Skip to content

JsonSerializer.Deserialize<JsonNode> does not honor MaxDepth for deeply nested arrays #2

@steveisok

Description

@steveisok

Description

When deserializing a JSON payload containing many nested arrays into JsonNode, JsonSerializer.Deserialize<JsonNode> appears to either return a valid node or take an unexpectedly long time, rather than throwing once JsonSerializerOptions.MaxDepth is exceeded.

Repro

using System.Linq;
using System.Text.Json;
using System.Text.Json.Nodes;

string json = string.Concat(Enumerable.Repeat("[", 200))
            + string.Concat(Enumerable.Repeat("]", 200));

var options = new JsonSerializerOptions { MaxDepth = 32 };
var node = JsonSerializer.Deserialize<JsonNode>(json, options);
Console.WriteLine(node is null ? "null" : "non-null");

Expected

JsonException with a "Maximum depth exceeded" message.

Actual

The call either returns a non-null JsonNode or takes several seconds.

Notes

A regression test in the existing JsonNode test class would be appreciated.

Metadata

Metadata

Labels

No labels
No labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions