Add limits when deserializing BigDecimal and BigInteger

gson/src/main/java/com/google/gson/JsonPrimitive.java

@@ -17,6 +17,7 @@
 package com.google.gson;
 
 import com.google.gson.internal.LazilyParsedNumber;
+import com.google.gson.internal.NumberLimits;
 import java.math.BigDecimal;
 import java.math.BigInteger;
 import java.util.Objects;
@@ -172,7 +173,7 @@ public double getAsDouble() {
    */
   @Override
   public BigDecimal getAsBigDecimal() {
-    return value instanceof BigDecimal ? (BigDecimal) value : new BigDecimal(getAsString());
+    return value instanceof BigDecimal ? (BigDecimal) value : NumberLimits.parseBigDecimal(getAsString());
   }
 
   /**
@@ -184,7 +185,7 @@ public BigInteger getAsBigInteger() {
         ? (BigInteger) value
         : isIntegral(this)
             ? BigInteger.valueOf(this.getAsNumber().longValue())
-            : new BigInteger(this.getAsString());
+            : NumberLimits.parseBigInteger(this.getAsString());
   }
 
   /**

gson/src/main/java/com/google/gson/ToNumberPolicy.java

@@ -17,6 +17,7 @@
 package com.google.gson;
 
 import com.google.gson.internal.LazilyParsedNumber;
+import com.google.gson.internal.NumberLimits;
 import com.google.gson.stream.JsonReader;
 import com.google.gson.stream.MalformedJsonException;
 import java.io.IOException;
@@ -89,7 +90,7 @@ public enum ToNumberPolicy implements ToNumberStrategy {
     @Override public BigDecimal readNumber(JsonReader in) throws IOException {
       String value = in.nextString();
       try {
-        return new BigDecimal(value);
+        return NumberLimits.parseBigDecimal(value);
       } catch (NumberFormatException e) {
         throw new JsonParseException("Cannot parse " + value + "; at path " + in.getPreviousPath(), e);
       }

gson/src/main/java/com/google/gson/internal/LazilyParsedNumber.java

@@ -35,6 +35,10 @@ public LazilyParsedNumber(String value) {
     this.value = value;
   }
 
+  private BigDecimal asBigDecimal() {
+    return NumberLimits.parseBigDecimal(value);
+  }
+
   @Override
   public int intValue() {
     try {
@@ -43,7 +47,7 @@ public int intValue() {
       try {
         return (int) Long.parseLong(value);
       } catch (NumberFormatException nfe) {
-        return new BigDecimal(value).intValue();
+        return asBigDecimal().intValue();
       }
     }
   }
@@ -53,7 +57,7 @@ public long longValue() {
     try {
       return Long.parseLong(value);
     } catch (NumberFormatException e) {
-      return new BigDecimal(value).longValue();
+      return asBigDecimal().longValue();
     }
   }
 
@@ -78,7 +82,7 @@ public String toString() {
    * deserialize it.
    */
   private Object writeReplace() throws ObjectStreamException {
-    return new BigDecimal(value);
+    return asBigDecimal();
   }
 
   private void readObject(ObjectInputStream in) throws IOException {

gson/src/main/java/com/google/gson/internal/NumberLimits.java

@@ -0,0 +1,37 @@
+package com.google.gson.internal;
+
+import java.math.BigDecimal;
+import java.math.BigInteger;
+
+/**
+ * This class enforces limits on numbers parsed from JSON to avoid potential performance
+ * problems when extremely large numbers are used.
+ */
+public class NumberLimits {
+  private NumberLimits() {
+  }
+
+  public static final int MAX_NUMBER_STRING_LENGTH = 10_000;
+
+  private static void checkNumberStringLength(String s) {
+    if (s.length() > MAX_NUMBER_STRING_LENGTH) {
+      throw new NumberFormatException("Number string too large: " + s.substring(0, 30) + "...");
+    }
+  }
+
+  public static BigDecimal parseBigDecimal(String s) throws NumberFormatException {
+    checkNumberStringLength(s);
+    BigDecimal decimal = new BigDecimal(s);
+
+    // Cast to long to avoid issues with abs when value is Integer.MIN_VALUE
+    if (Math.abs((long) decimal.scale()) >= 10_000) {
+      throw new NumberFormatException("Number has unsupported scale: " + s);
+    }
+    return decimal;
+  }
+
+  public static BigInteger parseBigInteger(String s) throws NumberFormatException {
+    checkNumberStringLength(s);
+    return new BigInteger(s);
+  }
+}

gson/src/main/java/com/google/gson/internal/bind/TypeAdapters.java

@@ -28,6 +28,7 @@
 import com.google.gson.TypeAdapterFactory;
 import com.google.gson.annotations.SerializedName;
 import com.google.gson.internal.LazilyParsedNumber;
+import com.google.gson.internal.NumberLimits;
 import com.google.gson.internal.TroubleshootingGuide;
 import com.google.gson.reflect.TypeToken;
 import com.google.gson.stream.JsonReader;
@@ -437,7 +438,7 @@ public void write(JsonWriter out, String value) throws IOException {
       }
       String s = in.nextString();
       try {
-        return new BigDecimal(s);
+        return NumberLimits.parseBigDecimal(s);
       } catch (NumberFormatException e) {
         throw new JsonSyntaxException("Failed parsing '" + s + "' as BigDecimal; at path " + in.getPreviousPath(), e);
       }
@@ -456,7 +457,7 @@ public void write(JsonWriter out, String value) throws IOException {
       }
       String s = in.nextString();
       try {
-        return new BigInteger(s);
+        return NumberLimits.parseBigInteger(s);
       } catch (NumberFormatException e) {
         throw new JsonSyntaxException("Failed parsing '" + s + "' as BigInteger; at path " + in.getPreviousPath(), e);
       }

gson/src/main/java/com/google/gson/stream/JsonReader.java

@@ -20,6 +20,7 @@
 import com.google.gson.GsonBuilder;
 import com.google.gson.Strictness;
 import com.google.gson.internal.JsonReaderInternalAccess;
+import com.google.gson.internal.NumberLimits;
 import com.google.gson.internal.TroubleshootingGuide;
 import com.google.gson.internal.bind.JsonTreeReader;
 import java.io.Closeable;
@@ -721,6 +722,7 @@ private int peekNumber() throws IOException {
     long value = 0; // Negative to accommodate Long.MIN_VALUE more easily.
     boolean negative = false;
     boolean fitsInLong = true;
+    int exponentDigitsCount = 0;
     int last = NUMBER_CHAR_NONE;
 
     int i = 0;
@@ -797,6 +799,15 @@ private int peekNumber() throws IOException {
           last = NUMBER_CHAR_FRACTION_DIGIT;
         } else if (last == NUMBER_CHAR_EXP_E || last == NUMBER_CHAR_EXP_SIGN) {
           last = NUMBER_CHAR_EXP_DIGIT;
+          exponentDigitsCount++;
+        } else if (last == NUMBER_CHAR_EXP_DIGIT) {
+          exponentDigitsCount++;
+
+          // Similar to the scale limit enforced by NumberLimits.parseBigDecimal(String)
+          // This also considers leading 0s (e.g. '1e000001'), but probably not worth the effort ignoring them
+          if (exponentDigitsCount > 4) {
+            throw new MalformedJsonException("Too many number exponent digits" + locationString());
+          }
         }
       }
     }
@@ -811,6 +822,11 @@ private int peekNumber() throws IOException {
     } else if (last == NUMBER_CHAR_DIGIT || last == NUMBER_CHAR_FRACTION_DIGIT
         || last == NUMBER_CHAR_EXP_DIGIT) {
       peekedNumberLength = i;
+      // Note: This will currently always be false because for PEEKED_NUMBER the number is backed
+      // by the `buffer` and its length is smaller than the max number string length
+      if (peekedNumberLength > NumberLimits.MAX_NUMBER_STRING_LENGTH) {
+        throw new MalformedJsonException("Number too large" + locationString());
+      }
       return peeked = PEEKED_NUMBER;
     } else {
       return PEEKED_NONE;

gson/src/test/java/com/google/gson/functional/NumberLimitsTest.java

@@ -0,0 +1,169 @@
+package com.google.gson.functional;
+
+import static com.google.common.truth.Truth.assertThat;
+import static org.junit.Assert.assertThrows;
+
+import com.google.gson.Gson;
+import com.google.gson.JsonParseException;
+import com.google.gson.JsonPrimitive;
+import com.google.gson.JsonSyntaxException;
+import com.google.gson.ToNumberPolicy;
+import com.google.gson.ToNumberStrategy;
+import com.google.gson.TypeAdapter;
+import com.google.gson.internal.LazilyParsedNumber;
+import com.google.gson.stream.JsonReader;
+import com.google.gson.stream.JsonToken;
+import com.google.gson.stream.MalformedJsonException;
+import java.io.IOException;
+import java.io.ObjectOutputStream;
+import java.io.OutputStream;
+import java.io.StringReader;
+import java.math.BigDecimal;
+import java.math.BigInteger;
+import org.junit.Test;
+
+public class NumberLimitsTest {
+  private static final int MAX_LENGTH = 10_000;
+
+  private static JsonReader jsonReader(String json) {
+    return new JsonReader(new StringReader(json));
+  }
+
+  @Test
+  public void testJsonReader() throws IOException {
+    JsonReader reader = jsonReader("1".repeat(1000));
+    assertThat(reader.peek()).isEqualTo(JsonToken.NUMBER);
+    assertThat(reader.nextString()).isEqualTo("1".repeat(1000));
+
+    JsonReader reader2 = jsonReader("1".repeat(MAX_LENGTH + 1));
+    // Currently JsonReader does not recognize large JSON numbers as numbers but treats them
+    // as unquoted string
+    MalformedJsonException e = assertThrows(MalformedJsonException.class, () -> reader2.peek());
+    assertThat(e).hasMessageThat().startsWith("Use JsonReader.setStrictness(Strictness.LENIENT) to accept malformed JSON");
+
+    reader = jsonReader("1e9999");
+    assertThat(reader.peek()).isEqualTo(JsonToken.NUMBER);
+    assertThat(reader.nextString()).isEqualTo("1e9999");
+
+    reader = jsonReader("1e+9999");
+    assertThat(reader.peek()).isEqualTo(JsonToken.NUMBER);
+    assertThat(reader.nextString()).isEqualTo("1e+9999");
+
+    JsonReader reader3 = jsonReader("1e10000");
+    e = assertThrows(MalformedJsonException.class, () -> reader3.peek());
+    assertThat(e).hasMessageThat().isEqualTo("Too many number exponent digits at line 1 column 1 path $");
+
+    JsonReader reader4 = jsonReader("1e00001");
+    // Currently JsonReader does not ignore leading 0s in exponent
+    e = assertThrows(MalformedJsonException.class, () -> reader4.peek());
+    assertThat(e).hasMessageThat().isEqualTo("Too many number exponent digits at line 1 column 1 path $");
+  }
+
+  @Test
+  public void testJsonPrimitive() {
+    assertThat(new JsonPrimitive("1".repeat(MAX_LENGTH)).getAsBigDecimal())
+        .isEqualTo(new BigDecimal("1".repeat(MAX_LENGTH)));
+    assertThat(new JsonPrimitive("1e9999").getAsBigDecimal())
+        .isEqualTo(new BigDecimal("1e9999"));
+    assertThat(new JsonPrimitive("1e-9999").getAsBigDecimal())
+        .isEqualTo(new BigDecimal("1e-9999"));
+
+    NumberFormatException e = assertThrows(NumberFormatException.class,
+        () -> new JsonPrimitive("1".repeat(MAX_LENGTH + 1)).getAsBigDecimal());
+    assertThat(e).hasMessageThat().isEqualTo("Number string too large: 111111111111111111111111111111...");
+
+    e = assertThrows(NumberFormatException.class,
+        () -> new JsonPrimitive("1e10000").getAsBigDecimal());
+    assertThat(e).hasMessageThat().isEqualTo("Number has unsupported scale: 1e10000");
+
+    e = assertThrows(NumberFormatException.class,
+        () -> new JsonPrimitive("1e-10000").getAsBigDecimal());
+    assertThat(e).hasMessageThat().isEqualTo("Number has unsupported scale: 1e-10000");
+
+
+    assertThat(new JsonPrimitive("1".repeat(MAX_LENGTH)).getAsBigInteger())
+        .isEqualTo(new BigInteger("1".repeat(MAX_LENGTH)));
+
+    e = assertThrows(NumberFormatException.class,
+        () -> new JsonPrimitive("1".repeat(MAX_LENGTH + 1)).getAsBigInteger());
+    assertThat(e).hasMessageThat().isEqualTo("Number string too large: 111111111111111111111111111111...");
+  }
+
+  @Test
+  public void testToNumberPolicy() throws IOException {
+    ToNumberStrategy strategy = ToNumberPolicy.BIG_DECIMAL;
+
+    assertThat(strategy.readNumber(jsonReader("\"" + "1".repeat(MAX_LENGTH) + "\"")))
+        .isEqualTo(new BigDecimal("1".repeat(MAX_LENGTH)));
+    assertThat(strategy.readNumber(jsonReader("1e9999")))
+        .isEqualTo(new BigDecimal("1e9999"));
+
+
+    JsonParseException e = assertThrows(JsonParseException.class,
+        () -> strategy.readNumber(jsonReader("\"" + "1".repeat(MAX_LENGTH + 1) + "\"")));
+    assertThat(e).hasMessageThat().isEqualTo("Cannot parse " + "1".repeat(MAX_LENGTH + 1) + "; at path $");
+    assertThat(e).hasCauseThat().hasMessageThat().isEqualTo("Number string too large: 111111111111111111111111111111...");
+
+    e = assertThrows(JsonParseException.class, () -> strategy.readNumber(jsonReader("\"1e10000\"")));
+    assertThat(e).hasMessageThat().isEqualTo("Cannot parse 1e10000; at path $");
+    assertThat(e).hasCauseThat().hasMessageThat().isEqualTo("Number has unsupported scale: 1e10000");
+  }
+
+  @Test
+  public void testLazilyParsedNumber() throws IOException {
+    assertThat(new LazilyParsedNumber("1".repeat(MAX_LENGTH)).intValue())
+        .isEqualTo(new BigDecimal("1".repeat(MAX_LENGTH)).intValue());
+    assertThat(new LazilyParsedNumber("1e9999").intValue())
+        .isEqualTo(new BigDecimal("1e9999").intValue());
+
+    NumberFormatException e = assertThrows(NumberFormatException.class,
+        () -> new LazilyParsedNumber("1".repeat(MAX_LENGTH + 1)).intValue());
+    assertThat(e).hasMessageThat().isEqualTo("Number string too large: 111111111111111111111111111111...");
+
+    e = assertThrows(NumberFormatException.class,
+        () -> new LazilyParsedNumber("1e10000").intValue());
+    assertThat(e).hasMessageThat().isEqualTo("Number has unsupported scale: 1e10000");
+
+    e = assertThrows(NumberFormatException.class,
+        () -> new LazilyParsedNumber("1e10000").longValue());
+    assertThat(e).hasMessageThat().isEqualTo("Number has unsupported scale: 1e10000");
+
+    ObjectOutputStream objOut = new ObjectOutputStream(OutputStream.nullOutputStream());
+    // Number is serialized as BigDecimal; should also enforce limits during this conversion
+    e = assertThrows(NumberFormatException.class, () -> objOut.writeObject(new LazilyParsedNumber("1e10000")));
+    assertThat(e).hasMessageThat().isEqualTo("Number has unsupported scale: 1e10000");
+  }
+
+  @Test
+  public void testBigDecimalAdapter() throws IOException {
+    TypeAdapter<BigDecimal> adapter = new Gson().getAdapter(BigDecimal.class);
+
+    assertThat(adapter.fromJson("\"" + "1".repeat(MAX_LENGTH) + "\""))
+        .isEqualTo(new BigDecimal("1".repeat(MAX_LENGTH)));
+    assertThat(adapter.fromJson("\"1e9999\""))
+        .isEqualTo(new BigDecimal("1e9999"));
+
+    JsonSyntaxException e = assertThrows(JsonSyntaxException.class,
+        () -> adapter.fromJson("\"" + "1".repeat(MAX_LENGTH + 1) + "\""));
+    assertThat(e).hasMessageThat().isEqualTo("Failed parsing '" + "1".repeat(MAX_LENGTH + 1) + "' as BigDecimal; at path $");
+    assertThat(e).hasCauseThat().hasMessageThat().isEqualTo("Number string too large: 111111111111111111111111111111...");
+
+    e = assertThrows(JsonSyntaxException.class,
+        () -> adapter.fromJson("\"1e10000\""));
+    assertThat(e).hasMessageThat().isEqualTo("Failed parsing '1e10000' as BigDecimal; at path $");
+    assertThat(e).hasCauseThat().hasMessageThat().isEqualTo("Number has unsupported scale: 1e10000");
+  }
+
+  @Test
+  public void testBigIntegerAdapter() throws IOException {
+    TypeAdapter<BigInteger> adapter = new Gson().getAdapter(BigInteger.class);
+
+    assertThat(adapter.fromJson("\"" + "1".repeat(MAX_LENGTH) + "\""))
+        .isEqualTo(new BigInteger("1".repeat(MAX_LENGTH)));
+
+    JsonSyntaxException e = assertThrows(JsonSyntaxException.class,
+        () -> adapter.fromJson("\"" + "1".repeat(MAX_LENGTH + 1) + "\""));
+    assertThat(e).hasMessageThat().isEqualTo("Failed parsing '" + "1".repeat(MAX_LENGTH + 1) + "' as BigInteger; at path $");
+    assertThat(e).hasCauseThat().hasMessageThat().isEqualTo("Number string too large: 111111111111111111111111111111...");
+  }
+}