netliomax25-code opened a new pull request, #2757:
URL: https://github.com/apache/groovy/pull/2757
Repro: `new JsonSlurper().parseText('{"k":"\u12"}').k` returns the
two-character string `12` instead of failing, and `"\u+041"` decodes to `A`;
both hold for every `JsonParserType`, while `JsonSlurperClassic` rejects the
same documents because `JsonTokenType.STRING` already validates
`\\u[0-9a-fA-F]{4}`.
Cause: `CharBuf.decodeJsonString` reads the digits with
`Integer.parseInt(hex, 16)`, which accepts a leading sign and non-ASCII digits,
and its `index + 4 < to` guard has no else branch, so a truncated escape is
left unconsumed and its digits fall through the loop as text.
Fix: decode the four digits through a strict ASCII hex check and reject a
short or non-hex escape the way the neighboring invalid-escape branch already
does.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
