Skip to content

JsonConvert.DeserializeObject can throw several unexpected exceptions #1947

@Metalnem

Description

@Metalnem

JsonConvert.DeserializeObject can throw several unexpected exceptions (JsonReaderException is the one that is usually expected). These are:

  • ArgumentException
  • JsonSerializationException
  • JsonWriterException
  • NullReferenceException

Documentation doesn't say anything about this, but deserialization is definitely weird place for a JsonWriterException. ArgumentException and NullReferenceException should not be possible in my opinion (if the input strings are non-empty). Here is the complete program to reproduce all of this:

using System;

namespace Newtonsoft.Json.Run
{
  public class Program
  {
    public static void Main(string[] args)
    {
      try
      {
        JsonConvert.DeserializeObject("[{\"click\":\"X\",\"Close()\"://[{\"click\":\"Kpen()\"},{\"cOOOOOOOOOO\u007f]}}}");
      }
      catch (ArgumentException) { }

      try
      {
        JsonConvert.DeserializeObject("{\"menu\":{\"id\":1,\"val\":\"X\",\"pop\":{\"a\":[{\"click\":\"Open()\"},{\"click\":\"Close()\"}]}}");
      }
      catch (JsonSerializationException) { }

      try
      {
        JsonConvert.DeserializeObject("{\"menu\":{\"id\":1,\"val\":\"X\",\"pop\":{\"a\":[{\"clicT\":\"Open()\"},");
      }
      catch (JsonWriterException) { }

      try
      {
        JsonConvert.DeserializeObject("[new\0([");
      }
      catch (NullReferenceException) { }
    }
  }
}

Found via SharpFuzz.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions