jsonc 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8181db363d5c3a12bad8d2a213121d4b790b41eef2eb47951a2133ab982e97fe
-  data.tar.gz: 9ebd700ac4b38e1db67d6b0820115b2e6d29069a672a9dae079c097159f41a16
+  metadata.gz: e1d2ee7ef746b211de8ddbb7e3f3d59b6c1a88b127f7525dd0f8dfb113e28ec2
+  data.tar.gz: a8ea35764e44a8c04edd4597773410779ce06b0e2710c0e7d0932bd503f9ff1f
 SHA512:
-  metadata.gz: 04f4d89a5d3b73ea2eb6d1b9a75d3abeda31e95d23b71e447d8b4fb9573670bfaa74197815255caec9af7021f9135fc750804b50f6e27c7bc24acf0908967d97
-  data.tar.gz: 60e5016c2360518153ae492a43948f7980cc4810c66e80ab00014799e0a5c885b5bb2ee488e84123e978df090c6f0736959cd9a3cb1ffb078eb3e498e0e62d89
+  metadata.gz: 7d25cdaca0214cb294ae5240c8f1874b7ac37670c656813026c66e44ef9f77ba78f586667074a0ca94ca50ab8a9a0c57fbcdbee1da3fa8dab3a78669ee723b42
+  data.tar.gz: d6676e4ffe049525e0530e98215b0f599d12a08652404f1d8ac4e0f95e7c55e69eb800fa75bdd441a266b060ed3c4e5ee1409c0a1e6054023faa28b7892048fb

data/CHANGELOG.md

@@ -1,5 +1,25 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
 ## [Unreleased]
 
+## [0.2.0] - 2026-01-09
+
+### Security
+
+- Fixed out-of-bounds string access vulnerability in parser that caused crashes when processing malformed input with trailing backslash
+- Added `max_bytes` option to `JSONC.parse` and `JSONC.load_file` methods to prevent memory exhaustion DoS attacks (default: 10MB)
+
 ## [0.1.0] - 2025-08-24
 
+### Added
+
 - Initial release
+
+[unreleased]: https://github.com/ytkg/jsonc/compare/v0.2.0...HEAD
+[0.2.0]: https://github.com/ytkg/jsonc/compare/v0.1.0...v0.2.0
+[0.1.0]: https://github.com/ytkg/jsonc/releases/tag/v0.1.0

data/README.md

@@ -54,6 +54,25 @@ puts parsed_hash["name"]
 # => Jules
 ```
 
+#### Size Limit
+
+To prevent memory exhaustion from malicious or excessively large inputs, you can set a `max_bytes` limit (default: 10MB):
+
+```ruby
+# Default 10MB limit
+JSONC.parse(jsonc_string)
+
+# Custom size limit (50MB)
+JSONC.parse(large_jsonc_string, max_bytes: 52_428_800)
+
+# Also works with load_file (checks file size before reading)
+JSONC.load_file('config.jsonc', max_bytes: 1_048_576)  # 1MB
+```
+
+Exceeding the size limit raises a `JSON::ParserError`.
+
+**Note**: The size limit applies to the raw JSONC input (including comments and whitespace) before sanitization. This means files with extensive comments count toward the limit.
+
 ### Loading a File
 
 Use `JSONC.load_file` in place of `JSON.load_file`.

data/lib/jsonc/parser/comment_remover.rb

@@ -50,8 +50,13 @@ module JSONC
       def parse_string
         char = @string[@index]
         if char == "\\"
-          @result << char << @string[@index + 1]
-          @index += 2
+          @result << char
+          if @index + 1 < @string.length
+            @result << @string[@index + 1]
+            @index += 2
+          else
+            @index += 1
+          end
         elsif char == '"'
           @state = :normal
           @result << char

data/lib/jsonc/parser/trailing_comma_remover.rb

@@ -38,8 +38,13 @@ module JSONC
       def parse_string # rubocop:disable Metrics/MethodLength
         char = @string[@index]
         if char == "\\"
-          @result << char << @string[@index + 1]
-          @index += 2
+          @result << char
+          if @index + 1 < @string.length
+            @result << @string[@index + 1]
+            @index += 2
+          else
+            @index += 1
+          end
         elsif char == '"'
           @state = :normal
           @result << char

data/lib/jsonc/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSONC
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

data/lib/jsonc.rb

@@ -7,12 +7,28 @@ require_relative "jsonc/parser"
 module JSONC
   class Error < StandardError; end
 
+  DEFAULT_MAX_BYTES = 10_485_760 # 10MB
+
   def self.parse(string, **opts)
+    max_bytes = opts.delete(:max_bytes) || DEFAULT_MAX_BYTES
+    if string.bytesize > max_bytes
+      raise JSON::ParserError,
+            "input string too large (#{string.bytesize} bytes, max #{max_bytes} bytes)"
+    end
+
     sanitized_string = Parser.parse(string)
     JSON.parse(sanitized_string, **opts)
   end
 
   def self.load_file(path, **opts)
+    max_bytes = opts.delete(:max_bytes) || DEFAULT_MAX_BYTES
+    file_size = File.size(path)
+
+    if file_size > max_bytes
+      raise JSON::ParserError,
+            "file too large (#{file_size} bytes, max #{max_bytes} bytes)"
+    end
+
     parse(File.read(path), **opts)
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jsonc
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Yoshiki Takagi
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-08-26 00:00:00.000000000 Z
+date: 2026-01-09 00:00:00.000000000 Z
 dependencies: []
 description: A simple parser for JSONC (JSON with comments).
 email: