To demonstrate the semantic bug, I use the following code to parse a json text:
const char *s = "{\"a\": true, \"b\": [ null,9999999999999999999999999999999999999999999999912345678901234567]}";
cJSON *root = NULL;
root = cJSON_Parse(s);
if (root == NULL) {
const char *error_ptr = cJSON_GetErrorPtr();
printf("error in json data:%s\n", error_ptr);
}
It outputs the error message. However, according to the specification https://www.rfc-editor.org/rfc/rfc7159, JSON parser MUST accept all texts that conform to the JSON grammar.
I have checked it against other parsers, e.g., https://jsonlint.com/, https://github.com/nlohmann/json, etc. All of them accepts the text.
This kind of bug has potential security threats especially when different json parser involved (e.g., client side and server side), it may lead to some unexpected errors (e.g., cause data to get out of sync).
Contact Details
dliangfun@gmail.com
What happened?
A bug happened! 运行环境: ubuntu 22.04 固件版本: no
Version
master (Default)
What soultions are you seeing the problem on?
No response
Relevant log output
It outputs the error message. However, according to the specification https://www.rfc-editor.org/rfc/rfc7159, JSON parser MUST accept all texts that conform to the JSON grammar. I have checked it against other parsers, e.g., https://jsonlint.com/, https://github.com/nlohmann/json, etc. All of them accepts the text. This kind of bug has potential security threats especially when different json parser involved (e.g., client side and server side), it may lead to some unexpected errors (e.g., cause data to get out of sync).