/pass15.json", "tests/fixtures/pass16.json", "tests/fixtures/pass17.json", "tests/fixtures/pass2.json", "tests/fixtures/pass26.json", "tests/fixtures/pass3.json", "tests/setup_variant.rb", "tests/test_json.rb", "tests/test_json_addition.rb", "tests/test_json_encoding.rb", "tests/test_json_fixtures.rb", "tests/test_json_generate.rb", "tests/test_json_string_matching.rb", "tests/test_json_unicode.rb", "tools/fuzz.rb", "tools/server.rb", "./tests/test_json_string_matching.rb", "./tests/test_json_fixtures.rb", "./tests/test_json_unicode.rb", "./tests/test_json_addition.rb", "./tests/test_json_generate.rb", "./tests/test_json_encoding.rb", "./tests/test_json.rb"]
   s.homepage = "http://flori.github.com/json"
   s.rdoc_options = ["--title", "JSON implemention for Ruby", "--main", "README.rdoc"]
   s.require_paths = ["ext/json/ext", "ext", "lib"]
   s.rubyforge_project = "json"
-  s.rubygems_version = "1.8.23"
+  s.rubygems_version = "1.8.25"
   s.summary = "JSON Implementation for Ruby"
   s.test_files = ["./tests/test_json_string_matching.rb", "./tests/test_json_fixtures.rb", "./tests/test_json_unicode.rb", "./tests/test_json_addition.rb", "./tests/test_json_generate.rb", "./tests/test_json_encoding.rb", "./tests/test_json.rb"]
 

json_pure.gemspec

@@ -2,11 +2,11 @@
 
 Gem::Specification.new do |s|
   s.name = "json_pure"
-  s.version = "1.6.7"
+  s.version = "1.6.8"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Florian Frank"]
-  s.date = "2012-04-28"
+  s.date = "2013-02-10"
   s.description = "This is a JSON implementation in pure Ruby."
   s.email = "[email protected]"
   s.extra_rdoc_files = ["README.rdoc"]
@@ -15,7 +15,7 @@ Gem::Specification.new do |s|
   s.rdoc_options = ["--title", "JSON implemention for ruby", "--main", "README.rdoc"]
   s.require_paths = ["lib"]
   s.rubyforge_project = "json"
-  s.rubygems_version = "1.8.23"
+  s.rubygems_version = "1.8.25"
   s.summary = "JSON Implementation for Ruby"
   s.test_files = ["./tests/test_json_string_matching.rb", "./tests/test_json_fixtures.rb", "./tests/test_json_unicode.rb", "./tests/test_json_addition.rb", "./tests/test_json_generate.rb", "./tests/test_json_encoding.rb", "./tests/test_json.rb"]