From 82ab100c7e6334dc6fa92e92c8838ecc622118d5 Mon Sep 17 00:00:00 2001
From: Jokler <jokler.contact@gmail.com>
Date: Sat, 30 Jun 2018 02:27:24 +0200
Subject: Factoids: Add max recursion level to json.decode

---
 src/plugins/factoids/utils.rs | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/plugins/factoids/utils.rs b/src/plugins/factoids/utils.rs
index c3bd629..9352a43 100644
--- a/src/plugins/factoids/utils.rs
+++ b/src/plugins/factoids/utils.rs
@@ -36,7 +36,11 @@ pub fn download(_: &Lua, url: String) -> Result<String, LuaError> {
     }
 }
 
-fn convert_value(lua: &Lua, sval: SerdeValue) -> Result<LuaValue, LuaError> {
+fn convert_value(lua: &Lua, sval: SerdeValue, max_recurs: usize) -> Result<LuaValue, LuaError> {
+    if max_recurs == 0 {
+        return Err(RuntimeError(String::from("Reached max recursion level - json is nested too deep")));
+    }
+
     let lval = match sval {
         SerdeValue::Null => LuaValue::Nil,
         SerdeValue::Bool(b) => LuaValue::Boolean(b),
@@ -48,7 +52,7 @@ fn convert_value(lua: &Lua, sval: SerdeValue) -> Result<LuaValue, LuaError> {
         SerdeValue::Array(arr) => {
             let table = lua.create_table()?;
             for (i, val) in arr.into_iter().enumerate() {
-                table.set(i + 1, convert_value(lua, val)?)?;
+                table.set(i + 1, convert_value(lua, val, max_recurs - 1)?)?;
             }
 
             LuaValue::Table(table)
@@ -56,7 +60,7 @@ fn convert_value(lua: &Lua, sval: SerdeValue) -> Result<LuaValue, LuaError> {
         SerdeValue::Object(obj) => {
             let table = lua.create_table()?;
             for (key, val) in obj {
-                table.set(key, convert_value(lua, val)?)?;
+                table.set(key, convert_value(lua, val, max_recurs - 1)?)?;
             }
 
             LuaValue::Table(table)
@@ -69,5 +73,5 @@ fn convert_value(lua: &Lua, sval: SerdeValue) -> Result<LuaValue, LuaError> {
 pub fn json_decode(lua: &Lua, json: String) -> Result<LuaValue, LuaError> {
     let ser_val: SerdeValue = serde_json::from_str(&json).map_err(|e| RuntimeError(e.to_string()))?;
 
-    convert_value(lua, ser_val)
+    convert_value(lua, ser_val, 25)
 }
-- 
cgit v1.2.3-70-g09d2