Skip to content

wrap malformed json number decode in JsonException#2713

Closed
netliomax25-code wants to merge 1 commit into
apache:masterfrom
netliomax25-code:json-malformed-number-jsonexception
Closed

wrap malformed json number decode in JsonException#2713
netliomax25-code wants to merge 1 commit into
apache:masterfrom
netliomax25-code:json-malformed-number-jsonexception

Conversation

@netliomax25-code

Copy link
Copy Markdown
Contributor
  1. A value that starts with a digit or minus enters number decoding, but a malformed exponent or a lone sign/point such as 1e, 1e+, 1E, or -. is only rejected when the collected token reaches new BigDecimal(...).
  2. The INDEX_OVERLAY and LAX overlay parsers already wrap that NumberFormatException in a JsonException (NumberValue.bigDecimalValue), but the default CHAR_BUFFER parser (CharScanner.parseJsonNumber) and the CHARACTER_SOURCE parser (JsonParserUsingCharacterSource.decodeNumber) let it propagate unwrapped, so an application guarding untrusted JSON with catch (JsonException) sees a raw NumberFormatException instead.
  3. Wrapped the numeric construction at both sites so malformed numbers surface as JsonException, matching the overlay parsers. Added a regression test that checks all four parser types.

@paulk-asert

Copy link
Copy Markdown
Contributor

Thanks! Merged as part of PR#2715 (GROOVY-12168) including tweaks to fix the build breakage and some consistency improvements.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants