Serializer::JSON: deserialize ignores engine config that serialize honours
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
Research direction
Start in lib/Dancer2/Serializer/JSON.pm at lines 39-41 and 50-57, comparing how serialize merges $self->config with how deserialize builds its options. Identify which configured decoder options are safe to allow, including max_depth and max_size. Done means supported configuration affects deserialization consistently without forwarding unsafe or unintended keys.
Written by the indexing model from the issue text.
Description
Status: reasoned from code
lib/Dancer2/Serializer/JSON.pm:50-57. serialize merges $self->config into its options (lines 39-41); deserialize does not — it only sets utf8 and deletes strict_utf8.
So allow_nonref and every other configured option apply in one direction only, despite being configured in one place. That is surprising and undocumented.
Suggested fix
Mirror the merge loop from serialize, but be deliberate about which options are safe to honour on the decode side. Blindly forwarding every config key to the decoder could enable options nobody intended, so an allowlist is probably right.
Worth explicitly supporting max_depth and max_size as hardening while in there — JSON::XS defaults to max_depth 512 and max_size 0 (unlimited), and neither is currently settable from Dancer2 config.
- Dominant language
- Perl
- Stars
- 604
- Forks
- 287
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 6
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PerlDancer/Dancer2
-
Add .gitattributes so share/skel keeps LF on a Windows git checkoutPossibly taken @sadhana-s-codez claimed this 2 days ago. Open
Difficulty 1/5 Under an hour Newbie friendliness 85/100
PerlDancer/Dancer2#1854 · 1 comment ·
Maintainers usually reply within 1 day
-
dancer2 gen -c writes the Dockerfile outside the app directoryPossibly taken @sjh9714 claimed this 1 day ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
PerlDancer/Dancer2#1851 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
PerlDancer/Dancer2#1850 ·
Maintainers usually reply within 1 day
-
Bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
PerlDancer/Dancer2#1820 ·
Maintainers usually reply within 1 day
-
Enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
PerlDancer/Dancer2#1819 ·
Maintainers usually reply within 1 day
All issues in PerlDancer/Dancer2
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
jimsalterjrs/sanoid#1116 · 1 reaction ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
major/MySQLTuner-perl#1007 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 69/100
bioconda/bioconda-recipes#70187 ·
Maintainers usually reply within 2 days