add depth protection to unary

Author: spyoungtech

src/parser.rs

@@ -494,6 +494,11 @@ impl<'toks, 'input> JSON5Parser<'toks, 'input> {
         match self.check_and_consume(vec![TokType::Plus, TokType::Minus]) {
             None => self.parse_primary(),
             Some(span) => {
+                self.current_depth = self.current_depth + 1;
+                if self.current_depth > self.max_depth {
+                    let idx = self.position();
+                    return Err(self.make_error(format!("max depth ({}) exceeded while parsing unary. To expand the depth, use the ``with_max_depth`` constructor or enable the `unlimited_depth` feature", self.max_depth), idx))
+                }
                 match span.1 {
                     TokType::Plus => {
                         let value = self.parse_unary()?;
@@ -503,6 +508,7 @@ impl<'toks, 'input> JSON5Parser<'toks, 'input> {
                                 return Err(self.make_error(format!("Unary operations not allowed for value {:?}", val), span.2))
                             }
                         }
+                        self.current_depth = self.current_depth - 1;
                         Ok(JSONValue::Unary {operator: UnaryOperator::Plus, value: Box::new(value)})
                     }
                     TokType::Minus => {
@@ -513,6 +519,7 @@ impl<'toks, 'input> JSON5Parser<'toks, 'input> {
                                 return Err(self.make_error(format!("Unary operations not allowed for value {:?}", val), span.2))
                             }
                         }
+                        self.current_depth = self.current_depth - 1;
                         Ok(JSONValue::Unary {operator: UnaryOperator::Minus, value: Box::new(value)})
                     }
                     _ => unreachable!("no")

src/rt/parser.rs

@@ -609,6 +609,11 @@ impl<'toks, 'input> JSON5Parser<'toks, 'input> {
         match self.check_and_consume(vec![TokType::Plus, TokType::Minus]) {
             None => self.parse_primary(),
             Some(span) => {
+                self.current_depth = self.current_depth + 1;
+                if self.current_depth > self.max_depth {
+                    let idx = self.position();
+                    return Err(self.make_error(format!("max depth ({}) exceeded while parsing unary. To expand the depth, use the ``with_max_depth`` constructor or enable the `unlimited_depth` feature", self.max_depth), idx))
+                }
                 match span.1 {
                     TokType::Plus => {
                         let value = self.parse_unary()?;
@@ -618,7 +623,7 @@ impl<'toks, 'input> JSON5Parser<'toks, 'input> {
                                 return Err(self.make_error(format!("Unary operations not allowed for value {:?}", val), span.2))
                             }
                         }
-
+                        self.current_depth = self.current_depth - 1;
                         Ok(JSONValue::Unary {operator: UnaryOperator::Plus, value: Box::new(value)})
                     }
                     TokType::Minus => {
@@ -629,6 +634,7 @@ impl<'toks, 'input> JSON5Parser<'toks, 'input> {
                                 return Err(self.make_error(format!("Unary operations not allowed for value {:?}", val), span.2))
                             }
                         }
+                        self.current_depth = self.current_depth - 1;
                         Ok(JSONValue::Unary {operator: UnaryOperator::Minus, value: Box::new(value)})
                     }
                     _ => unreachable!("no")