cJSON icon indicating copy to clipboard operation
cJSON copied to clipboard

fail to detect errors in unescaped string

Open Dongmuliang opened this issue 2 years ago • 0 comments

Hi, I have found an issue with cJSON's handling of special characters in JSON strings. According to the specifications outlined in RFC 8259, Section 7

......, All Unicode characters may be placed within the quotation marks, except for the characters that MUST be escaped: quotation mark, reverse solidus, and the control characters (U+0000 through U+001F).

It is crucial to escape specific special characters in a JSON string. Unfortunately, cJSON fails to identify and report these errors. I also checked this with other JSON parsers such as json and simdjson which can handle this correctly and report errors. Specifically, to verify this bug, I used the following code:

char buf[6];
buf[0] = '\"';
buf[1] = '1';
buf[2] = '\x0a'; // a character in the range should be escaped 
buf[3] = '2';
buf[4] = '\"';
buf[5] = 0;
cJSON *root = NULL;
root = cJSON_Parse(buf);
if (!root) {
       const char *error_ptr = cJSON_GetErrorPtr();
       printf("error in json data:%s\n", error_ptr);
} else {
       printf("well-parsed, type:%d\n", root->type);
}

By rectifying this issue, we can ensure cJSON aligns with the expected behavior outlined in the RFC and maintain compatibility with other popular JSON parsers. Hope this helps!

Dongmuliang avatar Jun 25 '23 09:06 Dongmuliang