Fix uncaught json::out_of_range in parseJson/parseYaml causing abort() - #1341

Security Impact

std.parseJson("1e400") crashes the process with abort() via SIGABRT. This is a denial-of-service vulnerability , any application embedding libjsonnet that evaluates untrusted Jsonnet input can be killed instantly with a single line of Jsonnet.

The abort() is not catchable by the embedding application. There is no way to recover.

This affects any tool built on libjsonnet that processes user-supplied Jsonnet, including CI/CD pipelines, Kubernetes config generators (Tanka, Kubecfg), and multi-tenant services.

Root Cause

builtinParseJson() in core/vm.cpp catches json::parse_error but not json::out_of_range. When nlohmann throws out_of_range for unrepresentable numbers like 1e400, the exception escapes to the TRY/CATCH macro which calls abort().

Same issue in builtinParseYaml().

Fix

Catch json::exception (the common base class) instead of just json::parse_error. This turns the crash into a normal Jsonnet RUNTIME ERROR that callers can handle gracefully.

Before

jsonnet -e 'std.parseJson("1e400")'

Something went wrong during jsonnet_evaluate_snippet, please report this:
[json.exception.out_of_range.406] number overflow parsing '1e400'
zsh: abort      jsonnet -e 'std.parseJson("1e400")'

After

jsonnet -e 'std.parseJson("1e400")'

RUNTIME ERROR: [json.exception.out_of_range.406] number overflow parsing '1e400'
       <cmdline>:1:1-23