fix recursion limit error when deserializing deeply nested audit trees

PLSysSec · Sep 25, 2024 · 4f36d62 · 4f36d62
1 parent da7085a
commit 4f36d62
Show file tree

Hide file tree

Showing 3 changed files with 42 additions and 4 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -66,9 +66,10 @@ parse-display = "0.8.2"
 home.workspace = true
 csv = "1.3.0"
 threadpool = "1.8.1"
+serde_stacker = "0.1.11"
 
 [workspace.dependencies]
-serde_json = "1.0.108"
+serde_json = { version = "1.0.108", features = ["unbounded_depth"] }
 log = "0.4.20"
 serde = { version = "1.0.192", features = ["derive"] }
 anyhow = "1.0.75"

diff --git a/src/audit_file.rs b/src/audit_file.rs
@@ -205,7 +205,11 @@ impl AuditFile {
             Err(anyhow!("Audit path is a directory"))
         } else if path.is_file() {
             let json_string = std::fs::read_to_string(path.as_path())?;
-            let audit_file = serde_json::from_str(&json_string)?;
+            let mut deserializer = serde_json::Deserializer::from_str(&json_string);
+            deserializer.disable_recursion_limit();
+            let deserializer = serde_stacker::Deserializer::new(&mut deserializer);
+            let audit_file = AuditFile::deserialize(deserializer).unwrap();
+
             Ok(Some(audit_file))
         } else {
             Ok(None)