netplex · Mar 29, 2024 · May 1, 2024 · May 1, 2024 · May 1, 2024 · May 1, 2024
diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
@@ -0,0 +1 @@
+github: urielch
diff --git a/.gitignore b/.gitignore
@@ -8,3 +8,4 @@
 **/*.iml
 **/bin
 **/target
+**/.vscode/
diff --git a/README.md b/README.md
@@ -19,6 +19,10 @@ So I do not use my json-smart anymore. I had fun with this project. If you want
 
 # Changelog
 
+### *V 2.5.2* (next version)
+
+* Fix CVE-2024-57699 for predefined parsers. [PR 233](https://github.com/netplex/json-smart-v2/pull/233)
+
 ### *V 2.5.1* (2024-03-14)
 
 * Bump all dependencies.
@@ -122,4 +126,4 @@ So I do not use my json-smart anymore. I had fun with this project. If you want
 
 ### *V 2.0-RC1* (2012-02-18)
   * speed improvement in POJO manipulation
-  * add JSONStyle.LT_COMPRESS predefined generate strct json, but ignoring / escapement.
+  * add JSONStyle.LT_COMPRESS predefined generate strct json, but ignoring / escapement.
diff --git a/accessors-smart/pom.xml b/accessors-smart/pom.xml
@@ -1,5 +1,5 @@
 <!--
-Copyright 2011-2023 JSON-SMART authors
+Copyright 2011-2024 JSON-SMART authors
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@ limitations under the License.
     <modelVersion>4.0.0</modelVersion>
     <groupId>net.minidev</groupId>
     <artifactId>accessors-smart</artifactId>
-    <version>2.5.1</version>
+    <version>2.5.2</version>
     <name>ASM based accessors helper used by json-smart</name>
     <description>Java reflect give poor performance on getter setter an constructor calls, accessors-smart use ASM to speed up those calls.</description>
     <packaging>bundle</packaging>
@@ -31,12 +31,12 @@ limitations under the License.
             <id>uriel</id>
             <name>Uriel Chemouni</name>
             <email>uchemouni@gmail.com</email>
-            <timezone>GMT+3</timezone>
+            <timezone>GMT+1</timezone>
         </developer>
         <developer>
-            <id>shoothzj</id>
-            <name>ZhangJian He</name>
-            <email>shoothzj@gmail.com</email>
+            <id>hezhangjian</id>
+            <name>Zhangjian He</name>
+            <email>hezhangjian97gmail.com</email>
             <timezone>GMT+8</timezone>
         </developer>
     </developers>
@@ -62,11 +62,11 @@ limitations under the License.
     <distributionManagement>
         <snapshotRepository>
             <id>ossrh</id>
-            <url>https://oss.sonatype.org/content/repositories/snapshots</url>
+            <url>https://s01.oss.sonatype.org/content/repositories/snapshots</url>
         </snapshotRepository>
         <repository>
             <id>ossrh</id>
-            <url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
+            <url>https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
         </repository>
     </distributionManagement>
 	<!-- release with: export GPG_TTY=$(tty); mvn clean deploy -P release-sign-artifacts -->
@@ -90,9 +90,10 @@ limitations under the License.
             <build>
                 <plugins>
                     <plugin>
+                        <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-gpg-plugin -->
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-gpg-plugin</artifactId>
-                        <version>1.6</version>
+                        <version>3.2.7</version>
                         <executions>
                             <execution>
                                 <id>sign-artifacts</id>
@@ -105,9 +106,10 @@ limitations under the License.
                     </plugin>
                     <!-- Publish also javadocs when releasing - required by Sonatype -->
                     <plugin>
+                        <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-javadoc-plugin -->
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-javadoc-plugin</artifactId>
-						<version>3.2.0</version>
+						<version>3.10.1</version>
 						<configuration>
                           <source>8</source>
                 		</configuration>
@@ -125,9 +127,10 @@ limitations under the License.
 						to perform: mvn release:prepare release:perform Read http://nexus.sonatype.org/oss-repository-hosting.html#3 
 						for instructions on releasing to this project's Sonatype repository -->
                     <plugin>
+						<!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-release-plugin -->
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-release-plugin</artifactId>
-                        <version>3.0.1</version>
+                        <version>3.1.1</version>
                         <configuration>
                             <mavenExecutorId>forked-path</mavenExecutorId>
                             <arguments>-Psonatype-oss-release</arguments>
@@ -159,9 +162,10 @@ limitations under the License.
     <build>
         <plugins>
             <plugin>
+                <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-source-plugin -->
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-source-plugin</artifactId>
-                <version>3.2.1</version>
+                <version>3.3.1</version>
                 <executions>
                     <execution>
                         <id>bind-sources</id>
@@ -172,32 +176,36 @@ limitations under the License.
                 </executions>
             </plugin>
             <plugin>
+                <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-compiler-plugin -->
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
-                <version>3.8.1</version>
+                <version>3.13.0</version>
                 <configuration>
                     <encoding>UTF-8</encoding>
                     <source>${maven.compiler.source}</source>
                     <target>${maven.compiler.target}</target>
                 </configuration>
             </plugin>
             <plugin>
+                <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-resources-plugin -->
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-resources-plugin</artifactId>
-                <version>3.2.0</version>
+                <version>3.3.1</version>
                 <configuration>
                     <encoding>UTF-8</encoding>
                 </configuration>
             </plugin>
             <plugin>
+                <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-jar-plugin -->
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-jar-plugin</artifactId>
-                <version>3.2.0</version>
+                <version>3.4.2</version>
             </plugin>
             <plugin>
+                <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-javadoc-plugin -->
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-javadoc-plugin</artifactId>
-                <version>3.2.0</version>
+                <version>3.10.1</version>
                 <!-- ONLY NEEDED With jdk 1.7+ -->
                 <configuration>
                     <source>8</source>
@@ -214,9 +222,10 @@ limitations under the License.
                 </executions>
             </plugin>
             <plugin>
+                <!-- https://mvnrepository.com/artifact/org.apache.felix/maven-bundle-plugin -->
                 <groupId>org.apache.felix</groupId>
                 <artifactId>maven-bundle-plugin</artifactId>
-                <version>5.1.2</version> <!-- 3.0.0 need java 7+ -->
+                <version>5.1.9</version> <!-- 3.0.0 need java 7+ -->
                 <extensions>true</extensions>
                 <configuration>
                     <instructions>
@@ -239,14 +248,14 @@ limitations under the License.
             <dependency>
                 <groupId>org.junit.jupiter</groupId>
                 <artifactId>junit-jupiter-api</artifactId>
-                <version>5.10.0</version>
+                <version>5.11.2</version>
                 <scope>test</scope>
             </dependency>
             <!-- https://mvnrepository.com/artifact/org.ow2.asm/asm -->
             <dependency>
                 <groupId>org.ow2.asm</groupId>
                 <artifactId>asm</artifactId>
-                <version>9.6</version>
+                <version>9.7.1</version>
             </dependency>
         </dependencies>    
 </project>
diff --git a/accessors-smart/src/main/java/net/minidev/asm/ASMUtil.java b/accessors-smart/src/main/java/net/minidev/asm/ASMUtil.java
@@ -1,7 +1,7 @@
 package net.minidev.asm;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/accessors-smart/src/main/java/net/minidev/asm/Accessor.java b/accessors-smart/src/main/java/net/minidev/asm/Accessor.java
@@ -1,7 +1,7 @@
 package net.minidev.asm;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/accessors-smart/src/main/java/net/minidev/asm/BeansAccess.java b/accessors-smart/src/main/java/net/minidev/asm/BeansAccess.java
@@ -1,7 +1,7 @@
 package net.minidev.asm;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/accessors-smart/src/main/java/net/minidev/asm/DynamicClassLoader.java b/accessors-smart/src/main/java/net/minidev/asm/DynamicClassLoader.java
@@ -1,7 +1,7 @@
 package net.minidev.asm;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart-action/pom.xml b/json-smart-action/pom.xml
@@ -2,7 +2,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>net.minidev</groupId>
     <artifactId>json-smart-action</artifactId>
-    <version>2.5.1</version>
+    <version>2.5.2</version>
     <name>JSON-smart-action Small and Fast Parser</name>
     <description>JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but uses conventions that are familiar to programmers of the C-family of languages, including C, C++, C#, Java, JavaScript, Perl, Python, and many others. These properties make JSON an ideal data-interchange language.</description>
     <packaging>bundle</packaging>
@@ -16,7 +16,7 @@
             <id>uriel</id>
             <name>Uriel Chemouni</name>
             <email>uchemouni@gmail.com</email>
-            <timezone>GMT+3</timezone>
+            <timezone>GMT+1</timezone>
         </developer>
         <developer>
             <id>erav</id>
@@ -25,9 +25,9 @@
             <timezone>GMT+2</timezone>
         </developer>
         <developer>
-            <id>shoothzj</id>
-            <name>ZhangJian He</name>
-            <email>shoothzj@gmail.com</email>
+            <id>hezhangjian</id>
+            <name>Zhangjian He</name>
+            <email>hezhangjian97gmail.com</email>
             <timezone>GMT+8</timezone>
         </developer>
     </developers>
@@ -44,7 +44,7 @@
         <project.build.outputTimestamp>10</project.build.outputTimestamp>
         <maven.compiler.source>1.8</maven.compiler.source>
         <maven.compiler.target>1.8</maven.compiler.target>
-        <junit.version>5.10.2</junit.version>
+        <junit.version>5.11.4</junit.version>
     </properties>
     <scm>
         <connection>scm:git:https://github.com/netplex/json-smart-v2.git</connection>
@@ -54,11 +54,11 @@
     <distributionManagement>
         <snapshotRepository>
             <id>ossrh</id>
-            <url>https://oss.sonatype.org/content/repositories/snapshots</url>
+            <url>https://s01.oss.sonatype.org/content/repositories/snapshots</url>
         </snapshotRepository>
         <repository>
             <id>ossrh</id>
-            <url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
+            <url>https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
         </repository>
     </distributionManagement>
 	<!-- release with: export GPG_TTY=$(tty); mvn clean deploy -P release-sign-artifacts -->
@@ -84,7 +84,7 @@
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-gpg-plugin</artifactId>
-                        <version>3.1.0</version>
+                        <version>3.2.7</version>
                         <executions>
                             <execution>
                                 <id>sign-artifacts</id>
@@ -97,9 +97,10 @@
                     </plugin>
                     <!-- Publish also javadocs when releasing - required by Sonatype -->
                     <plugin>
+                        <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-javadoc-plugin -->
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-javadoc-plugin</artifactId>
-						<version>3.6.3</version>
+						<version>3.11.2</version>
 						<configuration>
                           <source>8</source>
                 		</configuration>
@@ -117,9 +118,10 @@
 						to perform: mvn release:prepare release:perform Read http://nexus.sonatype.org/oss-repository-hosting.html#3 
 						for instructions on releasing to this project's Sonatype repository -->
                     <plugin>
+						<!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-release-plugin -->
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-release-plugin</artifactId>
-                        <version>3.0.1</version>
+                        <version>3.1.1</version>
                         <configuration>
                             <mavenExecutorId>forked-path</mavenExecutorId>
                             <arguments>-Psonatype-oss-release</arguments>
@@ -151,9 +153,10 @@
     <build>
         <plugins>
 			<plugin>
+                <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-source-plugin -->
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-source-plugin</artifactId>
-                <version>3.3.0</version>
+                <version>3.3.1</version>
                 <executions>
                     <execution>
                         <id>bind-sources</id>
@@ -164,16 +167,18 @@
                 </executions>
             </plugin>
             <plugin>
+                <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-compiler-plugin -->
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
-                <version>3.12.1</version>
+                <version>3.13.0</version>
                 <configuration>
                     <encoding>UTF-8</encoding>
                     <source>${maven.compiler.source}</source>
                     <target>${maven.compiler.target}</target>
                 </configuration>
             </plugin>
             <plugin>
+                <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-resources-plugin -->
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-resources-plugin</artifactId>
                 <version>3.3.1</version>
@@ -182,14 +187,16 @@
                 </configuration>
             </plugin>
             <plugin>
+                <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-jar-plugin -->
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-jar-plugin</artifactId>
-                <version>3.3.0</version>
+                <version>3.4.2</version>
             </plugin>
             <plugin>
+                <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-javadoc-plugin -->
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-javadoc-plugin</artifactId>
-				<version>3.6.3</version>
+				<version>3.11.2</version>
                 <!-- ONLY NEEDED With jdk 1.7+ -->
                 <configuration>
                     <source>8</source>
@@ -245,7 +252,7 @@
         <dependency>
             <groupId>net.minidev</groupId>
             <artifactId>json-smart</artifactId>
-            <version>2.5.1</version>
+            <version>2.5.2</version>
         </dependency>
     </dependencies>
 </project>
diff --git a/json-smart/pom.xml b/json-smart/pom.xml
@@ -1,5 +1,5 @@
 <!--
-Copyright 2011-2023 JSON-SMART authors
+Copyright 2011-2024 JSON-SMART authors
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@ limitations under the License.
 	<modelVersion>4.0.0</modelVersion>
     <groupId>net.minidev</groupId>
 	<artifactId>json-smart</artifactId>
-	<version>2.5.1</version>
+	<version>2.5.2</version>
 	<name>JSON Small and Fast Parser</name>
 	<description>JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but uses conventions that are familiar to programmers of the C-family of languages, including C, C++, C#, Java, JavaScript, Perl, Python, and many others. These properties make JSON an ideal data-interchange language.</description>
 	<packaging>bundle</packaging>
@@ -31,7 +31,7 @@ limitations under the License.
 			<id>uriel</id>
 			<name>Uriel Chemouni</name>
 			<email>uchemouni@gmail.com</email>
-			<timezone>GMT+3</timezone>
+			<timezone>GMT+1</timezone>
 		</developer>
 		<developer>
 			<id>erav</id>
@@ -40,9 +40,9 @@ limitations under the License.
 			<timezone>GMT+2</timezone>
 		</developer>
 		<developer>
-			<id>shoothzj</id>
-			<name>ZhangJian He</name>
-			<email>shoothzj@gmail.com</email>
+			<id>hezhangjian</id>
+			<name>Zhangjian He</name>
+			<email>hezhangjian97gmail.com</email>
 			<timezone>GMT+8</timezone>
 		</developer>
 	</developers>
@@ -59,7 +59,7 @@ limitations under the License.
 		<project.build.outputTimestamp>10</project.build.outputTimestamp>
 		<maven.compiler.source>1.8</maven.compiler.source>
 		<maven.compiler.target>1.8</maven.compiler.target>
-		<junit.version>5.10.2</junit.version>
+		<junit.version>5.11.4</junit.version>
 	</properties>
 	<scm>
 		<connection>scm:git:https://github.com/netplex/json-smart-v2.git</connection>
@@ -69,11 +69,11 @@ limitations under the License.
 	<distributionManagement>
 		<snapshotRepository>
 			<id>ossrh</id>
-			<url>https://oss.sonatype.org/content/repositories/snapshots</url>
+			<url>https://s01.oss.sonatype.org/content/repositories/snapshots</url>
 		</snapshotRepository>
 		<repository>
 			<id>ossrh</id>
-			<url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
+			<url>https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
 		</repository>
 	</distributionManagement>
 	<!-- release with: export GPG_TTY=$(tty); mvn clean deploy -P release-sign-artifacts -->
@@ -97,9 +97,10 @@ limitations under the License.
 			<build>
 				<plugins>
 					<plugin>
+						<!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-gpg-plugin -->
 						<groupId>org.apache.maven.plugins</groupId>
 						<artifactId>maven-gpg-plugin</artifactId>
-						<version>3.1.0</version>
+						<version>3.2.7</version>
 						<executions>
 							<execution>
 								<id>sign-artifacts</id>
@@ -112,9 +113,10 @@ limitations under the License.
 					</plugin>
 					<!-- Publish also javadocs when releasing - required by Sonatype -->
 					<plugin>
+						<!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-javadoc-plugin -->
 						<groupId>org.apache.maven.plugins</groupId>
 						<artifactId>maven-javadoc-plugin</artifactId>
-						<version>3.6.3</version>
+						<version>3.11.2</version>
 						<configuration>
                           <source>8</source>
                 		</configuration>
@@ -132,9 +134,10 @@ limitations under the License.
 						to perform: mvn release:prepare release:perform Read http://nexus.sonatype.org/oss-repository-hosting.html#3 
 						for instructions on releasing to this project's Sonatype repository -->
 					<plugin>
+						<!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-release-plugin -->
 						<groupId>org.apache.maven.plugins</groupId>
 						<artifactId>maven-release-plugin</artifactId>
-                        <version>3.0.1</version>
+						<version>3.1.1</version>
 						<configuration>
 							<mavenExecutorId>forked-path</mavenExecutorId>
 							<arguments>-Psonatype-oss-release</arguments>
@@ -166,9 +169,10 @@ limitations under the License.
 	<build>
 		<plugins>
 			<plugin>
+                <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-source-plugin -->
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-source-plugin</artifactId>
-				<version>3.3.0</version>
+				<version>3.3.1</version>
 				<executions>
 					<execution>
 						<id>bind-sources</id>
@@ -179,16 +183,18 @@ limitations under the License.
 				</executions>
 			</plugin>
 			<plugin>
+                <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-compiler-plugin -->
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-compiler-plugin</artifactId>
-				<version>3.12.1</version>
+				<version>3.13.0</version>
 				<configuration>
 					<encoding>UTF-8</encoding>
 					<source>${maven.compiler.source}</source>
 					<target>${maven.compiler.target}</target>
 				</configuration>
 			</plugin>
 			<plugin>
+                <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-resources-plugin -->
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-resources-plugin</artifactId>
 				<version>3.3.1</version>
@@ -197,14 +203,16 @@ limitations under the License.
 				</configuration>
 			</plugin>
 			<plugin>
+                <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-jar-plugin -->
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-jar-plugin</artifactId>
-				<version>3.3.0</version>
+				<version>3.4.2</version>
 			</plugin>
 			<plugin>
+                <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-javadoc-plugin -->
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-javadoc-plugin</artifactId>
-				<version>3.6.3</version>
+				<version>3.11.2</version>
 				<!-- ONLY NEEDED With jdk 1.7+ -->
 				<configuration>
                     <source>8</source>
@@ -221,6 +229,7 @@ limitations under the License.
 				</executions>
 			</plugin>
 			<plugin>
+                <!-- https://mvnrepository.com/artifact/org.apache.felix/maven-bundle-plugin -->
 				<groupId>org.apache.felix</groupId>
 				<artifactId>maven-bundle-plugin</artifactId>
                 <version>5.1.9</version>
@@ -264,7 +273,7 @@ limitations under the License.
 		<dependency>
 			<groupId>net.minidev</groupId>
 			<artifactId>accessors-smart</artifactId>
-            <version>2.5.1</version>
+            <version>2.5.2</version>
 		</dependency>
 	</dependencies>
 </project>
diff --git a/json-smart/src/main/java/net/minidev/json/JSONArray.java b/json-smart/src/main/java/net/minidev/json/JSONArray.java
@@ -1,7 +1,7 @@
 package net.minidev.json;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/JSONAware.java b/json-smart/src/main/java/net/minidev/json/JSONAware.java
@@ -1,7 +1,7 @@
 package net.minidev.json;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/JSONAwareEx.java b/json-smart/src/main/java/net/minidev/json/JSONAwareEx.java
@@ -1,7 +1,7 @@
 package net.minidev.json;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/JSONNavi.java b/json-smart/src/main/java/net/minidev/json/JSONNavi.java
@@ -1,7 +1,7 @@
 package net.minidev.json;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/JSONObject.java b/json-smart/src/main/java/net/minidev/json/JSONObject.java
@@ -1,7 +1,7 @@
 package net.minidev.json;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/JSONStreamAware.java b/json-smart/src/main/java/net/minidev/json/JSONStreamAware.java
@@ -1,7 +1,7 @@
 package net.minidev.json;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/JSONStreamAwareEx.java b/json-smart/src/main/java/net/minidev/json/JSONStreamAwareEx.java
@@ -1,7 +1,7 @@
 package net.minidev.json;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/JSONStyle.java b/json-smart/src/main/java/net/minidev/json/JSONStyle.java
@@ -1,7 +1,7 @@
 package net.minidev.json;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/JSONUtil.java b/json-smart/src/main/java/net/minidev/json/JSONUtil.java
@@ -7,7 +7,7 @@
 import net.minidev.json.annotate.JsonIgnore;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/JSONValue.java b/json-smart/src/main/java/net/minidev/json/JSONValue.java
@@ -1,7 +1,7 @@
 package net.minidev.json;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/JStylerObj.java b/json-smart/src/main/java/net/minidev/json/JStylerObj.java
@@ -1,7 +1,7 @@
 package net.minidev.json;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/parser/JSONParser.java b/json-smart/src/main/java/net/minidev/json/parser/JSONParser.java
@@ -1,7 +1,7 @@
 package net.minidev.json.parser;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -115,21 +115,21 @@ public class JSONParser {
 	 * 
 	 * @since 1.0.6
 	 */
-	public final static int MODE_RFC4627 = USE_INTEGER_STORAGE | USE_HI_PRECISION_FLOAT | ACCEPT_TAILLING_SPACE;
+	public final static int MODE_RFC4627 = USE_INTEGER_STORAGE | USE_HI_PRECISION_FLOAT | ACCEPT_TAILLING_SPACE | LIMIT_JSON_DEPTH;
 	/**
 	 * Parse Object like json-simple
 	 * 
 	 * Best for an iso-bug json-simple API port.
 	 * 
 	 * @since 1.0.7
 	 */
-	public final static int MODE_JSON_SIMPLE = ACCEPT_USELESS_COMMA | USE_HI_PRECISION_FLOAT | ACCEPT_TAILLING_DATA | ACCEPT_TAILLING_SPACE | REJECT_127_CHAR | BIG_DIGIT_UNRESTRICTED;
+	public final static int MODE_JSON_SIMPLE = ACCEPT_USELESS_COMMA | USE_HI_PRECISION_FLOAT | ACCEPT_TAILLING_DATA | ACCEPT_TAILLING_SPACE | REJECT_127_CHAR | BIG_DIGIT_UNRESTRICTED | LIMIT_JSON_DEPTH;
 	/**
 	 * Strictest parsing mode
 	 * 
 	 * @since 2.0.1
 	 */
-	public final static int MODE_STRICTEST = USE_INTEGER_STORAGE | USE_HI_PRECISION_FLOAT | REJECT_127_CHAR;
+	public final static int MODE_STRICTEST = USE_INTEGER_STORAGE | USE_HI_PRECISION_FLOAT | REJECT_127_CHAR | LIMIT_JSON_DEPTH;
 	/**
 	 * Default json-smart processing mode
 	 */

diff --git a/json-smart/src/main/java/net/minidev/json/parser/JSONParserBase.java b/json-smart/src/main/java/net/minidev/json/parser/JSONParserBase.java
@@ -1,7 +1,7 @@
 package net.minidev.json.parser;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/parser/JSONParserByteArray.java b/json-smart/src/main/java/net/minidev/json/parser/JSONParserByteArray.java
@@ -1,7 +1,7 @@
 package net.minidev.json.parser;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/parser/JSONParserInputStream.java b/json-smart/src/main/java/net/minidev/json/parser/JSONParserInputStream.java
@@ -1,7 +1,7 @@
 package net.minidev.json.parser;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/parser/JSONParserMemory.java b/json-smart/src/main/java/net/minidev/json/parser/JSONParserMemory.java
@@ -1,7 +1,7 @@
 package net.minidev.json.parser;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/parser/JSONParserReader.java b/json-smart/src/main/java/net/minidev/json/parser/JSONParserReader.java
@@ -1,7 +1,7 @@
 package net.minidev.json.parser;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/parser/JSONParserStream.java b/json-smart/src/main/java/net/minidev/json/parser/JSONParserStream.java
@@ -1,7 +1,7 @@
 package net.minidev.json.parser;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/parser/JSONParserString.java b/json-smart/src/main/java/net/minidev/json/parser/JSONParserString.java
@@ -1,7 +1,7 @@
 package net.minidev.json.parser;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/parser/ParseException.java b/json-smart/src/main/java/net/minidev/json/parser/ParseException.java
@@ -1,7 +1,7 @@
 package net.minidev.json.parser;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/writer/ArraysMapper.java b/json-smart/src/main/java/net/minidev/json/writer/ArraysMapper.java
@@ -1,7 +1,7 @@
 package net.minidev.json.writer;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/writer/BeansMapper.java b/json-smart/src/main/java/net/minidev/json/writer/BeansMapper.java
@@ -1,7 +1,7 @@
 package net.minidev.json.writer;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/writer/CollectionMapper.java b/json-smart/src/main/java/net/minidev/json/writer/CollectionMapper.java
@@ -1,7 +1,7 @@
 package net.minidev.json.writer;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/writer/CompessorMapper.java b/json-smart/src/main/java/net/minidev/json/writer/CompessorMapper.java
@@ -1,7 +1,7 @@
 package net.minidev.json.writer;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/writer/DefaultMapperCollection.java b/json-smart/src/main/java/net/minidev/json/writer/DefaultMapperCollection.java
@@ -1,7 +1,7 @@
 package net.minidev.json.writer;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/writer/DefaultMapperOrdered.java b/json-smart/src/main/java/net/minidev/json/writer/DefaultMapperOrdered.java
@@ -1,7 +1,7 @@
 package net.minidev.json.writer;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/writer/FakeMapper.java b/json-smart/src/main/java/net/minidev/json/writer/FakeMapper.java
@@ -2,7 +2,7 @@
 
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/writer/JsonReader.java b/json-smart/src/main/java/net/minidev/json/writer/JsonReader.java
@@ -1,7 +1,7 @@
 package net.minidev.json.writer;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/main/java/net/minidev/json/writer/JsonReaderI.java b/json-smart/src/main/java/net/minidev/json/writer/JsonReaderI.java
@@ -1,7 +1,7 @@
 package net.minidev.json.writer;
 
 /*
- *    Copyright 2011-2023 JSON-SMART authors
+ *    Copyright 2011-2024 JSON-SMART authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

diff --git a/json-smart/src/test/java/net/minidev/json/test/TestCVE202457699.java b/json-smart/src/test/java/net/minidev/json/test/TestCVE202457699.java
@@ -0,0 +1,56 @@
+package net.minidev.json.test;
+
+import net.minidev.json.parser.JSONParser;
+import net.minidev.json.parser.ParseException;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+public class TestCVE202457699 {
+
+    private static final String MALICIOUS_STRING = createMaliciousString();
+
+    @Test
+    public void jsonSimpleParserShouldRestrictDepth() {
+        JSONParser p = new JSONParser(JSONParser.MODE_JSON_SIMPLE);
+        assertThrows(ParseException.class,
+                () -> p.parse(MALICIOUS_STRING),
+                "Malicious payload, having non natural depths");
+    }
+
+    @Test
+    public void strictestParserShouldRestrictDepth() {
+        JSONParser p = new JSONParser(JSONParser.MODE_STRICTEST);
+        assertThrows(ParseException.class,
+                () -> p.parse(MALICIOUS_STRING),
+                "Malicious payload, having non natural depths");
+    }
+
+    @Test
+    public void rfc4627ParserShouldRestrictDepth() {
+        JSONParser p = new JSONParser(JSONParser.MODE_RFC4627);
+        assertThrows(ParseException.class,
+                () -> p.parse(MALICIOUS_STRING),
+                "Malicious payload, having non natural depths");
+    }
+
+    @Test
+    public void permissiveParserShouldRestrictDepth() {
+        JSONParser p = new JSONParser(JSONParser.MODE_PERMISSIVE);
+        assertThrows(ParseException.class,
+                () -> p.parse(MALICIOUS_STRING),
+                "Malicious payload, having non natural depths");
+    }
+
+    private static String createMaliciousString() {
+        StringBuilder sb = new StringBuilder();
+        for (int i = 0; i < 10000 ; i++) {
+            sb.append("{\"a\":");
+        }
+        sb.append("1");
+        for (int i = 0; i < 10000 ; i++) {
+            sb.append("}");
+        }
+        return sb.toString();
+    }
+}