Fix CHEF-1292/PL-538: make JSON.parse/to_json default recursion depth

much higher than default of 19; wrap JSON with Chef::JSON (obj.to_json
becomes Chef::JSON.to_json(obj); JSON.parse becomes Chef::JSON.from_json;
JSON.pretty_generate becomes Chef::JSON.to_json_pretty); monkey-patch
Merb::Request to handle this; override Merb::Controller.display to use 
this; many other modifications to to_json/from_json calls to use 
Chef::JSON

1 files changed, 33 insertions, 0 deletions

diff --git a/chef-server-api/config/router.rb b/chef-server-api/config/router.rb
index a64f3383e6..da0840840e 100644
--- a/chef-server-api/config/router.rb
+++ b/chef-server-api/config/router.rb
@@ -112,4 +112,37 @@ Merb::Router.prepare do
 
   match('/').to(:controller => 'main', :action =>'index').name(:top)
 
+  # Need to monkey patch Merb so that it inflates JSON input with a higher
+  # recursion depth allowed (the default is 19). See CHEF-1292/PL-538.
+  module Merb
+    class Request
+      # ==== Returns
+      # Hash:: Parameters from body if this is a JSON request.
+      #
+      # ==== Notes
+      # If the JSON object parses as a Hash, it will be merged with the
+      # parameters hash.  If it parses to anything else (such as an Array, or
+      # if it inflates to an Object) it will be accessible via the inflated_object
+      # parameter.
+      #
+      # :api: private
+      def json_params
+        @json_params ||= begin
+          if Merb::Const::JSON_MIME_TYPE_REGEXP.match(content_type)
+            begin
+              # Call Chef's JSON utility instead of the default in Merb, 
+              # JSON.parse.
+              jobj = Chef::JSON.from_json(raw_post)
+              jobj = jobj.to_mash if jobj.is_a?(Hash)
+            rescue JSON::ParserError
+              jobj = Mash.new
+            end
+            jobj.is_a?(Hash) ? jobj : { :inflated_object => jobj }
+          end
+        end
+      end
+
+    end
+  end
+
 end