============================================================================= Gate D: Deep-nesting stack safety (CVE-2020-29652 class) ============================================================================= runDeepNestingDepths runs json.Unmarshal on deeply-nested arrays at the specified depth
(t *testing.T, depths []int)
| 304 | // unclosed shape forces the parser to descend fully before discovering the |
| 305 | // missing closers, which is the more dangerous stack-overflow trigger. |
| 306 | func runDeepNestingDepths(t *testing.T, depths []int) { |
| 307 | t.Helper() |
| 308 | for _, depth := range depths { |
| 309 | depth := depth |
| 310 | for _, closed := range []bool{true, false} { |
| 311 | closed := closed |
| 312 | shape := "closed" |
| 313 | if !closed { |
| 314 | shape = "unclosed" |
| 315 | } |
| 316 | t.Run(fmt.Sprintf("depth_%d_%s", depth, shape), func(t *testing.T) { |
| 317 | data := genDeepNesting(depth, closed) |
| 318 | var v interface{} |
| 319 | encodingJSONNoPanic(t, "DeepNesting/Unmarshal", data, func() { |
| 320 | // We deliberately discard the error: success OR a clean |
| 321 | // error are both acceptable. Only a panic is a failure. |
| 322 | _ = json.Unmarshal(data, &v) |
| 323 | }) |
| 324 | }) |
| 325 | } |
| 326 | } |
| 327 | } |
| 328 | |
| 329 | // ============================================================================= |
| 330 | // Gate E: Streaming Decoder vs one-shot Unmarshal consistency |
no test coverage detected