security: deep nesting causes stack overflow in JSON parser
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
Research direction
Start by reading the JSON parser functions parseValue, parseArrayElems, and parseObjectElems to trace their mutual recursion and existing ParseError handling. Define how the configurable depth limit is passed and what default is appropriate, then verify that deeply nested input returns ParseError.nestingDepthExceeded without exhausting the runtime stack.
Written by the indexing model from the issue text.
Description
Problem
The JSON parser (parseValue/parseArrayElems/parseObjectElems) is mutually recursive with no depth limit. Deeply nested JSON (e.g., [[[[...10000 levels...]]]]) will exhaust the Lean runtime stack.
This is distinct from the DoS risk in #13 (which is about exponent arithmetic) — this is about recursion depth on the parse stack.
Expected fix
Add a configurable maximum nesting depth to the parser (defaulting to a safe value like 512 or 1024). Return a ParseError.nestingDepthExceeded on overflow.
References
- Related to: #13 (DoS prevention)
- Flagged by AI code review on PR #8
- Dominant language
- Lean
- Stars
- 2
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from lambdaclass/lambda_compiler_kit
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
-
Difficulty 1/5 Under an hour Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 50/100
All issues in lambdaclass/lambda_compiler_kit
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
internal.h中，漏掉了1个定义。 Open
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
oxc-project/oxc#26944 ·