Guard JSON conversion depth for CWE-674

AArnott · AArnott · commit b3af7cf7041e · 2026-05-15T10:07:02.000-06:00
ConvertFromJson now applies the configured MessagePackSecurity maximum object graph depth while translating nested JSON objects and arrays, preventing deeply nested input from recursing until stack exhaustion.

Added a bounded regression test that verifies over-depth JSON is rejected for both compressed and uncompressed conversion paths.
diff --git a/src/MessagePack/MessagePackSerializer.Json.cs b/src/MessagePack/MessagePackSerializer.Json.cs
@@ -187,6 +187,11 @@ public static void ConvertFromJson(TextReader reader, ref MessagePackWriter writ
         }
 
         private static uint FromJsonCore(TinyJsonReader jr, ref MessagePackWriter writer, MessagePackSerializerOptions options)
+        {
+            return FromJsonCore(jr, ref writer, options, 0);
+        }
+
+        private static uint FromJsonCore(TinyJsonReader jr, ref MessagePackWriter writer, MessagePackSerializerOptions options, int depth)
         {
             uint count = 0;
             while (jr.Read())
@@ -196,11 +201,13 @@ private static uint FromJsonCore(TinyJsonReader jr, ref MessagePackWriter writer
                     case TinyJsonToken.None:
                         break;
                     case TinyJsonToken.StartObject:
+                        VerifyJsonObjectGraphDepth(options, depth);
+
                         // Set up a scratch area to serialize the collection since we don't know its length yet, which must be written first.
                         using (var scratchRental = options.SequencePool.Rent())
                         {
                             MessagePackWriter scratchWriter = writer.Clone(scratchRental.Value);
-                            var mapCount = FromJsonCore(jr, ref scratchWriter, options);
+                            var mapCount = FromJsonCore(jr, ref scratchWriter, options, depth + 1);
                             scratchWriter.Flush();
 
                             mapCount = mapCount / 2; // remove propertyname string count.
@@ -213,11 +220,13 @@ private static uint FromJsonCore(TinyJsonReader jr, ref MessagePackWriter writer
                     case TinyJsonToken.EndObject:
                         return count; // break
                     case TinyJsonToken.StartArray:
+                        VerifyJsonObjectGraphDepth(options, depth);
+
                         // Set up a scratch area to serialize the collection since we don't know its length yet, which must be written first.
                         using (var scratchRental = options.SequencePool.Rent())
                         {
                             MessagePackWriter scratchWriter = writer.Clone(scratchRental.Value);
-                            var arrayCount = FromJsonCore(jr, ref scratchWriter, options);
+                            var arrayCount = FromJsonCore(jr, ref scratchWriter, options, depth + 1);
                             scratchWriter.Flush();
 
                             writer.WriteArrayHeader(arrayCount);
@@ -273,6 +282,14 @@ private static uint FromJsonCore(TinyJsonReader jr, ref MessagePackWriter writer
             return count;
         }
 
+        private static void VerifyJsonObjectGraphDepth(MessagePackSerializerOptions options, int depth)
+        {
+            if (depth >= options.Security.MaximumObjectGraphDepth)
+            {
+                throw new InsufficientExecutionStackException($"This JSON sequence has an object graph that exceeds the maximum depth allowed of {options.Security.MaximumObjectGraphDepth}.");
+            }
+        }
+
         private static void ToJsonCore(ref MessagePackReader reader, TextWriter writer, MessagePackSerializerOptions options)
         {
             MessagePackType type = reader.NextMessagePackType;
diff --git a/tests/MessagePack.Tests/ToJsonTest.cs b/tests/MessagePack.Tests/ToJsonTest.cs
@@ -47,6 +47,19 @@ public void ComplexToJson()
             this.JsonConvert(json, LZ4Standard).Is(json);
         }
 
+        [Theory]
+        [InlineData(false)]
+        [InlineData(true)]
+        [Trait("CWE", "674")]
+        public void ConvertFromJsonRejectsExcessiveNesting(bool compression)
+        {
+            var options = MessagePackSerializerOptions.Standard
+                .WithCompression(compression ? MessagePackCompression.Lz4Block : MessagePackCompression.None)
+                .WithSecurity(MessagePackSecurity.UntrustedData.WithMaximumObjectGraphDepth(3));
+
+            Assert.Throws<InsufficientExecutionStackException>(() => MessagePackSerializer.ConvertFromJson("[[[[1]]]]", options));
+        }
+
         [Fact]
         public void FloatJson()
         {
