Verify integrity of JSOM messages sent to debugger client

runtime/platform/json.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "platform/json.h"
 
 #include "platform/assert.h"
 #include "platform/globals.h"
 #include "platform/utils.h"
 #include "vm/os.h"
@@ skipping 184 matching lines @@
       }
   }
 }
 
 
 JSONReader::JSONReader(const char* json_object)
 : scanner_(json_object) {
   Set(json_object);
 }
 
+
 void JSONReader::Set(const char* json_object) {
   scanner_.SetText(json_object);
   json_object_ = json_object;
   error_ = false;
 }
 
 
+bool JSONReader::CheckMessage() {
+  scanner_.SetText(json_object_);
+  scanner_.Scan();
+  CheckObject();
+  return true;
+}
+
+
+void JSONReader::CheckValue() {
+  switch (scanner_.CurrentToken()) {
+    case JSONScanner::TokenLBrace:
+      CheckObject();
+      break;
+    case JSONScanner::TokenLBrack:
+      CheckArray();
+      break;
+    case JSONScanner::TokenString: {
+      // Check the encoding.
+      const char* s = ValueChars();
+      int remaining = ValueLen();
+      while (remaining > 0) {
+        if ((*s == '\n') || (*s == '\t')) {
+          OS::Print("Un-escaped character in JSON string: '%s'\n",
+                    ValueChars());
+          ASSERT(!"illegal character in JSON string value");

[Tom Ball, 2013/01/24 23:28:23]

Assert when checking caller data? Seems an exception is better here.

[hausner, 2013/01/24 23:35:15]

We don't use exceptions in our C++ code. Asserting is fine, since the
debugger/json code is supposed to escape all strings. If we do find an
un-escaped value, it's an internal error.

+        }
+        s++;
+        remaining--;
+      }
+      scanner_.Scan();
+      break;
+    }
+    case JSONScanner::TokenInteger:
+    case JSONScanner::TokenTrue:
+    case JSONScanner::TokenFalse:
+    case JSONScanner::TokenNull:
+      scanner_.Scan();
+      break;
+    default:
+      OS::Print("Malformed JSON: expected a value but got '%s'\n",
+                scanner_.TokenChars());
+      ASSERT(!"illegal JSON value found");
+  }
+}
+
+#define CHECK_TOKEN(token)                                                     \
+  if (scanner_.CurrentToken() != token) {                                      \
+    OS::Print("Malformed JSON: expected %s but got '%s'\n",                    \
+              #token, scanner_.TokenChars());                                  \
+  }                                                                            \
+  ASSERT(scanner_.CurrentToken() == token);
+
+void JSONReader::CheckArray() {
+  CHECK_TOKEN(JSONScanner::TokenLBrack);
+  scanner_.Scan();
+  while (scanner_.CurrentToken() != JSONScanner::TokenRBrack) {
+    CheckValue();
+    if (scanner_.CurrentToken() != JSONScanner::TokenComma) {
+      break;
+    }
+    scanner_.Scan();
+  }
+  CHECK_TOKEN(JSONScanner::TokenRBrack);
+  scanner_.Scan();
+}
+
+
+void JSONReader::CheckObject() {
+  CHECK_TOKEN(JSONScanner::TokenLBrace);
+  scanner_.Scan();
+  while (scanner_.CurrentToken() == JSONScanner::TokenString) {
+    scanner_.Scan();
+    CHECK_TOKEN(JSONScanner::TokenColon);
+    scanner_.Scan();
+    CheckValue();
+    if (scanner_.CurrentToken() != JSONScanner::TokenComma) {
+      break;
+    }
+    scanner_.Scan();
+  }
+  CHECK_TOKEN(JSONScanner::TokenRBrace);
+  scanner_.Scan();
+}
+
+#undef CHECK_TOKEN
+
+
 bool JSONReader::Seek(const char* name) {
   error_ = false;
   scanner_.SetText(json_object_);
   scanner_.Scan();
   if (scanner_.CurrentToken() != JSONScanner::TokenLBrace) {
     error_ = true;
     return false;
   }
   scanner_.Scan();
   if (scanner_.CurrentToken() == JSONScanner::TokenRBrace) {
@@ skipping 245 matching lines @@
     // the debugger front-end.
     intptr_t new_size = buf_size_ + len + kBufferSpareCapacity;
     char* new_buf = reinterpret_cast<char*>(realloc(buf_, new_size));
     ASSERT(new_buf != NULL);
     buf_ = new_buf;
     buf_size_ = new_size;
   }
 }
 
 }  // namespace dart