Comments (5)
Sorry, the repository was still set to "private". It should be public now.
I am referencing Section 7 "Strings" from (https://datatracker.ietf.org/doc/html/rfc8259):
All Unicode characters may be placed within the quotation marks, except for the characters that MUST be escaped: quotation mark, reverse solidus, and the control characters (U+0000 through U+001F).
If my understanding of this is correct, the control characters below U+001F must be passed as "\u0000" - "\u001f" to be valid JSON (except for U+0008, U+000C, U+000A, U+000D, U+0009 which may also be passed as "\b", "\f", "\n", "\r", "\t").
json.h behaves as follows:
These are expected to return parsing errors:
- 0x01 - 0x07 are parsed and serialized back to 0x01 - 0x07
- 0x08 is parsed and serialized back to "\u0008"
- 0x0b is parsed and serialized back to 0x0b
- 0x0c is parsed and serialized back to "\u000c"
- 0x0e - 0x1f are parsed and serialized back to 0x0e - 0x1f
These are expected to be parsed and return "\u00xx":
- "\u0001" - "\u0007" are parsed and serialized back to 0x01 - 0x07
- "\u000b" is parsed and serialized back to 0x000b
- "\u000e" - "\u001f" are parsed and serialized back to 0x0e - 0x1f
Note that since there is also Section 9 "Parser", json.h is technically still adhering to the specification. So feel free to decide on the correct way to handle this.
A JSON parser MAY accept non-JSON forms or extensions.
from json.h.
Cannot see the sample (it 404's for me). Can you point me at the offending JSON grammar language that the lib is violating by any chance? Happy to have this fixed, but just wanna know where it says!
from json.h.
Nice summary thanks! I think we'll fix this - seems worthwhile to err on the side of caution here.
I can take this change up if you wish, but happy to accept a PR if you'd rather do the coding!
from json.h.
Hi, sorry for the late reply. Unfortunately, I am not that familiar with the code base, so I think it would be better, if you implemented the necessary changes.
from json.h.
Totally fine. When I get the time I'll look into it.
from json.h.
Related Issues (20)
- Convert a json object into json string HOT 2
- Stack Overflow in json_get_value_size() HOT 2
- Minor overflow in json_skip_whitespace HOT 1
- json.h under TrustInSoft CI HOT 5
- Iterate over array linked list HOT 1
- Helping Parsing Array Json HOT 2
- [Feature Request] Lookup value via given key HOT 2
- Buffer overflow in json_skip_whitespace HOT 5
- Buffer overflow in json_get_number_size HOT 3
- Buffer overflow in json_skip_c_style_comments
- Re-definition errors under GCC HOT 8
- Heap buffer overflow in json_parse_value when use json_parse_flags_allow_inf_and_nan HOT 1
- Heap buffer overflow in json_parse_array HOT 1
- Heap Overflow in json_parse_string() HOT 2
- Heap Overflow in json_parse_object()
- Heap Overflow in json_parse_value()
- Heap Overflow in json_parse_number()
- Heap Overflow in json_parse_key()
- Another Heap OOB in json_parse_object()
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from json.h.