jcoffey-dev
ffeb1aeb65
A property key whose first part holds an escaped "/" (~1) is parsed again as a pointer, and each level can escape the one inside it. A key built that way and nested a few thousand deep, well inside the default request size, recursed once per level: on a 2 MiB stack, like a tokio worker's, it overflowed and aborted the server. Past 8 levels the text is now kept as a plain key, which is also what RFC 6901 says "~1" means.