Reject unpaired JSON surrogate escapes - #1085
Draft
He-Pin wants to merge 1 commit into
Draft
Conversation
He-Pin
force-pushed
the
fix/parsejson-surrogates
branch
from
July 4, 2026 11:52
6aee07c to
8974a1e
Compare
Motivation: std.parseJson and strict .json import fast paths accepted or normalized JSON strings containing unpaired UTF-16 surrogate escapes. That allowed invalid JSON Unicode to become Jsonnet strings, diverging from cpp-jsonnet and jrsonnet behavior and from the intent of rejecting malformed JSON input. Modification: Add a shared surrogate validator for JSON visitors, enable it for std.parseJson, and convert strict .json import surrogate failures into normal Jsonnet errors instead of falling back or producing raw invalid strings. Keep the import fast path allocation-conscious with a private nullable return contract, leaving any reusable OptionVal abstraction for a separate PR. Result: Lone high/low surrogate values and keys now fail with Invalid JSON: unpaired surrogate in string, valid surrogate pairs still materialize as codepoint strings, escaped literal text such as \\uD800 remains ordinary text, and loose Jsonnet .json files can still fall back through the Jsonnet parser. References: https://jsonnet.org/ref/stdlib.html#std-parseJson google/go-jsonnet#885 com-lihaoyi/upickle#722
He-Pin
force-pushed
the
fix/parsejson-surrogates
branch
from
July 4, 2026 11:57
8974a1e to
07ed891
Compare
Contributor
Author
|
refs: com-lihaoyi/upickle#723 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
std.parseJsonand the strict.jsonimport fast path could let JSON strings containing lone UTF-16 surrogate halves through as Jsonnet strings. The proper fix belongs in ujson upstream; this PR adds a downstream guard.Modification
ValVisitor.rejectUnpairedSurrogatesfor decoded JSON string values and object keys.std.parseJsonand the strict.jsonimport path."\\uD800").Result
std.parseJson("\"\\uD800\"")5529665533std.parseJson("\"\\uDC00\"")5632065533std.parseJson("\"\\uD83D\\uDE00\"")(valid pair)1285121285121285121285121285125529665533Aligns with cpp-jsonnet and jrsonnet. go-jsonnet normalizes to U+FFFD (see google/go-jsonnet#885).
References