json: 🐛Fix stack overflow deserializing empty JSON (#1293)

Fixes #1292 

The call to "token.ToObject<IQuantity>(serializer)" with an empty or
invalid json calls `JsonConvert.DeserializeObject` again and results in
infinite recursion and stack overflow.

### Changes
- Throw `JsonSerializationException` on invalid JSON in
`UnitsNetIQuantityJsonConverter`
- Include helpful info in exception, link to wiki, truncated JSON token
in message and full JSON token in `Data["JsonToken"]` property.
- Add tests for new behavior

---------

Co-authored-by: Andreas Gullberg Larsen <[email protected]>

Author: shaeussler

UnitsNet.Serialization.JsonNet.Tests/UnitsNetIComparableJsonConverterTest.cs

@@ -13,7 +13,7 @@ namespace UnitsNet.Serialization.JsonNet.Tests
 {
     public sealed class UnitsNetIComparableJsonConverterTest
     {
-        private UnitsNetIComparableJsonConverter _sut;
+        private readonly UnitsNetIComparableJsonConverter _sut;
 
         public UnitsNetIComparableJsonConverterTest()
         {

UnitsNet.Serialization.JsonNet.Tests/UnitsNetJsonDeserializationTests.cs

@@ -98,6 +98,24 @@ public void NullValue_ExpectNullReturned()
             Assert.Null(deserializedNullMass);
         }
 
+        [Fact]
+        public void EmptyJsonValue_NullableType_ExpectJsonSerializationException()
+        {
+            var ex = Assert.Throws<JsonSerializationException>(() => DeserializeObject<Mass?>("{}"));
+            Assert.Equal("Failed to deserialize IQuantity for target type System.Nullable`1[UnitsNet.Mass] from JSON '{}', expected properties Unit and Value.", ex.Message);
+            Assert.Equal("https://github.com/angularsen/UnitsNet/wiki/Serializing-to-JSON,-XML-and-more#unitsnetserializationjsonnet-with-jsonnet-newtonsoft", ex.HelpLink);
+            Assert.Equal("{}", ex.Data["JsonToken"]);
+        }
+
+        [Fact]
+        public void EmptyJsonValue_NonNullableType_ExpectJsonSerializationException()
+        {
+            var ex = Assert.Throws<JsonSerializationException>(() => DeserializeObject<Mass>("{}"));
+            Assert.Equal("Failed to deserialize IQuantity for target type UnitsNet.Mass from JSON '{}', expected properties Unit and Value.", ex.Message);
+            Assert.Equal("https://github.com/angularsen/UnitsNet/wiki/Serializing-to-JSON,-XML-and-more#unitsnetserializationjsonnet-with-jsonnet-newtonsoft", ex.HelpLink);
+            Assert.Equal("{}", ex.Data["JsonToken"]);
+        }
+
         [Fact]
         public void NullValueNestedInObject_ExpectValueDeserializedToNullCorrectly()
         {

UnitsNet.Serialization.JsonNet/StringExtensions.cs

@@ -0,0 +1,25 @@
+// Licensed under MIT No Attribution, see LICENSE file at the root.
+// Copyright 2013 Andreas Gullberg Larsen ([email protected]). Maintained at https://github.com/angularsen/UnitsNet.
+
+using System.Diagnostics.CodeAnalysis;
+
+namespace UnitsNet.Serialization.JsonNet
+{
+    internal static class StringExtensions
+    {
+        /// <summary>
+        /// Truncates a string to the given length, with truncation suffix.
+        /// </summary>
+        /// <param name="value">The string.</param>
+        /// <param name="maxLength">The max length, including <paramref name="truncationSuffix"/>.</param>
+        /// <param name="truncationSuffix">Suffix to append if truncated, defaults to "…".</param>
+        /// <returns>The truncated string if longer, otherwise the original string.</returns>
+        [return: NotNullIfNotNull("value")]
+        public static string? Truncate(this string? value, int maxLength, string truncationSuffix = "…")
+        {
+            return value?.Length > maxLength
+                ? value.Substring(0, maxLength - truncationSuffix.Length) + truncationSuffix
+                : value;
+        }
+    }
+}

UnitsNet.Serialization.JsonNet/UnitsNetBaseJsonConverter.cs

@@ -47,6 +47,7 @@ public void RegisterCustomType(Type quantity, Type unit)
         /// <returns>A <see cref="ValueUnit"/></returns>
         protected ValueUnit? ReadValueUnit(JToken jsonToken)
         {
+            // Empty JSON "{}"
             if (!jsonToken.HasValues)
             {
                 return null;

UnitsNet.Serialization.JsonNet/UnitsNetIComparableJsonConverter.cs

@@ -50,28 +50,30 @@ public override void WriteJson(JsonWriter writer, IComparable? value, JsonSerial
         public override IComparable? ReadJson(JsonReader reader, Type objectType, IComparable? existingValue, bool hasExistingValue,
             JsonSerializer serializer)
         {
-            reader = reader ?? throw new ArgumentNullException(nameof(reader));
-            serializer = serializer ?? throw new ArgumentNullException(nameof(serializer));
+            if (reader == null) throw new ArgumentNullException(nameof(reader));
+            if (serializer == null) throw new ArgumentNullException(nameof(serializer));
 
-            if (reader.TokenType == JsonToken.Null)
+            var token = JToken.Load(reader);
+
+            if (token.Type is JTokenType.Null)
             {
                 return existingValue;
             }
 
-            var localSerializer = CreateLocalSerializer(serializer, this);
-
-            var token = JToken.Load(reader);
-
             // If objectType is not IComparable but a type that implements IComparable, deserialize directly as this type instead.
             if (objectType != typeof(IComparable))
             {
+                // Remove the current converter from the list of converters to avoid infinite recursion.
+                JsonSerializer localSerializer = CreateLocalSerializer(serializer, this);
                 return (IComparable)token.ToObject(objectType, localSerializer)!;
             }
 
-            var valueUnit = ReadValueUnit(token);
+            ValueUnit? valueUnit = ReadValueUnit(token);
 
             if (valueUnit == null)
             {
+                // Remove the current converter from the list of converters to avoid infinite recursion.
+                JsonSerializer localSerializer = CreateLocalSerializer(serializer, this);
                 return token.ToObject<IComparable>(localSerializer);
             }
 

UnitsNet.Serialization.JsonNet/UnitsNetIQuantityJsonConverter.cs

@@ -31,7 +31,7 @@ public override void WriteJson(JsonWriter writer, IQuantity? value, JsonSerializ
                 return;
             }
 
-            var valueUnit = ConvertIQuantity(value);
+            ValueUnit valueUnit = ConvertIQuantity(value);
 
             serializer.Serialize(writer, valueUnit);
         }
@@ -51,24 +51,28 @@ public override void WriteJson(JsonWriter writer, IQuantity? value, JsonSerializ
         public override IQuantity? ReadJson(JsonReader reader, Type objectType, IQuantity? existingValue, bool hasExistingValue,
             JsonSerializer serializer)
         {
-            reader = reader ?? throw new ArgumentNullException(nameof(reader));
-            serializer = serializer ?? throw new ArgumentNullException(nameof(serializer));
-
-            if (reader.TokenType == JsonToken.Null)
-            {
-                return existingValue;
-            }
+            if (reader == null) throw new ArgumentNullException(nameof(reader));
+            if (serializer == null) throw new ArgumentNullException(nameof(serializer));
 
             var token = JToken.Load(reader);
 
-            var valueUnit = ReadValueUnit(token);
-
-            if (valueUnit == null)
+            if (token.Type is JTokenType.Null)
             {
-                return token.ToObject<IQuantity>(serializer);
+                return existingValue;
             }
 
-            return ConvertValueUnit(valueUnit);
+            // Try to read value and unit from JSON, otherwise throw.
+            ValueUnit? valueUnit = ReadValueUnit(token);
+
+            return valueUnit != null
+                ? ConvertValueUnit(valueUnit)
+                : throw new JsonSerializationException(
+                    $"Failed to deserialize IQuantity for target type {objectType} from JSON '{token.ToString().Truncate(100)}', expected properties Unit and Value.")
+                {
+                    HelpLink =
+                        "https://github.com/angularsen/UnitsNet/wiki/Serializing-to-JSON,-XML-and-more#unitsnetserializationjsonnet-with-jsonnet-newtonsoft",
+                    Data = { { "JsonToken", token.ToString() }, }
+                };
         }
     }
 }