Handle block comments ending in **/ in the JSON parser

Handle block comments ending in **/ in the JSON parser

BUG=177585
TEST=Covered by base_unittests --gtest_filter=JSONReaderTest.Reading


Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=188120

[tapted, 2013-03-12 00:30:27]

Hi Robert, came across this during triage - the bug was quiet so I decided just
to put up a patch ;).

Let me know if you think this bug has security implications, or I should request
a merge.

Thanks.

[Robert Sesek, 2013-03-12 00:58:39]

LGTM

I don't think this has security implications. The only thing that an attacker
would be able to do is create some form of invalid JSON, which would return as
an error. The other thing they could do is omit portions of a JSON file using
this greediness problem, but since they're already in control of the JSON I
don't think that's much of an issue. Do you have other ideas as to how this
could be used?

Also, please don't remove chromium-reviews@chromium.org from the CC as that's
the public review log.

[tapted, 2013-03-12 02:09:46]

+brettw for src/base OWNERS

On 2013/03/12 00:58:39, rsesek wrote:
> Do you have other ideas as to how this could be used?

You can also add portions of JSON. There's note on the bug at
http://crbug.com/177585#c2

Something like

/* **/
// */ permissions = [ bad_stuff_that_looks_commented_out_but_is_not ]

I don't think it's exploitable, but I don't know all the places this parser is
used.


> Also, please don't remove mailto:chromium-reviews@chromium.org from the CC as
that's
> the public review log.

Sorry - that was a tip from an old chrome-team thread - I think I groked it
wrong :/

[tapted, 2013-03-13 22:22:02]

ping brettw for base/ OWNERS

[brettw, 2013-03-14 04:19:18]

lgtm

[commit-bot: I haz the power, 2013-03-14 04:34:37]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/tapted@chromium.org/12476030/3003

[commit-bot: I haz the power, 2013-03-14 17:45:27]

Change committed as 188120