Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

Summary

fromJSON and fromCrossJSON used two node fields without checking them.

• An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp.
• A sequence node's done index was not checked. A crafted value produced an iterator that never finished.

Impact

A service that passes untrusted input to fromJSON or fromCrossJSON can be made unavailable by an unauthenticated request.

• The array case blocks the thread while the decoder runs.
• The sequence case makes any code that reads the resulting iterator to the end run forever.

Patches

Fixed in seroval@1.6.8.

• Element lists must be arrays.
• A sequence node's throw and done indices must be integers from -1 up to the last element index.

Invalid input throws SerovalMalformedNodeError.

Workarounds

None. Upgrade to 1.6.8.