Fix CHEF-1292/PL-538: make JSON.parse/to_json default recursion depth

much higher than default of 19; wrap JSON with Chef::JSON (obj.to_json
becomes Chef::JSON.to_json(obj); JSON.parse becomes Chef::JSON.from_json;
JSON.pretty_generate becomes Chef::JSON.to_json_pretty); monkey-patch
Merb::Request to handle this; override Merb::Controller.display to use 
this; many other modifications to to_json/from_json calls to use 
Chef::JSON

1 files changed, 12 insertions, 2 deletions

diff --git a/chef-server-api/app/controllers/application.rb b/chef-server-api/app/controllers/application.rb
index 72c1482087..0e2db2901e 100644
--- a/chef-server-api/app/controllers/application.rb
+++ b/chef-server-api/app/controllers/application.rb
@@ -22,6 +22,7 @@
 require "chef/mixin/checksum"
 require "chef/cookbook_loader"
 require "mixlib/authentication/signatureverification"
+require "chef/json"
 
 class Application < Merb::Controller
 
@@ -102,11 +103,11 @@ class Application < Merb::Controller
   def access_denied
     raise Unauthorized, "You must authenticate first!"
   end
-  
+
   def get_available_recipes
     all_cookbooks_list = Chef::CookbookVersion.cdb_list(true)
     available_recipes = all_cookbooks_list.sort{ |a,b| a.name.to_s <=> b.name.to_s }.inject([]) do |result, element|
-      element.recipes.sort.each do |r| 
+      element.recipes.sort.each do |r|
         if r =~ /^(.+)::default$/
           result << $1
         else
@@ -118,5 +119,14 @@ class Application < Merb::Controller
     available_recipes
   end
 
+  # Use Chef's JSON conversion library for sending JSON instead of the
+  # default Merb, which calls obj.to_json. Fixes CHEF-1292/PL-538.
+  override! :display
+  def display(obj)
+    super(obj, nil, {:max_nesting => Chef::JSON::JSON_MAX_NESTING})
+    #super.display(Chef::JSON.to_json(obj))
+    #Chef::JSON.to_json(obj)
+  end
+
 end