diff -pruN 4.4.0-1/.github/workflows/build.yml 4.5.0-1/.github/workflows/build.yml --- 4.4.0-1/.github/workflows/build.yml 2023-12-07 14:00:48.000000000 +0000 +++ 4.5.0-1/.github/workflows/build.yml 2025-04-20 16:01:38.000000000 +0000 @@ -15,7 +15,7 @@ jobs: steps: - name: Checkout repo - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 @@ -23,7 +23,7 @@ jobs: run: ./build_release.sh - name: Upload hjson-cli artifacts - uses: actions/upload-artifact@v2 + uses: actions/upload-artifact@v4 with: name: output path: binaries/* @@ -35,7 +35,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Download actifacts - uses: actions/download-artifact@v2 + uses: actions/download-artifact@v4 with: path: artifacts diff -pruN 4.4.0-1/.github/workflows/test.yml 4.5.0-1/.github/workflows/test.yml --- 4.4.0-1/.github/workflows/test.yml 2023-12-07 14:00:48.000000000 +0000 +++ 4.5.0-1/.github/workflows/test.yml 2025-04-20 16:01:38.000000000 +0000 @@ -1,14 +1,39 @@ name: test -on: [push, pull_request] + +on: + push: + branches: + - master + pull_request: + +permissions: + contents: read + jobs: test: + name: ${{ matrix.name }} runs-on: ${{ matrix.os }} strategy: fail-fast: false matrix: - os: [ubuntu-latest, macos-latest, windows-latest] + include: + - name: ubuntu + os: ubuntu-latest + go-version: 'stable' + - name: mac + os: macos-latest + go-version: 'stable' + - name: windows + os: windows-latest + go-version: 'stable' + - name: ubuntu go 1.12 + os: ubuntu-latest + go-version: '1.12.x' steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 + - uses: actions/setup-go@v5 + with: + go-version: ${{ matrix.go-version }} - run: go version - run: go test -v - run: cd hjson-cli && go build diff -pruN 4.4.0-1/README.md 4.5.0-1/README.md --- 4.4.0-1/README.md 2023-12-07 14:00:48.000000000 +0000 +++ 4.5.0-1/README.md 2025-04-20 16:01:38.000000000 +0000 @@ -349,7 +349,7 @@ Output: {3} ``` -String pointer destinations are treated the same as string destinations, so you cannot set a string pointer to `nil` by writing `null` in an Hjson file. Writing `null` in an Hjson file would result in the string "null" being stored in the destination string pointer. +String pointer destinations can be set to `nil` by writing `null` in an Hjson file. The same goes for a pointer destination of any type that implements `UnmarshalText()`. ## ElemTyper interface @@ -364,6 +364,10 @@ func (o *OrderedMap[T]) ElemType() refle } ``` +## Max nesting depth + +In order to avoid stack overflow all unmarshal-functions return an error if the Hjson input contains a tree more than 10000 levels deep. This is the same limit as in the Go standard library package `encoding/json`. + # API [![godoc](https://godoc.org/github.com/hjson/hjson-go/v4?status.svg)](https://godoc.org/github.com/hjson/hjson-go/v4) diff -pruN 4.4.0-1/assets/comments2/root_result.hjson 4.5.0-1/assets/comments2/root_result.hjson --- 4.4.0-1/assets/comments2/root_result.hjson 2023-12-07 14:00:48.000000000 +0000 +++ 4.5.0-1/assets/comments2/root_result.hjson 2025-04-20 16:01:38.000000000 +0000 @@ -1,6 +1,7 @@ -// a object with the root braces omitted -database: { - host: 127.0.0.1 - port: 555 +// a object with the root braces omitted +database: { + host: 127.0.0.1 + port: 555 + } } diff -pruN 4.4.0-1/assets/comments2/strings4_result.hjson 4.5.0-1/assets/comments2/strings4_result.hjson --- 4.4.0-1/assets/comments2/strings4_result.hjson 1970-01-01 00:00:00.000000000 +0000 +++ 4.5.0-1/assets/comments2/strings4_result.hjson 2025-04-20 16:01:38.000000000 +0000 @@ -0,0 +1 @@ +"" diff -pruN 4.4.0-1/assets/comments2/strings4_result.json 4.5.0-1/assets/comments2/strings4_result.json --- 4.4.0-1/assets/comments2/strings4_result.json 1970-01-01 00:00:00.000000000 +0000 +++ 4.5.0-1/assets/comments2/strings4_result.json 2025-04-20 16:01:38.000000000 +0000 @@ -0,0 +1 @@ +"" diff -pruN 4.4.0-1/assets/comments3/root_result.hjson 4.5.0-1/assets/comments3/root_result.hjson --- 4.4.0-1/assets/comments3/root_result.hjson 2023-12-07 14:00:48.000000000 +0000 +++ 4.5.0-1/assets/comments3/root_result.hjson 2025-04-20 16:01:38.000000000 +0000 @@ -1,6 +1,7 @@ -// a object with the root braces omitted -database: { +// a object with the root braces omitted +database: { host: 127.0.0.1 port: 555 + } } diff -pruN 4.4.0-1/assets/comments3/strings4_result.hjson 4.5.0-1/assets/comments3/strings4_result.hjson --- 4.4.0-1/assets/comments3/strings4_result.hjson 1970-01-01 00:00:00.000000000 +0000 +++ 4.5.0-1/assets/comments3/strings4_result.hjson 2025-04-20 16:01:38.000000000 +0000 @@ -0,0 +1 @@ +"" diff -pruN 4.4.0-1/assets/comments3/strings4_result.json 4.5.0-1/assets/comments3/strings4_result.json --- 4.4.0-1/assets/comments3/strings4_result.json 1970-01-01 00:00:00.000000000 +0000 +++ 4.5.0-1/assets/comments3/strings4_result.json 2025-04-20 16:01:38.000000000 +0000 @@ -0,0 +1 @@ +"" diff -pruN 4.4.0-1/assets/failJSON24_test.json 4.5.0-1/assets/failJSON24_test.json --- 4.4.0-1/assets/failJSON24_test.json 2023-12-07 14:00:48.000000000 +0000 +++ 4.5.0-1/assets/failJSON24_test.json 1970-01-01 00:00:00.000000000 +0000 @@ -1 +0,0 @@ -['single quote'] diff -pruN 4.4.0-1/assets/failStr9a_test.hjson 4.5.0-1/assets/failStr9a_test.hjson --- 4.4.0-1/assets/failStr9a_test.hjson 1970-01-01 00:00:00.000000000 +0000 +++ 4.5.0-1/assets/failStr9a_test.hjson 2025-04-20 16:01:38.000000000 +0000 @@ -0,0 +1,4 @@ +[ +[ += +[['''''' diff -pruN 4.4.0-1/assets/root_result.hjson 4.5.0-1/assets/root_result.hjson --- 4.4.0-1/assets/root_result.hjson 2023-12-07 14:00:48.000000000 +0000 +++ 4.5.0-1/assets/root_result.hjson 2025-04-20 16:01:38.000000000 +0000 @@ -1,6 +1,5 @@ { - database: - { + database: { host: 127.0.0.1 port: 555 } diff -pruN 4.4.0-1/assets/root_test.hjson 4.5.0-1/assets/root_test.hjson --- 4.4.0-1/assets/root_test.hjson 2023-12-07 14:00:48.000000000 +0000 +++ 4.5.0-1/assets/root_test.hjson 2025-04-20 16:01:38.000000000 +0000 @@ -1,6 +1,5 @@ // a object with the root braces omitted -database: -{ +database: { host: 127.0.0.1 port: 555 } diff -pruN 4.4.0-1/assets/sorted/root_result.hjson 4.5.0-1/assets/sorted/root_result.hjson --- 4.4.0-1/assets/sorted/root_result.hjson 2023-12-07 14:00:48.000000000 +0000 +++ 4.5.0-1/assets/sorted/root_result.hjson 2025-04-20 16:01:38.000000000 +0000 @@ -1,6 +1,5 @@ { - database: - { + database: { host: 127.0.0.1 port: 555 } diff -pruN 4.4.0-1/assets/sorted/strings4_result.hjson 4.5.0-1/assets/sorted/strings4_result.hjson --- 4.4.0-1/assets/sorted/strings4_result.hjson 1970-01-01 00:00:00.000000000 +0000 +++ 4.5.0-1/assets/sorted/strings4_result.hjson 2025-04-20 16:01:38.000000000 +0000 @@ -0,0 +1 @@ +"" diff -pruN 4.4.0-1/assets/sorted/strings4_result.json 4.5.0-1/assets/sorted/strings4_result.json --- 4.4.0-1/assets/sorted/strings4_result.json 1970-01-01 00:00:00.000000000 +0000 +++ 4.5.0-1/assets/sorted/strings4_result.json 2025-04-20 16:01:38.000000000 +0000 @@ -0,0 +1 @@ +"" diff -pruN 4.4.0-1/assets/strings4_result.hjson 4.5.0-1/assets/strings4_result.hjson --- 4.4.0-1/assets/strings4_result.hjson 1970-01-01 00:00:00.000000000 +0000 +++ 4.5.0-1/assets/strings4_result.hjson 2025-04-20 16:01:38.000000000 +0000 @@ -0,0 +1 @@ +"" diff -pruN 4.4.0-1/assets/strings4_result.json 4.5.0-1/assets/strings4_result.json --- 4.4.0-1/assets/strings4_result.json 1970-01-01 00:00:00.000000000 +0000 +++ 4.5.0-1/assets/strings4_result.json 2025-04-20 16:01:38.000000000 +0000 @@ -0,0 +1 @@ +"" diff -pruN 4.4.0-1/assets/strings4_test.hjson 4.5.0-1/assets/strings4_test.hjson --- 4.4.0-1/assets/strings4_test.hjson 1970-01-01 00:00:00.000000000 +0000 +++ 4.5.0-1/assets/strings4_test.hjson 2025-04-20 16:01:38.000000000 +0000 @@ -0,0 +1 @@ +'''''' diff -pruN 4.4.0-1/assets/testlist.txt 4.5.0-1/assets/testlist.txt --- 4.4.0-1/assets/testlist.txt 2023-12-07 14:00:48.000000000 +0000 +++ 4.5.0-1/assets/testlist.txt 2025-04-20 16:01:38.000000000 +0000 @@ -1,12 +1,12 @@ charset2_test.hjson charset_test.hjson -comments_test.hjson comments2_test.hjson comments3_test.hjson comments4_test.hjson comments5_test.hjson comments6_test.hjson comments7_test.hjson +comments_test.hjson empty_test.hjson failCharset1_test.hjson failJSON02_test.json @@ -70,6 +70,7 @@ failStr6c_test.hjson failStr6d_test.hjson failStr7a_test.hjson failStr8a_test.hjson +failStr9a_test.hjson int64_test.hjson kan_test.hjson keys_test.hjson @@ -82,9 +83,11 @@ pass4_test.json pass5_test.hjson pass6_test.hjson passSingle_test.hjson +root_test.hjson stringify1_test.hjson strings2_test.hjson strings3_test.hjson +strings4_test.hjson strings_test.hjson trail_test.hjson stringify/quotes_all_test.hjson diff -pruN 4.4.0-1/debian/changelog 4.5.0-1/debian/changelog --- 4.4.0-1/debian/changelog 2024-07-24 12:26:27.000000000 +0000 +++ 4.5.0-1/debian/changelog 2025-09-24 11:20:42.000000000 +0000 @@ -1,3 +1,10 @@ +hjson-go (4.5.0-1) unstable; urgency=high + + * New upstream release. urgency=high to unblock security and FTBFS uploads + for nncp in sid. + + -- John Goerzen Wed, 24 Sep 2025 06:20:42 -0500 + hjson-go (4.4.0-1) unstable; urgency=medium * New upstream release diff -pruN 4.4.0-1/decode.go 4.5.0-1/decode.go --- 4.4.0-1/decode.go 2023-12-07 14:00:48.000000000 +0000 +++ 4.5.0-1/decode.go 2025-04-20 16:01:38.000000000 +0000 @@ -12,6 +12,9 @@ import ( const maxPointerDepth = 512 +// This limits the max nesting depth to prevent stack overflow. +const maxNestingDepth = 10000 + type commentInfo struct { hasComment bool cmStart int @@ -73,6 +76,7 @@ type hjsonParser struct { structTypeCache map[reflect.Type]structFieldMap willMarshalToJSON bool nodeDestination bool + nestingDepth int } var unmarshalerText = reflect.TypeOf((*encoding.TextUnmarshaler)(nil)).Elem() @@ -95,6 +99,7 @@ func (p *hjsonParser) setComment2(pCm *s func (p *hjsonParser) resetAt() { p.at = 0 + p.nestingDepth = 0 p.next() } @@ -549,6 +554,11 @@ func getElemTyperType(rv reflect.Value, func (p *hjsonParser) readArray(dest reflect.Value, t reflect.Type) (value interface{}, err error) { var node Node + + if p.nestingDepth > maxNestingDepth { + return nil, p.errAt(fmt.Sprintf("Exceeded max depth (%d)", maxNestingDepth)) + } + array := make([]interface{}, 0, 1) // Skip '['. @@ -624,6 +634,11 @@ func (p *hjsonParser) readObject( // Parse an object value. var node Node var elemNode *Node + + if p.nestingDepth > maxNestingDepth { + return nil, p.errAt(fmt.Sprintf("Exceeded max depth (%d)", maxNestingDepth)) + } + object := NewOrderedMap() // If withoutBraces == true we use the input argument ciBefore as @@ -775,9 +790,13 @@ func (p *hjsonParser) readValue(dest ref // Parse an Hjson value. It could be an object, an array, a string, a number or a word. switch p.ch { case '{': + p.nestingDepth++ ret, err = p.readObject(false, dest, t, ciBefore) + p.nestingDepth-- case '[': + p.nestingDepth++ ret, err = p.readArray(dest, t) + p.nestingDepth-- case '"', '\'': s, err := p.readString(true) if err != nil { @@ -942,6 +961,7 @@ func orderedUnmarshal( structTypeCache: map[reflect.Type]structFieldMap{}, willMarshalToJSON: willMarshalToJSON, nodeDestination: nodeDestination, + nestingDepth: 0, } parser.resetAt() value, err := parser.rootValue(rv) diff -pruN 4.4.0-1/go.mod 4.5.0-1/go.mod --- 4.4.0-1/go.mod 2023-12-07 14:00:48.000000000 +0000 +++ 4.5.0-1/go.mod 2025-04-20 16:01:38.000000000 +0000 @@ -1,3 +1,3 @@ module github.com/hjson/hjson-go/v4 -go 1.11 +go 1.12 diff -pruN 4.4.0-1/hjson_test.go 4.5.0-1/hjson_test.go --- 4.4.0-1/hjson_test.go 2023-12-07 14:00:48.000000000 +0000 +++ 4.5.0-1/hjson_test.go 2025-04-20 16:01:38.000000000 +0000 @@ -65,11 +65,11 @@ func run(t *testing.T, file string) { if err := Unmarshal(testContent, &data); err != nil { if !shouldFail { t.Error(err) - } else { - return } + return } else if shouldFail { t.Error(errors.New(name + " should_fail!")) + return } rjson, rhjson, cm2, cm3 := getResultContent(name) @@ -77,11 +77,13 @@ func run(t *testing.T, file string) { actualHjson, err := Marshal(data) if err != nil { t.Error(err) + return } actualHjson = append(actualHjson, '\n') actualJSON, err := json.MarshalIndent(data, "", " ") if err != nil { t.Error(err) + return } actualJSON = append(actualJSON, '\n') actualJSON = fixJSON(actualJSON) @@ -92,10 +94,12 @@ func run(t *testing.T, file string) { decOpt.WhitespaceAsComments = false if err := UnmarshalWithOptions(testContent, &node, decOpt); err != nil { t.Error(err) + return } actualCm2, err = Marshal(node) if err != nil { t.Error(err) + return } if len(actualCm2) > 0 && actualCm2[len(actualCm2)-1] != '\n' { actualCm2 = append(actualCm2, '\n') @@ -106,10 +110,12 @@ func run(t *testing.T, file string) { var node Node if err := Unmarshal(testContent, &node); err != nil { t.Error(err) + return } actualCm3, err = Marshal(node) if err != nil { t.Error(err) + return } if len(actualCm3) > 0 && actualCm3[len(actualCm3)-1] != '\n' { actualCm3 = append(actualCm3, '\n') @@ -146,6 +152,7 @@ func run(t *testing.T, file string) { err = Unmarshal(actualCm2, &roundTrip) if err != nil { t.Error(err) + return } if !reflect.DeepEqual(data, roundTrip) { t.Errorf("cm2 roundtrip failed!") @@ -163,6 +170,7 @@ func run(t *testing.T, file string) { err = Unmarshal(actualCm3, &roundTrip) if err != nil { t.Error(err) + return } if !reflect.DeepEqual(data, roundTrip) { t.Errorf("cm3 roundtrip failed!")