Skip to content

fix: prevent CPU runaway in HttpNodesStatsAction JSON parsing #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
marevol merged 2 commits into from
Mar 22, 2026
Merged

fix: prevent CPU runaway in HttpNodesStatsAction JSON parsing #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2b58183
fix: prevent CPU runaway in HttpNodesStatsAction JSON parsing (#18)
marevol Mar 22, 2026
8ce3543
fix: handle initial parser state and reduce test log output
marevol Mar 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 20 additions & 1 deletion src/main/java/org/codelibs/fesen/client/action/HttpNodesStatsAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,8 +157,14 @@ protected NodesStatsResponse fromXContent(final XContentParser parser) throws IO
List<NodeStats> nodes = Collections.emptyList();
String fieldName = null;
ClusterName clusterName = ClusterName.DEFAULT;
if (parser.currentToken() == null) {
parser.nextToken();
}
XContentParser.Token token;
while ((token = parser.currentToken()) != XContentParser.Token.END_OBJECT) {
if (token == null) {
throw new IOException("Unexpected end of JSON stream while parsing NodesStatsResponse");
}
if (token == XContentParser.Token.FIELD_NAME) {
fieldName = parser.currentName();
} else if (token == XContentParser.Token.START_OBJECT) {
Expand All @@ -181,6 +187,9 @@ protected List<NodeStats> parseNodes(final XContentParser parser) throws IOExcep
String fieldName = null;
XContentParser.Token token;
while ((token = parser.currentToken()) != XContentParser.Token.END_OBJECT) {
if (token == null) {
throw new IOException("Unexpected end of JSON stream while parsing nodes");
}
if (token == XContentParser.Token.FIELD_NAME) {
fieldName = parser.currentName();
} else if (token == XContentParser.Token.START_OBJECT) {
Expand All @@ -193,7 +202,6 @@ protected List<NodeStats> parseNodes(final XContentParser parser) throws IOExcep
}

protected NodeStats parseNodeStats(final XContentParser parser, final String nodeId) throws IOException {
new ArrayList<>();
String fieldName = null;
String nodeName = "";
long timestamp = 0;
Expand Down Expand Up @@ -230,6 +238,9 @@ protected NodeStats parseNodeStats(final XContentParser parser, final String nod
XContentParser.Token token;
TransportAddress transportAddress = new TransportAddress(TransportAddress.META_ADDRESS, 0);
while ((token = parser.currentToken()) != XContentParser.Token.END_OBJECT) {
if (token == null) {
throw new IOException("Unexpected end of JSON stream while parsing node stats for " + nodeId);
}
if (token == XContentParser.Token.FIELD_NAME) {
fieldName = parser.currentName();
} else if (token == XContentParser.Token.START_OBJECT) {
Expand Down Expand Up @@ -399,6 +410,7 @@ protected SearchBackpressureStats parseSearchBackpressureStats(final XContentPar
if (token == XContentParser.Token.FIELD_NAME) {
fieldName = parser.currentName();
} else if (token == XContentParser.Token.START_OBJECT) {
parser.nextToken();
if ("search_task".equals(fieldName) || "search_shard_task".equals(fieldName)) {
consumeObject(parser);
} else {
Expand Down Expand Up @@ -544,6 +556,7 @@ protected TaskCancellationStats parseTaskCancellationStats(final XContentParser
if (token == XContentParser.Token.FIELD_NAME) {
fieldName = parser.currentName();
} else if (token == XContentParser.Token.START_OBJECT) {
parser.nextToken();
if ("search_task".equals(fieldName)) {
searchTaskCancellationStats = parseSearchTaskCancellationStats(parser);
} else if ("search_shard_task".equals(fieldName)) {
Expand Down Expand Up @@ -606,6 +619,7 @@ protected SearchPipelineStats parseSearchPipelineStats(final XContentParser pars
if (token == XContentParser.Token.FIELD_NAME) {
fieldName = parser.currentName();
} else if (token == XContentParser.Token.START_OBJECT) {
parser.nextToken();
if ("total_request".equals(fieldName)) {
totalRequestStats = parseOperationStats(parser);
} else if ("total_response".equals(fieldName)) {
Expand Down Expand Up @@ -2322,9 +2336,14 @@ protected int[] parseNodeResults(final XContentParser parser) throws IOException
protected void consumeObject(final XContentParser parser) throws IOException {
XContentParser.Token token;
while ((token = parser.currentToken()) != XContentParser.Token.END_OBJECT) {
if (token == null) {
throw new IOException("Unexpected end of JSON stream while consuming object");
}
if (token == XContentParser.Token.START_OBJECT) {
parser.nextToken();
consumeObject(parser);
} else if (token == XContentParser.Token.START_ARRAY) {
parser.skipChildren();
}
parser.nextToken();
}
Expand Down
4 changes: 2 additions & 2 deletions src/test/java/org/codelibs/fesen/client/Elasticsearch7ClientTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,10 +131,10 @@ static void setUpAll() {
static void setupLogger() {
System.setProperty("java.util.logging.SimpleFormatter.format", "%1$tY-%1$tm-%1$td %1$tH:%1$tM:%1$tS %4$s %2$s %5$s%6$s%n");
final Logger rootLogger = Logger.getLogger("");
rootLogger.setLevel(Level.ALL);
rootLogger.setLevel(Level.INFO);
final ConsoleHandler handler = new ConsoleHandler();
handler.setFormatter(new SimpleFormatter());
handler.setLevel(Level.ALL);
handler.setLevel(Level.INFO);
rootLogger.addHandler(handler);
}

Expand Down
4 changes: 2 additions & 2 deletions src/test/java/org/codelibs/fesen/client/Elasticsearch8ClientTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,10 +130,10 @@ static void setUpAll() {
static void setupLogger() {
System.setProperty("java.util.logging.SimpleFormatter.format", "%1$tY-%1$tm-%1$td %1$tH:%1$tM:%1$tS %4$s %2$s %5$s%6$s%n");
final Logger rootLogger = Logger.getLogger("");
rootLogger.setLevel(Level.ALL);
rootLogger.setLevel(Level.INFO);
final ConsoleHandler handler = new ConsoleHandler();
handler.setFormatter(new SimpleFormatter());
handler.setLevel(Level.ALL);
handler.setLevel(Level.INFO);
rootLogger.addHandler(handler);
}

Expand Down
4 changes: 2 additions & 2 deletions src/test/java/org/codelibs/fesen/client/OpenSearch1ClientTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,10 +131,10 @@ static void setUpAll() {
static void setupLogger() {
System.setProperty("java.util.logging.SimpleFormatter.format", "%1$tY-%1$tm-%1$td %1$tH:%1$tM:%1$tS %4$s %2$s %5$s%6$s%n");
final Logger rootLogger = Logger.getLogger("");
rootLogger.setLevel(Level.ALL);
rootLogger.setLevel(Level.INFO);
final ConsoleHandler handler = new ConsoleHandler();
handler.setFormatter(new SimpleFormatter());
handler.setLevel(Level.ALL);
handler.setLevel(Level.INFO);
rootLogger.addHandler(handler);
}

Expand Down
4 changes: 2 additions & 2 deletions src/test/java/org/codelibs/fesen/client/OpenSearch2ClientTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,10 +131,10 @@ static void setUpAll() {
static void setupLogger() {
System.setProperty("java.util.logging.SimpleFormatter.format", "%1$tY-%1$tm-%1$td %1$tH:%1$tM:%1$tS %4$s %2$s %5$s%6$s%n");
final Logger rootLogger = Logger.getLogger("");
rootLogger.setLevel(Level.ALL);
rootLogger.setLevel(Level.INFO);
final ConsoleHandler handler = new ConsoleHandler();
handler.setFormatter(new SimpleFormatter());
handler.setLevel(Level.ALL);
handler.setLevel(Level.INFO);
rootLogger.addHandler(handler);
}

Expand Down
4 changes: 2 additions & 2 deletions src/test/java/org/codelibs/fesen/client/OpenSearch3ClientTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,10 +131,10 @@ static void setUpAll() {
static void setupLogger() {
System.setProperty("java.util.logging.SimpleFormatter.format", "%1$tY-%1$tm-%1$td %1$tH:%1$tM:%1$tS %4$s %2$s %5$s%6$s%n");
final Logger rootLogger = Logger.getLogger("");
rootLogger.setLevel(Level.ALL);
rootLogger.setLevel(Level.INFO);
final ConsoleHandler handler = new ConsoleHandler();
handler.setFormatter(new SimpleFormatter());
handler.setLevel(Level.ALL);
handler.setLevel(Level.INFO);
rootLogger.addHandler(handler);
}

Expand Down
Loading
Loading