Add depth validation to Jruby and TruffleRuby implementations

Author: byroot

java/src/json/ext/GeneratorState.java

@@ -484,9 +484,12 @@ public RubyInteger depth_get(ThreadContext context) {
     }
 
     @JRubyMethod(name="depth=")
-    public IRubyObject depth_set(IRubyObject vDepth) {
+    public IRubyObject depth_set(ThreadContext context, IRubyObject vDepth) {
         checkFrozen();
         depth = RubyNumeric.fix2int(vDepth);
+        if (depth < 0) {
+            throw context.runtime.newArgumentError("depth must be >= 0 (got: " + depth + ")");
+        }
         return vDepth;
     }
 
@@ -557,6 +560,9 @@ public IRubyObject _configure(ThreadContext context, IRubyObject vOpts) {
         bufferInitialLength = opts.getInt("buffer_initial_length", DEFAULT_BUFFER_INITIAL_LENGTH);
 
         depth = opts.getInt("depth", 0);
+        if (depth < 0) {
+            throw context.runtime.newArgumentError("depth must be >= 0 (got: " + depth + ")");
+        }
 
         if (opts.hasKey("allow_duplicate_key")) {
             this.allowDuplicateKey = opts.getBool("allow_duplicate_key", false);

lib/json/truffle_ruby/generator.rb

@@ -211,7 +211,14 @@ def buffer_initial_length=(length)
 
         # This integer returns the current depth data structure nesting in the
         # generated JSON.
-        attr_accessor :depth
+        attr_reader :depth
+
+        def depth=(depth)
+          if depth.negative?
+            raise ArgumentError, "depth must be >= 0 (got #{depth})"
+          end
+          @depth = depth
+        end
 
         def check_max_nesting # :nodoc:
           return if @max_nesting.zero?
@@ -260,6 +267,11 @@ def configure(opts)
           else
             raise TypeError, "can't convert #{opts.class} into Hash"
           end
+
+          if opts[:depth]&.negative?
+            raise ArgumentError, "depth must be >= 0 (got #{opts[:depth]})"
+          end
+
           opts.each do |key, value|
             instance_variable_set "@#{key}", value
           end