davisp / jiffy

JSON NIFs for Erlang
Other
869 stars 319 forks source link

The value field contained `\r\n` will cause a decode crash #201

Closed HJianBo closed 2 years ago

HJianBo commented 4 years ago

E.g:

1> jiffy:decode(<<"{\"a\": \"123\r\n\"}">>).
** exception error: {11,invalid_string}
     in function  jiffy:decode/2 (/path/to/jiffy/src/jiffy.erl, line 71)

%% The following can works well
2> jiffy:decode(<<"{\"a\": \"123\\r\\n\"}">>).
{[{<<"a">>,<<"123\r\n">>}]}

I think it would be better to support these special formats, such as adding a 'escape_in_string' option for jiffy:decode/2 function

davisp commented 2 years ago

Raw \r and \n characters in JSON are invalid and allowing them would be very not good. And to avoid confusion, I mean the literal byte values 0x0D and 0x0A specifically are disallowed. Using the byte syntax of <<"\r\n">> is placing those disallowed values into the binary value that you're asking to Jiffy to decode. The correct approach is to make sure that the` value is escaped.