Skip to content

Python implementation of json.loads() accepts non-ascii digits #125682

Closed
Closed
Python implementation of json.loads() accepts non-ascii digits#125682
Labels
3.12only security fixes3.13only security fixes3.14bugs and security fixesstdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or error

Description

@nineteendo
nineteendo
opened on Oct 18, 2024

Bug report

Bug description:

You should be careful when matching unicode regexes:

cpython/Lib/json/scanner.py

Lines 11 to 13 in a0f5c8e

NUMBER_RE = re.compile(
r'(-?(?:0|[1-9]\d*))(\.\d+)?([eE][-+]?\d+)?',
(re.VERBOSE | re.MULTILINE | re.DOTALL)) 

>>> import sys
>>> sys.modules["_json"] = None
>>> import json
>>> json.loads("[1\uff10, 0.\uff10, 0e\uff10]")
[10, 0.0, 0.0]

I think it's safer to use [0-9] instead of \d here.

CPython versions tested on:

3.13

Operating systems tested on:

macOS

Linked PRs

Activity

  1. nineteendo
    added
    type-bugAn unexpected behavior, bug, or error
    on Oct 18, 2024

  2. ZeroIntensity commented on Oct 18, 2024

    @ZeroIntensity
    ZeroIntensity
    on Oct 18, 2024
    Member

    Why is this a bug? int and float support this as well:

    >>> int("\uff10")
0
>>> float("0e\uff10")
0.0

    Arguably, the bug is that the C implementation does not support it.

  3. taleinat commented on Oct 18, 2024

    @taleinat
    taleinat
    on Oct 18, 2024
    Contributor

    This can indeed be considered a bug, since it does not conform to the JSON specification in the standards.

    See, for example, Section 6: Numbers in IETF RFC 8259, which clearly defines the supported digits.

  4. ZeroIntensity
    added
    stdlibStandard Library Python modules in the Lib/ directory
    3.12only security fixes
    3.13only security fixes
    3.14bugs and security fixes
    on Oct 18, 2024

  5. ZeroIntensity commented on Oct 18, 2024

    @ZeroIntensity
    ZeroIntensity
    on Oct 18, 2024
    Member

    Ah, I've applied the appropriate labels. Thank you for clarification :)

  6. nineteendo
    changed the title [-]Python implementation of `json.loads()` accepts unicode digits[/-] [+]Python implementation of `json.loads()` accepts non-ascii digits[/+] on Oct 18, 2024
  7. serhiy-storchaka
    added a commit that references this issue on Oct 18, 2024

    gh-125682: Reject non-ASCII digits in the Python implementation of JS…

    d358425
  8. miss-islington
    added 2 commits that reference this issue on Oct 18, 2024

    pythongh-125682: Reject non-ASCII digits in the Python implementation…

    f0c3392

    pythongh-125682: Reject non-ASCII digits in the Python implementation…

    090a7c0

  9. hauntsaninja commented on Oct 21, 2024

    @hauntsaninja
    hauntsaninja
    on Oct 21, 2024
    Contributor

    Good spot!

  10. serhiy-storchaka
    added 2 commits that reference this issue on Oct 21, 2024

    [3.12] gh-125682: Reject non-ASCII digits in the Python implementatio…

    18196fe

    [3.13] gh-125682: Reject non-ASCII digits in the Python implementatio…

    6715afe
  11. serhiy-storchaka
    closed this as completedon Oct 21, 2024
  12. ebonnal
    added a commit that references this issue on Jan 12, 2025

    pythongh-125682: Reject non-ASCII digits in the Python implementation…

    2a604cf
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.12only security fixes3.13only security fixes3.14bugs and security fixesstdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or error

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions