ruby--ruby/spec/ruby/security/cve_2020_10663_spec.rb

require_relative '../spec_helper'
require 'json'

module JSONSpecs
  class MyClass
    def initialize(foo)
      @foo = foo
    end

    def self.json_create(hash)
      new(*hash['args'])
    end

    def to_json(*args)
      { 'json_class' => self.class.name, 'args' => [ @foo ] }.to_json(*args)
    end
  end
end

guard -> {
  JSON.const_defined?(:Pure) or
  version_is(JSON::VERSION, '2.3.0')
} do
  describe "CVE-2020-10663 is resisted by" do
    it "only creating custom objects if passed create_additions: true or using JSON.load" do
      obj = JSONSpecs::MyClass.new("bar")
      JSONSpecs::MyClass.should.json_creatable?
      json = JSON.dump(obj)

      JSON.parse(json, create_additions: true).class.should == JSONSpecs::MyClass
      JSON(json, create_additions: true).class.should == JSONSpecs::MyClass
      JSON.load(json).class.should == JSONSpecs::MyClass

      JSON.parse(json).class.should == Hash
      JSON.parse(json, nil).class.should == Hash
      JSON(json).class.should == Hash
    end
  end
end