Merge pull request stleary#759 from eamonnmcmanus/eofnull

JSON parsing should detect embedded `\0` values
johnjaylward · Oct 17, 2023 · ca48f2d · ca48f2d
1 parent a963115
commit ca48f2d
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/src/main/java/org/json/JSONObject.java b/src/main/java/org/json/JSONObject.java
@@ -256,6 +256,9 @@ public JSONObject(JSONTokener x) throws JSONException {
                 if (x.nextClean() == '}') {
                     return;
                 }
+                if (x.end()) {
+                    throw x.syntaxError("A JSONObject text must end with '}'");
+                }
                 x.back();
                 break;
             case '}':

diff --git a/src/test/java/org/json/junit/JSONObjectTest.java b/src/test/java/org/json/junit/JSONObjectTest.java
@@ -2198,6 +2198,15 @@ public void jsonObjectParsingErrors() {
                     "Expected a ',' or '}' at 15 [character 16 line 1]",
                     e.getMessage());
         }
+        try {
+            // \0 after ,
+            String str = "{\"myKey\":true, \0\"myOtherKey\":false}";
+            assertNull("Expected an exception",new JSONObject(str));
+        } catch (JSONException e) {
+            assertEquals("Expecting an exception message",
+                    "A JSONObject text must end with '}' at 15 [character 16 line 1]",
+                    e.getMessage());
+        }
         try {
             // append to wrong key
             String str = "{\"myKey\":true, \"myOtherKey\":false}";