oauth: Limit JSON parsing depth in the client
Check the ctx->nested level as we go, to prevent a server from running
the client out of stack space.
The limit we choose when communicating with authorization servers can't
be overly strict, since those servers will continue to add extensions in
their JSON documents which we need to correctly ignore. For the SASL
communication, we can be more conservative, since there are no defined
extensions (and the peer is probably more Postgres code).
Reviewed-by: Aleksander Alekseev <aleksander@timescale.com>
Discussion: https://postgr.es/m/CAOYmi%2Bm71aRUEi0oQE9ciBnBS8xVtMn3CifaPu2kmJzUfhOZgA%40mail.gmail.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/cbc8fd0c9aec01f451af5e4eeb0eb2c5d5e47eb2
Modified Files
--------------
src/interfaces/libpq-oauth/oauth-curl.c | 26 ++++++++++++++++++
src/interfaces/libpq/fe-auth-oauth.c | 25 +++++++++++++++++
src/test/modules/oauth_validator/t/001_server.pl | 20 ++++++++++++++
src/test/modules/oauth_validator/t/oauth_server.py | 31 +++++++++++++++++-----
4 files changed, 96 insertions(+), 6 deletions(-)
