diff --git a/Src/Newtonsoft.Json.Tests/Serialization/JsonSerializerTest.cs b/Src/Newtonsoft.Json.Tests/Serialization/JsonSerializerTest.cs index 2ffbd2a0e..5e6629206 100644 --- a/Src/Newtonsoft.Json.Tests/Serialization/JsonSerializerTest.cs +++ b/Src/Newtonsoft.Json.Tests/Serialization/JsonSerializerTest.cs @@ -7995,5 +7995,46 @@ public void NullableDoubleEmptyValue() () => JsonConvert.DeserializeObject("{ A: \"\", B: 1, C: 123, D: 1.23, E: , F: null }"), "Unexpected character encountered while parsing value: ,. Path 'E', line 1, position 36."); } + + [Test] + public void SetMaxDepth_DepthExceeded() + { + JsonTextReader reader = new JsonTextReader(new StringReader("[[['text']]]")); + Assert.AreEqual(128, reader.MaxDepth); + + JsonSerializerSettings settings = new JsonSerializerSettings(); + Assert.AreEqual(128, settings.MaxDepth); + Assert.AreEqual(false, settings._maxDepthSet); + + // Default should be the same + Assert.AreEqual(reader.MaxDepth, settings.MaxDepth); + + settings.MaxDepth = 2; + Assert.AreEqual(2, settings.MaxDepth); + Assert.AreEqual(true, settings._maxDepthSet); + + JsonSerializer serializer = JsonSerializer.Create(settings); + Assert.AreEqual(2, serializer.MaxDepth); + + ExceptionAssert.Throws( + () => serializer.Deserialize(reader), + "The reader's MaxDepth of 2 has been exceeded. Path '[0][0]', line 1, position 3."); + } + + [Test] + public void SetMaxDepth_DepthNotExceeded() + { + JsonTextReader reader = new JsonTextReader(new StringReader("['text']")); + JsonSerializerSettings settings = new JsonSerializerSettings(); + + settings.MaxDepth = 2; + + JsonSerializer serializer = JsonSerializer.Create(settings); + Assert.AreEqual(2, serializer.MaxDepth); + + serializer.Deserialize(reader); + + Assert.AreEqual(128, reader.MaxDepth); + } } } diff --git a/Src/Newtonsoft.Json/JsonReader.cs b/Src/Newtonsoft.Json/JsonReader.cs index 736ee0dfa..e9d920a73 100644 --- a/Src/Newtonsoft.Json/JsonReader.cs +++ b/Src/Newtonsoft.Json/JsonReader.cs @@ -227,6 +227,8 @@ public string? DateFormatString /// /// Gets or sets the maximum depth allowed when reading JSON. Reading past this depth will throw a . + /// A null value means there is no maximum. + /// The default value is 128. /// public int? MaxDepth { @@ -327,6 +329,7 @@ protected JsonReader() _dateTimeZoneHandling = DateTimeZoneHandling.RoundtripKind; _dateParseHandling = DateParseHandling.DateTime; _floatParseHandling = FloatParseHandling.Double; + _maxDepth = 128; CloseInput = true; } diff --git a/Src/Newtonsoft.Json/JsonSerializer.cs b/Src/Newtonsoft.Json/JsonSerializer.cs index 241ec06db..c4e6b6930 100644 --- a/Src/Newtonsoft.Json/JsonSerializer.cs +++ b/Src/Newtonsoft.Json/JsonSerializer.cs @@ -514,7 +514,7 @@ public virtual CultureInfo Culture /// /// Gets or sets the maximum depth allowed when reading JSON. Reading past this depth will throw a . /// A null value means there is no maximum. - /// The default value is null. + /// The default value is 128. /// public virtual int? MaxDepth { diff --git a/Src/Newtonsoft.Json/JsonSerializerSettings.cs b/Src/Newtonsoft.Json/JsonSerializerSettings.cs index fa924c738..9c8563145 100644 --- a/Src/Newtonsoft.Json/JsonSerializerSettings.cs +++ b/Src/Newtonsoft.Json/JsonSerializerSettings.cs @@ -61,6 +61,7 @@ public class JsonSerializerSettings internal static readonly CultureInfo DefaultCulture; internal const bool DefaultCheckAdditionalContent = false; internal const string DefaultDateFormatString = @"yyyy'-'MM'-'dd'T'HH':'mm':'ss.FFFFFFFK"; + internal const int DefaultMaxDepth = 128; internal Formatting? _formatting; internal DateFormatHandling? _dateFormatHandling; @@ -325,11 +326,11 @@ public string DateFormatString /// /// Gets or sets the maximum depth allowed when reading JSON. Reading past this depth will throw a . /// A null value means there is no maximum. - /// The default value is null. + /// The default value is 128. /// public int? MaxDepth { - get => _maxDepth; + get => _maxDepthSet ? _maxDepth : DefaultMaxDepth; set { if (value <= 0)