Repository navigation
Python implementation of json.loads() accepts invalid unicode escapes #125660
Description
Bug report
Bug description:
While reviewing #125652 and reading the documentation of int(), I realised this condition in json.decoder is insufficient:
Line 61 in f203d1c
>>> import sys
>>> sys.modules["_json"] = None
>>> import json
>>> json.loads(r'["\u 000", "\u-000", "\u+000", "\u0_00"]')
['\x00', '\x00', '\x00', '\x00']CPython versions tested on:
3.13
Operating systems tested on:
macOS
Linked PRs
- gh-125660: Python implementation of json.loads() accepts invalid unicode escapes #125683
- [3.13] gh-125660: Reject invalid unicode escapes for Python implementation of JSON decoder (GH-125683) #125694
- [3.12] gh-125660: Reject invalid unicode escapes for Python implementation of JSON decoder (GH-125683) #125695
Activity
nineteendo commented on Oct 17, 2024
cc @serhiy-storchaka
nineteendo commented on Oct 17, 2024
Maybe something like this? Although it might be a better idea to use a stricter function.
serhiy-storchaka commented on Oct 17, 2024
Either this, or simply use regexp.
nineteendo commented on Oct 18, 2024
Let's use a regex, unicode digits aren't allowed either:
nineteendo commented on Oct 18, 2024
Could there be other code that suffers from this problem?
taleinat commented on Oct 18, 2024
Possibly, but that's out of context for this issue. If someone finds such issues they should be reported separately.
gh-125660: Reject invalid unicode escapes for Python implementation o…
pythongh-125660: Reject invalid unicode escapes for Python implementa…
pythongh-125660: Reject invalid unicode escapes for Python implementa…
pythongh-125660: Enable setting persistent_id and persistent_load of …
[3.13] gh-125660: Reject invalid unicode escapes for Python implement…
[3.12] gh-125660: Reject invalid unicode escapes for Python implement…
pythongh-125660: Reject invalid unicode escapes for Python implementa…