java - Extraneous postfixed data in JSON for POST method -

i wondering if can tell me if problem worth consider or how can fix if needed.

we have web service written in java built using spring boot , running on amazon aws. used our other products , services internally. though endpoint public, there authentication prevents public access.

one of our api accepts json parameter post method. our qe pointed out our api not detect extraneous data following json data. example, assuming our api expects data like:

{   "name": "john doe",   "email": "john.doe@example.com" } 

our api not complain if following data given:

{   "name": "john doe",   "email": "john.doe@example.com" } hello, i’m ignored! 

our api ignores extraneous portion completely. use jackson deserialize json string. looked jackson , spring documentation not able find out how can detected.

so, question is: security threat? if so, how can fixed?

thanks,

masa

i digged jackson source code little bit , conclusion follow. when parsing json object, jackson parse values , make object, , check if parser reached end ("}"). can see string append after "}" won't taken jackson. , jackson ignore them , won't throw exception.

i don't think cause safety issue, since string after "}" ignored, never used inside jackson , hence no chance go app. if don't want this, can use interceptor check.

hope you.

protected object _unwrapanddeserialize(jsonparser p, deserializationcontext ctxt,          deserializationconfig config,         javatype roottype, jsondeserializer<object> deser)     throws ioexception {      ...     // ok, move value itself....     p.nexttoken();     object result = deser.deserialize(p, ctxt);     // , last, verify matching end_object     if (p.nexttoken() != jsontoken.end_object) {         ctxt.reportwrongtokenexception(p, jsontoken.end_object,                 "current token not end_object (to match wrapper object root name '%s'), %s",                 expsimplename, p.getcurrenttoken());     }     return result; } 

the enum

/* jackson json-processor.  *  * copyright (c) 2007- tatu saloranta, tatu.saloranta@iki.fi  */  package com.fasterxml.jackson.core;  /**  * enumeration basic token types used returning results  * of parsing json content.  */ public enum jsontoken {   ...     /**      * end_object returned when encountering '}'      * signals ending of object value      */     end_object("}", jsontokenid.id_end_object), ...