Skip to content

Reject NUL-truncated Validator schemas and documents #250

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lelit merged 2 commits into from
Oct 31, 2026
Merged

Reject NUL-truncated Validator schemas and documents #250

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7258cb9
Reject NUL-truncated Validator schemas and documents
jadenfix Oct 18, 2026
8f96aad
Allow one rounding unit in the native float doctest
jadenfix Oct 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGES.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@ Changes
1.26 (unreleased)
~~~~~~~~~~~~~~~~~

* Reject embedded NUL truncation in ``Validator`` schemas and documents

* Add Windows ARM64 build (`PR #242`__), thanks to Nikhil Dabas

__ https://github.com/python-rapidjson/python-rapidjson/pull/242
Expand Down
12 changes: 10 additions & 2 deletions docs/loads.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,8 +113,16 @@

>>> loads('123456789012345678901234567890')
123456789012345678901234567890
>>> loads('123456789012345678901234567890', number_mode=NM_NATIVE)
1.2345678901234566e+29
>>> import math
>>> native = loads('123456789012345678901234567890', number_mode=NM_NATIVE)
>>> isinstance(native, float)
True
>>> math.isclose(native, float(123456789012345678901234567890),
... rel_tol=0, abs_tol=math.ulp(native))
True

The final bit of the rounded ``double`` can differ between platforms; the example
permits a difference of one unit in the last place while requiring a ``float``.

These flags can be combined together:

Expand Down
16 changes: 10 additions & 6 deletions rapidjson.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3716,17 +3716,18 @@ static PyObject* validator_call(PyObject* self, PyObject* args, PyObject* kwargs
return NULL;

const char* jsonStr;
Py_ssize_t jsonStrLen;
PyObject* asUnicode = NULL;

if (PyUnicode_Check(jsonObject)) {
jsonStr = PyUnicode_AsUTF8(jsonObject);
jsonStr = PyUnicode_AsUTF8AndSize(jsonObject, &jsonStrLen);
if (jsonStr == NULL)
return NULL;
} else if (PyBytes_Check(jsonObject) || PyByteArray_Check(jsonObject)) {
asUnicode = PyUnicode_FromEncodedObject(jsonObject, "utf-8", NULL);
if (asUnicode == NULL)
return NULL;
jsonStr = PyUnicode_AsUTF8(asUnicode);
jsonStr = PyUnicode_AsUTF8AndSize(asUnicode, &jsonStrLen);
if (jsonStr == NULL) {
Py_DECREF(asUnicode);
return NULL;
Expand All @@ -3741,7 +3742,8 @@ static PyObject* validator_call(PyObject* self, PyObject* args, PyObject* kwargs
bool error;

Py_BEGIN_ALLOW_THREADS
error = d.Parse(jsonStr).HasParseError();
StringStream stream(jsonStr);
error = d.ParseStream(stream).HasParseError() || stream.Tell() < (size_t) jsonStrLen;
Py_END_ALLOW_THREADS

if (error) {
Expand Down Expand Up @@ -3803,17 +3805,18 @@ static PyObject* validator_new(PyTypeObject* type, PyObject* args, PyObject* kwa
return NULL;

const char* jsonStr;
Py_ssize_t jsonStrLen;
PyObject* asUnicode = NULL;

if (PyUnicode_Check(jsonObject)) {
jsonStr = PyUnicode_AsUTF8(jsonObject);
jsonStr = PyUnicode_AsUTF8AndSize(jsonObject, &jsonStrLen);
if (jsonStr == NULL)
return NULL;
} else if (PyBytes_Check(jsonObject) || PyByteArray_Check(jsonObject)) {
asUnicode = PyUnicode_FromEncodedObject(jsonObject, "utf-8", NULL);
if (asUnicode == NULL)
return NULL;
jsonStr = PyUnicode_AsUTF8(asUnicode);
jsonStr = PyUnicode_AsUTF8AndSize(asUnicode, &jsonStrLen);
if (jsonStr == NULL) {
Py_DECREF(asUnicode);
return NULL;
Expand All @@ -3828,7 +3831,8 @@ static PyObject* validator_new(PyTypeObject* type, PyObject* args, PyObject* kwa
bool error;

Py_BEGIN_ALLOW_THREADS
error = d.Parse(jsonStr).HasParseError();
StringStream stream(jsonStr);
error = d.ParseStream(stream).HasParseError() || stream.Tell() < (size_t) jsonStrLen;
Py_END_ALLOW_THREADS

if (asUnicode != NULL)
Expand Down
37 changes: 37 additions & 0 deletions tests/test_validator.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,3 +65,40 @@ def test_invalid(schema, json, details):
def test_additional_and_pattern_properties_valid(schema, json):
validate = rj.Validator(schema)
validate(json)


@pytest.mark.parametrize('convert', (str, lambda s: s.encode('utf-8'),
lambda s: bytearray(s.encode('utf-8'))))
@pytest.mark.parametrize('suffix', ('\0', '\0garbage', ' \n\0{}'))
@pytest.mark.parametrize('root', ('{}', '{"type":"integer"}', '{"title":"café"}'))
def test_schema_with_embedded_nul(convert, suffix, root):
with pytest.raises(rj.JSONDecodeError, match='Invalid JSON'):
rj.Validator(convert(root + suffix))


@pytest.mark.parametrize('convert', (str, lambda s: s.encode('utf-8'),
lambda s: bytearray(s.encode('utf-8'))))
@pytest.mark.parametrize('suffix', ('\0', '\0garbage', ' \n\0{}'))
@pytest.mark.parametrize('root', ('123', '[]', '{"key":"café"}'))
def test_document_with_embedded_nul(convert, suffix, root):
validate = rj.Validator('{}')
with pytest.raises(rj.JSONDecodeError, match='Invalid JSON'):
validate(convert(root + suffix))


@pytest.mark.parametrize('convert', (str, lambda s: s.encode('utf-8'),
lambda s: bytearray(s.encode('utf-8'))))
def test_escaped_nul_remains_valid(convert):
validate = rj.Validator(convert(rj.dumps({"type": "string", "enum": ["a\0b"]})))
validate(convert(rj.dumps("a\0b")))
with pytest.raises(rj.ValidationError):
validate(rj.dumps("other"))


@pytest.mark.parametrize('convert', (str, lambda s: s.encode('utf-8'),
lambda s: bytearray(s.encode('utf-8'))))
def test_trailing_json_whitespace(convert):
validate = rj.Validator(convert('{"type":"integer"} \n\t\r'))
validate(convert('123 \n\t\r'))
with pytest.raises(rj.ValidationError):
validate(convert('"wrong type" \n\t\r'))
Loading