KSP-CKAN / CKAN

The Comprehensive Kerbal Archive Network
https://forum.kerbalspaceprogram.com/index.php?/topic/197082-*
Other
1.99k stars 348 forks source link

Tests for Newtonsoft.Json's handling of octal literals in version files #4227

Closed HebaruSan closed 1 month ago

HebaruSan commented 1 month ago

Motivation

A mod uploaded a release today with this in its version file:

        "PATCH":09,

This causes an inflation error:

New inflation error for <mod name>: Error parsing version file <path to version file>.version: Input string '09' is not a valid number. Path 'VERSION.PATCH', line 9, position 12.

Digging into this, apparently a 0 prefix for numbers isn't technically allowed at all in strict JSON (and a few online validators confirm this), but some parsers (including the most popular one for C#, Newtonsoft.Json) decided to be lenient and parse them as C-style octal literals. But 08 and 09 are not valid octal literals because only the digits 01234567 can be used in octal.

Changes

Now several new test cases are added to check and document exactly what is and is not allowed by Newtonsoft.Json's numeric parser, for future reference.

Note that the QuotedInvalidOctalNumber test is technically using an exploit, as the version file schema requires these fields to be integers, not strings, but CKAN does not enforce this.

JonnyOThan commented 1 month ago

for reference here is the official json grammar: https://www.json.org/json-en.html