Merge pull request #71 from yuzawa-san/fibonacci-limit

Enforce limits on ranges

Author: aitnitishshelage

iabgpp-encoder/src/main/java/com/iab/gpp/encoder/datatype/encoder/FibonacciIntegerEncoder.java

@@ -39,6 +39,11 @@ public static String encode(int value) {
   }
 
   public static int decode(String bitString) throws DecodingException {
+    // enforce a length restriction to avoid overflows
+    // 2^16 has a bit string length of 24
+    if (bitString.length() > 24) {
+      throw new DecodingException("FibonacciInteger too long");
+    }
     if (!BITSTRING_VERIFICATION_PATTERN.matcher(bitString).matches() || bitString.length() < 2
         || bitString.indexOf("11") != bitString.length() - 2) {
       throw new DecodingException("Undecodable FibonacciInteger '" + bitString + "'");

iabgpp-encoder/src/main/java/com/iab/gpp/encoder/datatype/encoder/FibonacciIntegerRangeEncoder.java

@@ -3,11 +3,16 @@
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
+import java.util.logging.Logger;
 import java.util.regex.Pattern;
 import com.iab.gpp.encoder.error.DecodingException;
 
 public class FibonacciIntegerRangeEncoder {
 
+  private static final Logger LOGGER = Logger.getLogger(FibonacciIntegerRangeEncoder.class.getName());
+  // NOTE: This is a value roughly the 2x the size of this list
+  // https://tools.iabtechlab.com/transparencycenter/explorer/business/gpp
+  static final int MAX_SIZE = 8192;
   private static Pattern BITSTRING_VERIFICATION_PATTERN = Pattern.compile("^[0-1]*$", Pattern.CASE_INSENSITIVE);
 
   public static String encode(List<Integer> value) {
@@ -70,13 +75,21 @@ public static List<Integer> decode(String bitString) throws DecodingException {
         offset = end;
         startIndex = index + 2;
 
+        if (value.size() + (end - start) > MAX_SIZE) {
+          LOGGER.warning("FibonacciIntegerRange has too many values");
+          break;
+        }
         for (int j = start; j <= end; j++) {
           value.add(j);
         }
       } else {
         int index = bitString.indexOf("11", startIndex);
         int val = FibonacciIntegerEncoder.decode(bitString.substring(startIndex, index + 2)) + offset;
         offset = val;
+        if (value.size() == MAX_SIZE) {
+          LOGGER.warning("FibonacciIntegerRange has too many values");
+          break;
+        }
         value.add(val);
         startIndex = index + 2;
       }

iabgpp-encoder/src/main/java/com/iab/gpp/encoder/datatype/encoder/FixedIntegerRangeEncoder.java

@@ -3,11 +3,16 @@
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
+import java.util.logging.Logger;
 import java.util.regex.Pattern;
 import com.iab.gpp.encoder.error.DecodingException;
 
 public class FixedIntegerRangeEncoder {
 
+  private static final Logger LOGGER = Logger.getLogger(FixedIntegerRangeEncoder.class.getName());
+  // NOTE: This is a value roughly the 2x the size of this list
+  // https://tools.iabtechlab.com/transparencycenter/explorer/business/gpp
+  private static final int MAX_SIZE = 8192;
   private static Pattern BITSTRING_VERIFICATION_PATTERN = Pattern.compile("^[0-1]*$", Pattern.CASE_INSENSITIVE);
 
   public static String encode(List<Integer> value) {
@@ -58,11 +63,22 @@ public static List<Integer> decode(String bitString) throws DecodingException {
         int end = FixedIntegerEncoder.decode(bitString.substring(startIndex, startIndex + 16));
         startIndex += 16;
 
+        if (end < start) {
+          throw new DecodingException("FixedIntegerRange has invalid range");
+        }
+        if (value.size() + (end - start) > MAX_SIZE) {
+          LOGGER.warning("FixedIntegerRange has too many values");
+          break;
+        }
         for (int j = start; j <= end; j++) {
           value.add(j);
         }
       } else {
         int val = FixedIntegerEncoder.decode(bitString.substring(startIndex, startIndex + 16));
+        if (value.size() == MAX_SIZE) {
+          LOGGER.warning("FixedIntegerRange has too many values");
+          break;
+        }
         value.add(val);
         startIndex += 16;
       }

iabgpp-encoder/src/test/java/com/iab/gpp/encoder/datatype/encoder/FibonacciIntegerEncoderTest.java

@@ -1,5 +1,6 @@
 package com.iab.gpp.encoder.datatype.encoder;
 
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
 import com.iab.gpp.encoder.error.DecodingException;
@@ -100,4 +101,9 @@ public void testDecode10() {
     }
   }
 
+  @Test
+  public void testDecodeTooLarge() {
+    String large = FibonacciIntegerEncoder.encode(2 << 17);
+    assertThrows(DecodingException.class, () -> FibonacciIntegerEncoder.decode(large));
+  }
 }

iabgpp-encoder/src/test/java/com/iab/gpp/encoder/datatype/encoder/FibonacciIntegerRangeEncoderTest.java

@@ -1,7 +1,9 @@
 package com.iab.gpp.encoder.datatype.encoder;
 
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.List;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
 import com.iab.gpp.encoder.error.DecodingException;
@@ -96,4 +98,10 @@ public void testDecode8() {
 
     }
   }
+
+  @Test
+  public void testGiantRange() {
+    String max = FibonacciIntegerEncoder.encode(FibonacciIntegerRangeEncoder.MAX_SIZE + 1);
+    Assertions.assertEquals(List.of(), FibonacciIntegerRangeEncoder.decode("000000000001111" + max));
+  }
 }

iabgpp-encoder/src/test/java/com/iab/gpp/encoder/datatype/encoder/FixedIntegerRangeEncoderTest.java

@@ -1,7 +1,9 @@
 package com.iab.gpp.encoder.datatype.encoder;
 
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.List;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
 import com.iab.gpp.encoder.error.DecodingException;
@@ -126,4 +128,10 @@ public void testDecode10() {
 
     }
   }
+
+  @Test
+  public void testGiantRange() {
+    String max = FibonacciIntegerEncoder.encode(FibonacciIntegerRangeEncoder.MAX_SIZE + 1);
+    Assertions.assertEquals(List.of(), FixedIntegerRangeEncoder.decode("00000000000110000000000000001" + max));
+  }
 }