From 68438274964c4ebe512893a9e26f2f94a6ebc0a4 Mon Sep 17 00:00:00 2001
From: Alan Liddell <aliddell@chanzuckerberg.com>
Date: Tue, 3 Sep 2024 16:28:10 -0400
Subject: [PATCH] Do JSON validation when setting external metadata.

---
 src/internal/stream.settings.cpp | 36 ++++++++++++++++++++++++++++++--
 1 file changed, 34 insertions(+), 2 deletions(-)

diff --git a/src/internal/stream.settings.cpp b/src/internal/stream.settings.cpp
index 72463ea7..92aed8a9 100644
--- a/src/internal/stream.settings.cpp
+++ b/src/internal/stream.settings.cpp
@@ -3,6 +3,7 @@
 #include "logger.hh"
 
 #include <blosc.h>
+#include <nlohmann/json.hpp>
 
 #include <cstring> // memcpy
 
@@ -160,8 +161,39 @@ ZarrStreamSettings_set_external_metadata(ZarrStreamSettings* settings,
                                          const char* external_metadata,
                                          size_t bytes_of_external_metadata)
 {
-    SETTINGS_SET_STRING(
-      settings, external_metadata, bytes_of_external_metadata);
+    if (!settings) {
+        LOG_ERROR("Null pointer: settings");
+        return ZarrError_InvalidArgument;
+    }
+
+    if (!external_metadata) {
+        LOG_ERROR("Null pointer: external_metadata");
+        return ZarrError_InvalidArgument;
+    }
+
+    if (bytes_of_external_metadata == 0) {
+        LOG_ERROR("Invalid length: %zu. Must be greater than 0",
+                  bytes_of_external_metadata);
+        return ZarrError_InvalidArgument;
+    }
+
+    const size_t nbytes =
+      strnlen(external_metadata, bytes_of_external_metadata);
+
+    auto val =  nlohmann::json::parse(external_metadata,
+                                        external_metadata + nbytes,
+                                        nullptr, // callback
+                                        false,    // allow exceptions
+                                        true     // ignore comments
+    );
+
+    if (val.is_discarded()) {
+        LOG_ERROR("Invalid JSON: %s", external_metadata);
+        return ZarrError_InvalidArgument;
+    }
+    settings->external_metadata = val.dump();
+
+    return ZarrError_Success;
 }
 
 ZarrError