add exception for json

hutool-json/src/main/java/cn/hutool/json/JSONParser.java

@@ -50,19 +50,26 @@ public class JSONParser {
 	public void parseTo(final JSONObject jsonObject, final Predicate<MutableEntry<String, Object>> predicate) {
 		final JSONTokener tokener = this.tokener;
 
-		char c;
-		String key;
-
 		if (tokener.nextClean() != '{') {
 			throw tokener.syntaxError("A JSONObject text must begin with '{'");
 		}
+
+		char prev;
+		char c;
+		String key;
 		while (true) {
+			prev = tokener.getPrevious();
 			c = tokener.nextClean();
 			switch (c) {
 				case 0:
 					throw tokener.syntaxError("A JSONObject text must end with '}'");
 				case '}':
 					return;
+				case '{':
+				case '[':
+					if(prev=='{') {
+						throw tokener.syntaxError("A JSONObject can not directly nest another JSONObject or JSONArray.");
+					}
 				default:
 					tokener.back();
 					key = tokener.nextValue().toString();

hutool-json/src/main/java/cn/hutool/json/JSONTokener.java

@@ -162,6 +162,15 @@ public class JSONTokener {
 		return this.previous;
 	}
 
+	/**
+	 * Get the last character read from the input or '\0' if nothing has been read yet.
+	 *
+	 * @return the last character read from the input.
+	 */
+	protected char getPrevious() {
+		return this.previous;
+	}
+
 	/**
 	 * 读取下一个字符，并比对是否和指定字符匹配
 	 *
@@ -334,10 +343,18 @@ public class JSONTokener {
 				return this.nextString(c);
 			case '{':
 				this.back();
-				return new JSONObject(this, this.config);
+				try {
+					return new JSONObject(this, this.config);
+				} catch (final StackOverflowError e) {
+					throw new JSONException("JSONObject depth too large to process.", e);
+				}
 			case '[':
 				this.back();
-				return new JSONArray(this, this.config);
+				try {
+					return new JSONArray(this, this.config);
+				} catch (final StackOverflowError e) {
+					throw new JSONException("JSONArray depth too large to process.", e);
+				}
 		}
 
 		/*

hutool-json/src/main/java/cn/hutool/json/xml/XMLTokener.java

@@ -113,9 +113,38 @@ public class XMLTokener extends JSONTokener {
 				throw syntaxError("Missing ';' in XML entity: &" + sb);
 			}
 		}
-		final String string = sb.toString();
-		final Object object = entity.get(string);
-		return object != null ? object : ampersand + string + ";";
+		return unescapeEntity(sb.toString());
+	}
+
+	/**
+	 * Unescape an XML entity encoding;
+	 *
+	 * @param e entity (only the actual entity value, not the preceding & or ending ;
+	 * @return Unescape str
+	 */
+	static String unescapeEntity(final String e) {
+		// validate
+		if (e == null || e.isEmpty()) {
+			return "";
+		}
+		// if our entity is an encoded unicode point, parse it.
+		if (e.charAt(0) == '#') {
+			final int cp;
+			if (e.charAt(1) == 'x' || e.charAt(1) == 'X') {
+				// hex encoded unicode
+				cp = Integer.parseInt(e.substring(2), 16);
+			} else {
+				// decimal encoded unicode
+				cp = Integer.parseInt(e.substring(1));
+			}
+			return new String(new int[]{cp}, 0, 1);
+		}
+		final Character knownEntity = entity.get(e);
+		if (knownEntity == null) {
+			// we don't know the entity so keep it encoded
+			return '&' + e + ';';
+		}
+		return knownEntity.toString();
 	}
 
 	/**