encoding/json: handle misspelled JSON literals in ,string

Fixes #15146.

Change-Id: I229611b9cc995a1391681c492c4d742195c787ea
Reviewed-on: https://go-review.googlesource.com/30943
Run-TryBot: Russ Cox <rsc@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

1 files changed, 13 insertions, 1 deletions

diff --git a/src/encoding/json/decode.go b/src/encoding/json/decode.go
index ceaecec67c..ee3585f3e6 100644
--- a/src/encoding/json/decode.go
+++ b/src/encoding/json/decode.go
@@ -851,13 +851,25 @@ func (d *decodeState) literalStore(item []byte, v reflect.Value, fromQuoted bool
 
 	switch c := item[0]; c {
 	case 'n': // null
+		// The main parser checks that only true and false can reach here,
+		// but if this was a quoted string input, it could be anything.
+		if fromQuoted && string(item) != "null" {
+			d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
+			break
+		}
 		switch v.Kind() {
 		case reflect.Interface, reflect.Ptr, reflect.Map, reflect.Slice:
 			v.Set(reflect.Zero(v.Type()))
 			// otherwise, ignore null for primitives/string
 		}
 	case 't', 'f': // true, false
-		value := c == 't'
+		value := item[0] == 't'
+		// The main parser checks that only true and false can reach here,
+		// but if this was a quoted string input, it could be anything.
+		if fromQuoted && string(item) != "true" && string(item) != "false" {
+			d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
+			break
+		}
 		switch v.Kind() {
 		default:
 			if fromQuoted {