Skip to content

Commit cd5c9fa

Browse files
wschinjeffkilpatrick
authored andcommitted
Fix a security warning (microsoft#18979)
Description (reference: GHSA-5crp-9r3c-p9vr) Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of expressions with high nesting level that lead to StackOverFlow exception or high CPU and RAM usage. Exploiting this vulnerability results in Denial Of Service (DoS). To mitigate the issue one either need to update Newtonsoft.Json to 13.0.1 or set MaxDepth parameter in the JsonSerializerSettings. ``` JsonConvert.DefaultSettings = () => new JsonSerializerSettings { MaxDepth = 128 }; ``` This file is the only place using `JsonConvert`, so I blindly put this fix and hope the warning will disappear.
1 parent e3ab149 commit cd5c9fa

File tree

2 files changed

+5
-2
lines changed
  • csharp/test

2 files changed

+5
-2
lines changed

csharp/test/Microsoft.ML.OnnxRuntime.EndToEndTests.Mobile/EndToEndTests.Mobile.Automation/Tests.cs

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,10 +40,12 @@ public void RunPlatformUnitTest()
4040
var serializedResultSummary = _app.Invoke(_getResultsBackdoorMethodName)?.ToString();
4141
Assert.IsNotEmpty(serializedResultSummary, "Test results were not returned");
4242

43+
// Fix security issue (overflow with too much nesting): GHSA-5crp-9r3c-p9vr
44+
JsonConvert.DefaultSettings = () => new JsonSerializerSettings { MaxDepth = 128 };
4345
var testSummary = JsonConvert.DeserializeObject<TestResultSummary>(serializedResultSummary);
4446
Assert.AreEqual(testSummary.Failed, 0, $"{testSummary.Failed} tests failed");
4547

4648
_app.Screenshot("Post-testing");
4749
}
4850
}
49-
}
51+
}

csharp/test/Microsoft.ML.OnnxRuntime.Tests.Devices/TestResultProcessor.cs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,9 @@ public TestResultSummary GetResults()
4545
public string GetSerializedResults()
4646
{
4747
var resultSummary = GetResults();
48+
JsonConvert.DefaultSettings = () => new JsonSerializerSettings { MaxDepth = 128 };
4849
var serializedResultSummary = JsonConvert.SerializeObject(resultSummary, Formatting.Indented);
4950
return serializedResultSummary;
5051
}
5152
}
52-
}
53+
}

0 commit comments

Comments
 (0)