Limit jstream parse depth (#20474)

Add https://github.com/bcicen/jstream/pull/15 by vendoring the package.

Sets JSON depth limit to 100 entries in S3 Select.

internal/s3select/sql/evaluate.go

@@ -24,7 +24,7 @@ import (
 	"math"
 	"strings"
 
-	"github.com/bcicen/jstream"
+	"github.com/minio/minio/internal/s3select/jstream"
 	"github.com/minio/simdjson-go"
 )
 

internal/s3select/sql/jsonpath.go

@@ -20,7 +20,7 @@ package sql
 import (
 	"errors"
 
-	"github.com/bcicen/jstream"
+	"github.com/minio/minio/internal/s3select/jstream"
 	"github.com/minio/simdjson-go"
 )
 

internal/s3select/sql/jsonpath_test.go

@@ -27,11 +27,11 @@ import (
 	"testing"
 
 	"github.com/alecthomas/participle"
-	"github.com/bcicen/jstream"
+	"github.com/minio/minio/internal/s3select/jstream"
 )
 
 func getJSONStructs(b []byte) ([]interface{}, error) {
-	dec := jstream.NewDecoder(bytes.NewBuffer(b), 0).ObjectAsKVS()
+	dec := jstream.NewDecoder(bytes.NewBuffer(b), 0).ObjectAsKVS().MaxDepth(100)
 	var result []interface{}
 	for parsedVal := range dec.Stream() {
 		result = append(result, parsedVal.Value)

internal/s3select/sql/statement.go

@@ -22,7 +22,7 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/bcicen/jstream"
+	"github.com/minio/minio/internal/s3select/jstream"
 	"github.com/minio/simdjson-go"
 )