fix: Reject JSON with duplicate keys (#2073)

jitsi · Nov 29, 2023 · 73fb0cf · 73fb0cf
1 parent 814bffd
commit 73fb0cf
Show file tree

Hide file tree

Showing 2 changed files with 46 additions and 0 deletions.
diff --git a/jvb/src/main/kotlin/org/jitsi/videobridge/message/BridgeChannelMessage.kt b/jvb/src/main/kotlin/org/jitsi/videobridge/message/BridgeChannelMessage.kt
@@ -23,6 +23,7 @@ import com.fasterxml.jackson.annotation.JsonInclude
 import com.fasterxml.jackson.annotation.JsonProperty
 import com.fasterxml.jackson.annotation.JsonSubTypes
 import com.fasterxml.jackson.annotation.JsonTypeInfo
+import com.fasterxml.jackson.core.JsonParser
 import com.fasterxml.jackson.core.JsonProcessingException
 import com.fasterxml.jackson.databind.JsonMappingException
 import com.fasterxml.jackson.databind.MapperFeature
@@ -86,6 +87,7 @@ sealed class BridgeChannelMessage {
     companion object {
         private val mapper = jacksonObjectMapper().apply {
             enable(MapperFeature.ACCEPT_CASE_INSENSITIVE_ENUMS)
+            enable(JsonParser.Feature.STRICT_DUPLICATE_DETECTION)
         }
 
         @JvmStatic

diff --git a/jvb/src/test/kotlin/org/jitsi/videobridge/message/BridgeChannelMessageTest.kt b/jvb/src/test/kotlin/org/jitsi/videobridge/message/BridgeChannelMessageTest.kt
@@ -15,6 +15,7 @@
  */
 package org.jitsi.videobridge.message
 
+import com.fasterxml.jackson.core.JsonParseException
 import com.fasterxml.jackson.core.JsonProcessingException
 import com.fasterxml.jackson.databind.ObjectMapper
 import com.fasterxml.jackson.databind.exc.InvalidTypeIdException
@@ -65,6 +66,49 @@ class BridgeChannelMessageTest : ShouldSpec() {
             shouldThrow<InvalidTypeIdException> {
                 parse("""{"colibriClass": "invalid-colibri-class" }""")
             }
+            shouldThrow<JsonParseException> {
+                parse(
+                    """
+                {
+                  "colibriClass": "EndpointStats",
+                  "colibriClass": "duplicate"
+                }
+                    """.trimIndent()
+                )
+            }
+            shouldThrow<JsonParseException> {
+                parse(
+                    """
+                {
+                  "colibriClass": "EndpointStats",
+                  "to": "a",
+                  "to": "b"
+                }
+                    """.trimIndent()
+                )
+            }
+            shouldThrow<JsonParseException> {
+                parse(
+                    """
+                {
+                  "colibriClass": "EndpointStats",
+                  "from": "a",
+                  "from": "b"
+                }
+                    """.trimIndent()
+                )
+            }
+            shouldThrow<JsonParseException> {
+                parse(
+                    """
+                {
+                  "colibriClass": "EndpointStats",
+                  "non-defined-prop": "a",
+                  "non-defined-prop": "b"
+                }
+                    """.trimIndent()
+                )
+            }
 
             context("when some of the message-specific fields are missing/invalid") {
                 shouldThrow<JsonProcessingException> {