diff options
| author | Lucas Bremgartner <lucas@bremis.ch> | 2019-09-16 19:46:12 +0000 |
|---|---|---|
| committer | Daniel Martí <mvdan@mvdan.cc> | 2019-09-16 21:56:53 +0000 |
| commit | c1000c500cb4cec2991f8c1924cd5fff05279658 (patch) | |
| tree | 437a1dba9133567ff611ffad29f926971f88e2d7 /src | |
| parent | 0e0bff840e3cd041aa9d103c6135862faae9c03f (diff) | |
| download | go-c1000c500cb4cec2991f8c1924cd5fff05279658.tar.xz | |
encoding/json: validate strings when decoding into Number
Unmarshaling a string into a json.Number should first check that the string is a valid Number.
If not, we should fail without decoding it.
Fixes #14702
Change-Id: I286178e93df74ad63c0a852c3f3489577072cf47
GitHub-Last-Rev: fe69bb68eed06d056639f440d2daf4bb7c99013b
GitHub-Pull-Request: golang/go#34272
Reviewed-on: https://go-review.googlesource.com/c/go/+/195045
Reviewed-by: Daniel Martí <mvdan@mvdan.cc>
Run-TryBot: Daniel Martí <mvdan@mvdan.cc>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/encoding/json/decode.go | 3 | ||||
| -rw-r--r-- | src/encoding/json/decode_test.go | 31 |
2 files changed, 34 insertions, 0 deletions
diff --git a/src/encoding/json/decode.go b/src/encoding/json/decode.go index 360fc69d04..407fbcedbe 100644 --- a/src/encoding/json/decode.go +++ b/src/encoding/json/decode.go @@ -949,6 +949,9 @@ func (d *decodeState) literalStore(item []byte, v reflect.Value, fromQuoted bool } v.SetBytes(b[:n]) case reflect.String: + if v.Type() == numberType && !isValidNumber(string(s)) { + return fmt.Errorf("json: invalid number literal, trying to unmarshal %q into Number", item) + } v.SetString(string(s)) case reflect.Interface: if v.NumMethod() == 0 { diff --git a/src/encoding/json/decode_test.go b/src/encoding/json/decode_test.go index 489f8674d0..4cbd2172d0 100644 --- a/src/encoding/json/decode_test.go +++ b/src/encoding/json/decode_test.go @@ -949,6 +949,37 @@ var unmarshalTests = []unmarshalTest{ Offset: 29, }, }, + // #14702 + { + in: `invalid`, + ptr: new(Number), + err: &SyntaxError{ + msg: "invalid character 'i' looking for beginning of value", + Offset: 1, + }, + }, + { + in: `"invalid"`, + ptr: new(Number), + err: fmt.Errorf("json: invalid number literal, trying to unmarshal %q into Number", `"invalid"`), + }, + { + in: `{"A":"invalid"}`, + ptr: new(struct{ A Number }), + err: fmt.Errorf("json: invalid number literal, trying to unmarshal %q into Number", `"invalid"`), + }, + { + in: `{"A":"invalid"}`, + ptr: new(struct { + A Number `json:",string"` + }), + err: fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into json.Number", `invalid`), + }, + { + in: `{"A":"invalid"}`, + ptr: new(map[string]Number), + err: fmt.Errorf("json: invalid number literal, trying to unmarshal %q into Number", `"invalid"`), + }, } func TestMarshal(t *testing.T) { |