Skip to content

Properly fail on invalid json #53740

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AndyScherzinger merged 3 commits into from
Jul 3, 2025
Merged

Properly fail on invalid json #53740

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
87f98c8
chore: Rename property and type it to match its current use in Request
come-nc Jul 1, 2025
e8bc35e
fix(ocs): Return a proper error on JSON decoding failures
come-nc Jul 1, 2025
79f4e0d
fix: Only attempt to decode JSON input if it is not an empty string
come-nc Jul 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions lib/base.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,8 +141,8 @@ public static function initPaths(): void {

// Resolve /nextcloud to /nextcloud/ to ensure to always have a trailing
// slash which is required by URL generation.
if (isset($_SERVER['REQUEST_URI']) && $_SERVER['REQUEST_URI'] === \OC::$WEBROOT &&
substr($_SERVER['REQUEST_URI'], -1) !== '/') {
if (isset($_SERVER['REQUEST_URI']) && $_SERVER['REQUEST_URI'] === \OC::$WEBROOT
&& substr($_SERVER['REQUEST_URI'], -1) !== '/') {
header('Location: ' . \OC::$WEBROOT . '/');
exit();
}
Expand Down Expand Up @@ -285,8 +285,8 @@ private static function printUpgradePage(\OC\SystemConfig $systemConfig): void {
$tooBig = ($totalUsers > 50);
}
}
$ignoreTooBigWarning = isset($_GET['IKnowThatThisIsABigInstanceAndTheUpdateRequestCouldRunIntoATimeoutAndHowToRestoreABackup']) &&
$_GET['IKnowThatThisIsABigInstanceAndTheUpdateRequestCouldRunIntoATimeoutAndHowToRestoreABackup'] === 'IAmSuperSureToDoThis';
$ignoreTooBigWarning = isset($_GET['IKnowThatThisIsABigInstanceAndTheUpdateRequestCouldRunIntoATimeoutAndHowToRestoreABackup'])
&& $_GET['IKnowThatThisIsABigInstanceAndTheUpdateRequestCouldRunIntoATimeoutAndHowToRestoreABackup'] === 'IAmSuperSureToDoThis';

if ($disableWebUpdater || ($tooBig && !$ignoreTooBigWarning)) {
// send http status 503
Expand Down Expand Up @@ -987,6 +987,7 @@ public static function handleRequest(): void {
}

$request = Server::get(IRequest::class);
$request->throwDecodingExceptionIfAny();
$requestPath = $request->getRawPathInfo();
if ($requestPath === '/heartbeat') {
return;
Expand Down
22 changes: 18 additions & 4 deletions lib/private/AppFramework/Http/Request.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ class Request implements \ArrayAccess, \Countable, IRequest {
public const REGEX_LOCALHOST = '/^(127\.0\.0\.1|localhost|\[::1\])$/';

protected string $inputStream;
protected $content;
private bool $isPutStreamContentAlreadySent = false;
protected array $items = [];
protected array $allowedKeys = [
'get',
Expand All @@ -64,6 +64,7 @@ class Request implements \ArrayAccess, \Countable, IRequest {
protected ?CsrfTokenManager $csrfTokenManager;

protected bool $contentDecoded = false;
private ?\JsonException $decodingException = null;

/**
* @param array $vars An associative array with the following optional values:
Expand Down Expand Up @@ -356,13 +357,13 @@ public function getCookie(string $key) {
protected function getContent() {
// If the content can't be parsed into an array then return a stream resource.
if ($this->isPutStreamContent()) {
if ($this->content === false) {
if ($this->isPutStreamContentAlreadySent) {
throw new \LogicException(
'"put" can only be accessed once if not '
. 'application/x-www-form-urlencoded or application/json.'
);
}
$this->content = false;
$this->isPutStreamContentAlreadySent = true;
return fopen($this->inputStream, 'rb');
} else {
$this->decodeContent();
Expand All @@ -389,7 +390,14 @@ protected function decodeContent() {

// 'application/json' and other JSON-related content types must be decoded manually.
if (preg_match(self::JSON_CONTENT_TYPE_REGEX, $this->getHeader('Content-Type')) === 1) {
$params = json_decode(file_get_contents($this->inputStream), true);
$content = file_get_contents($this->inputStream);
if ($content !== '') {
try {
$params = json_decode($content, true, flags:JSON_THROW_ON_ERROR);
} catch (\JsonException $e) {
$this->decodingException = $e;
}
}
if (\is_array($params) && \count($params) > 0) {
$this->items['params'] = $params;
if ($this->method === 'POST') {
Expand All @@ -413,6 +421,12 @@ protected function decodeContent() {
$this->contentDecoded = true;
}

public function throwDecodingExceptionIfAny(): void {
if ($this->decodingException !== null) {
throw $this->decodingException;
}
}


/**
* Checks if the CSRF check was correct
Expand Down
10 changes: 10 additions & 0 deletions lib/public/IRequest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -305,4 +305,14 @@ public function getInsecureServerHost(): string;
* @since 8.1.0
*/
public function getServerHost(): string;

/**
* If decoding the request content failed, throw an exception.
* Currently only \JsonException for json decoding errors,
* but in the future may throw other exceptions for other decoding issues.
*
* @throws \Exception
* @since 32.0.0
*/
public function throwDecodingExceptionIfAny(): void;
}
7 changes: 5 additions & 2 deletions ocs/v1.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,11 +50,14 @@
// side effects in existing apps
OC_App::loadApps();

$request = Server::get(IRequest::class);
$request->throwDecodingExceptionIfAny();

if (!Server::get(IUserSession::class)->isLoggedIn()) {
OC::handleLogin(Server::get(IRequest::class));
OC::handleLogin($request);
}

Server::get(Router::class)->match('/ocsapp' . Server::get(IRequest::class)->getRawPathInfo());
Server::get(Router::class)->match('/ocsapp' . $request->getRawPathInfo());
} catch (MaxDelayReached $ex) {
ApiHelper::respond(Http::STATUS_TOO_MANY_REQUESTS, $ex->getMessage());
} catch (ResourceNotFoundException $e) {
Expand Down
Loading