FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-125660: Python implementation of `json.loads()` accepts invalid unicode escapes by nineteendo · Pull Request #125683 · python/cpython · GitHub

  1. python
  2. cpython

Repository navigation

gh-125660: Python implementation of json.loads() accepts invalid unicode escapes - #125683

Merged
serhiy-storchaka merged 7 commits into
python:mainfrom
nineteendo:patch-1
Oct 18, 2024
ConversationCommits (7)ChecksFiles changed
Merged

gh-125660: Python implementation of json.loads() accepts invalid unicode escapes#125683
serhiy-storchaka merged 7 commits into
python:mainfrom
nineteendo:patch-1

Conversation

nineteendo commented Oct 18, 2024 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Contributor

This condition in json.decoder is insufficient:

cpython/Lib/json/decoder.py

Line 61 in f203d1c

if len(esc) == 4 and esc[1] not in 'xX': 

>>> import sys
>>> sys.modules["_json"] = None
>>> import json
>>> json.loads(r'["\u 000", "\u-000", "\u+000", "\u0_00"]')
['\x00', '\x00', '\x00', '\x00']

bedevere-app Bot mentioned this pull request Oct 18, 2024
Closed
nineteendo marked this pull request as ready for review October 18, 2024 09:10
ZeroIntensity approved these changes Oct 18, 2024
View reviewed changes

ZeroIntensity left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

For other reviewers, see also: #125687

I think this is fine, but per @taleinat, this shouldn't get backported--it's technically a very minor breaking change.

taleinat commented Oct 18, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

I think this is fine, but per @taleinat, this shouldn't get backported--it's technically a very minor breaking change.

After further consideration, I do consider this to be a clear bug fix, which should be backported to versions in "bugfix" status (i.e. 3.12).

ZeroIntensity commented Oct 18, 2024

Copy link
Copy Markdown
Member

Are you sure? I'm not certain what policy PyPy, IronPython, Jython, etc. have for changes that we backport, but point of pure-Python modules was almost exclusively for other Python implementations--I don't want to accidentally cause any surprises.

ZeroIntensity mentioned this pull request Oct 18, 2024
Merged

taleinat commented Oct 18, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

Are you sure?

No, I am not sure, I've been away from Python development for several years. It would be good to get another core dev's perspective.

taleinat commented Oct 18, 2024

Copy link
Copy Markdown
Contributor

Upon further consideration, yes, the chance of breaking something with a backport is large relative to the likely pain caused by the current, buggy, state. Let's avoid backporting.

serhiy-storchaka approved these changes Oct 18, 2024
View reviewed changes

serhiy-storchaka left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

LGTM. 👍

serhiy-storchaka added needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes labels Oct 18, 2024

serhiy-storchaka commented Oct 18, 2024

Copy link
Copy Markdown
Member

This is clearly a bug. json.loads() can be a part of validation. If it accepts an invalid JSON, it can fail later, in other program with more strict JSON parser. I do not think that anybody depends on such buggy behavior.

serhiy-storchaka merged commit df75136 into python:main Oct 18, 2024

miss-islington-app Bot commented Oct 18, 2024

Copy link
Copy Markdown

Thanks @nineteendo for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12, 3.13.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 18, 2024
pythongh-125660: Reject invalid unicode escapes for Python implementa…
025b9e8 
…tion of JSON decoder (pythonGH-125683)

(cherry picked from commit df75136)

Co-authored-by: Nice Zombies <nineteendo19d0@gmail.com>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 18, 2024
pythongh-125660: Reject invalid unicode escapes for Python implementa…
49905fb 
…tion of JSON decoder (pythonGH-125683)

(cherry picked from commit df75136)

Co-authored-by: Nice Zombies <nineteendo19d0@gmail.com>

bedevere-app Bot commented Oct 18, 2024

Copy link
Copy Markdown

GH-125694 is a backport of this pull request to the 3.13 branch.

bedevere-app Bot removed the needs backport to 3.13 only security fixes label Oct 18, 2024

bedevere-app Bot commented Oct 18, 2024

Copy link
Copy Markdown

GH-125695 is a backport of this pull request to the 3.12 branch.

bedevere-app Bot removed the needs backport to 3.12 only security fixes label Oct 18, 2024
nineteendo deleted the patch-1 branch October 18, 2024 12:30
serhiy-storchaka pushed a commit that referenced this pull request Oct 21, 2024
[3.13] gh-125660: Reject invalid unicode escapes for Python implement…
d9dafc7 
…ation of JSON decoder (GH-125683) (GH-125694)

(cherry picked from commit df75136)

Co-authored-by: Nice Zombies <nineteendo19d0@gmail.com>
serhiy-storchaka pushed a commit that referenced this pull request Oct 21, 2024
[3.12] gh-125660: Reject invalid unicode escapes for Python implement…
2746ec4 
…ation of JSON decoder (GH-125683) (GH-125695)

(cherry picked from commit df75136)

Co-authored-by: Nice Zombies <nineteendo19d0@gmail.com>
ebonnal pushed a commit to ebonnal/cpython that referenced this pull request Jan 12, 2025
pythongh-125660: Reject invalid unicode escapes for Python implementa…
a05b129 
…tion of JSON decoder (pythonGH-125683)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

serhiy-storchaka serhiy-storchaka approved these changes
ZeroIntensity ZeroIntensity approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

Back | FazBrowse Home | New Git URL