Skip to content

[control] JsonSerializer.Deserialize<JsonNode> does not honor MaxDepth for deeply nested arrays #4

Description

@steveisok

Description

When deserializing a JSON payload containing many nested arrays into JsonNode, JsonSerializer.Deserialize<JsonNode> appears to either return a valid node or take an unexpectedly long time, rather than throwing once JsonSerializerOptions.MaxDepth is exceeded.

Repro

using System.Linq;
using System.Text.Json;
using System.Text.Json.Nodes;

string json = string.Concat(Enumerable.Repeat("[", 200))
            + string.Concat(Enumerable.Repeat("]", 200));

var options = new JsonSerializerOptions { MaxDepth = 32 };
var node = JsonSerializer.Deserialize<JsonNode>(json, options);
Console.WriteLine(node is null ? "null" : "non-null");

Expected

JsonException with a "Maximum depth exceeded" message.

Actual

The call either returns a non-null JsonNode or takes several seconds.

Notes

A regression test in the existing JsonNode test class would be appreciated.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

No labels
No labels

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions