Broken JSON serialization and JSON injection vulnerability

[j13z]

General information

• SDK/Library version: 1.0.2
• Java Version: 8

Issue description

The JSON serializer implementation does not properly JSON-encode string values. In fact, they are not encoded at all. See this critical line that constructs the JSON value (the right part after the colon) by just quoting the input string value and otherwise copying it unchanged:
https://github.com/paypal/paypalhttp_java/blob/master/paypalhttp/src/main/java/com/paypal/http/serializer/Json.java#L133

Combined with user-provided data, this allows JSON injection that leads to security vulnerabilities in the Checkout-Java-SDK library (e.g. manipulating OrdersCreateRequest via injection in user-provided address data) when no additional security measures are in place (e.g. restricting character sets or input lengths).

I created a commit on a forked repo that shows this defect with two failing tests: j13z@3dce573

[j13z]

Is there a reason why you don't just use Jackson or GSON for handling JSON?

[NadirHelix]

Hi,
this issue is affecting our customers and we would like to get it solved. It's a major security issue.
I'm a bit surprised that there is no reaction here?!

[foxt7ot]

I second this, any particular reason for using a custom JSON serializer when we have already have some amazing serializations libraries.