[go] encoding/json: fix extra data regression under goexperiment.jsonv2

4 views
Skip to first unread message

Joseph Tsai (Gerrit)

unread,
Jul 24, 2025, 5:40:00 PMJul 24
to goph...@pubsubhelper.golang.org, golang-co...@googlegroups.com

Joseph Tsai has uploaded the change for review

Commit message

encoding/json: fix extra data regression under goexperiment.jsonv2

When operating under v1 semantics in the v2 implementation,
ab extra data error should take precedence over any semantic error
that could theoretically occur within the value itself.

This change only affects code compiled under goexperiment.jsonv2.

Fixes #74614
Change-Id: I055a606b053fa66b0c766ae205487b8290109285

Change diff

diff --git a/src/encoding/json/jsontext/decode.go b/src/encoding/json/jsontext/decode.go
index 44b4366..b9f247b 100644
--- a/src/encoding/json/jsontext/decode.go
+++ b/src/encoding/json/jsontext/decode.go
@@ -776,7 +776,8 @@
 
 // CheckNextValue checks whether the next value is syntactically valid,
 // but does not advance the read offset.
-func (d *decoderState) CheckNextValue() error {
+// If last, it verifies that the stream cleanly terminates with [io.EOF].
+func (d *decoderState) CheckNextValue(last bool) error {
 	d.PeekKind() // populates d.peekPos and d.peekErr
 	pos, err := d.peekPos, d.peekErr
 	d.peekPos, d.peekErr = 0, nil
@@ -787,13 +788,18 @@
 	var flags jsonwire.ValueFlags
 	if pos, err := d.consumeValue(&flags, pos, d.Tokens.Depth()); err != nil {
 		return wrapSyntacticError(d, err, pos, +1)
+	} else if last {
+		return d.checkEOF(pos)
 	}
 	return nil
 }
 
 // CheckEOF verifies that the input has no more data.
 func (d *decoderState) CheckEOF() error {
-	switch pos, err := d.consumeWhitespace(d.prevEnd); err {
+	return d.checkEOF(d.prevEnd)
+}
+func (d *decoderState) checkEOF(pos int) error {
+	switch pos, err := d.consumeWhitespace(pos); err {
 	case nil:
 		err := jsonwire.NewInvalidCharacterError(d.buf[pos:], "after top-level value")
 		return wrapSyntacticError(d, err, pos, 0)
diff --git a/src/encoding/json/v2/arshal.go b/src/encoding/json/v2/arshal.go
index 5cd2106..e2ce778 100644
--- a/src/encoding/json/v2/arshal.go
+++ b/src/encoding/json/v2/arshal.go
@@ -409,7 +409,7 @@
 	dec := export.GetBufferedDecoder(in, opts...)
 	defer export.PutBufferedDecoder(dec)
 	xd := export.Decoder(dec)
-	err = unmarshalFull(dec, out, &xd.Struct)
+	err = unmarshalDecode(dec, out, &xd.Struct, true)
 	if err != nil && xd.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
 		return internal.TransformUnmarshalError(out, err)
 	}
@@ -426,25 +426,13 @@
 	dec := export.GetStreamingDecoder(in, opts...)
 	defer export.PutStreamingDecoder(dec)
 	xd := export.Decoder(dec)
-	err = unmarshalFull(dec, out, &xd.Struct)
+	err = unmarshalDecode(dec, out, &xd.Struct, true)
 	if err != nil && xd.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
 		return internal.TransformUnmarshalError(out, err)
 	}
 	return err
 }
 
-func unmarshalFull(in *jsontext.Decoder, out any, uo *jsonopts.Struct) error {
-	switch err := unmarshalDecode(in, out, uo); err {
-	case nil:
-		return export.Decoder(in).CheckEOF()
-	case io.EOF:
-		offset := in.InputOffset() + int64(len(in.UnreadBuffer()))
-		return &jsontext.SyntacticError{ByteOffset: offset, Err: io.ErrUnexpectedEOF}
-	default:
-		return err
-	}
-}
-
 // UnmarshalDecode deserializes a Go value from a [jsontext.Decoder] according to
 // the provided unmarshal options (while ignoring marshal, encode, or decode options).
 // Any unmarshal options already specified on the [jsontext.Decoder]
@@ -463,14 +451,14 @@
 		defer func() { xd.Struct = optsOriginal }()
 		xd.Struct.JoinWithoutCoderOptions(opts...)
 	}
-	err = unmarshalDecode(in, out, &xd.Struct)
+	err = unmarshalDecode(in, out, &xd.Struct, false)
 	if err != nil && xd.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
 		return internal.TransformUnmarshalError(out, err)
 	}
 	return err
 }
 
-func unmarshalDecode(in *jsontext.Decoder, out any, uo *jsonopts.Struct) (err error) {
+func unmarshalDecode(in *jsontext.Decoder, out any, uo *jsonopts.Struct, last bool) (err error) {
 	v := reflect.ValueOf(out)
 	if v.Kind() != reflect.Pointer || v.IsNil() {
 		return &SemanticError{action: "unmarshal", GoType: reflect.TypeOf(out), Err: internal.ErrNonNilReference}
@@ -481,7 +469,11 @@
 	// In legacy semantics, the entirety of the next JSON value
 	// was validated before attempting to unmarshal it.
 	if uo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
-		if err := export.Decoder(in).CheckNextValue(); err != nil {
+		if err := export.Decoder(in).CheckNextValue(last); err != nil {
+			if err == io.EOF {
+				offset := in.InputOffset() + int64(len(in.UnreadBuffer()))
+				return &jsontext.SyntacticError{ByteOffset: offset, Err: io.ErrUnexpectedEOF}
+			}
 			return err
 		}
 	}
@@ -495,8 +487,15 @@
 		if !uo.Flags.Get(jsonflags.AllowDuplicateNames) {
 			export.Decoder(in).Tokens.InvalidateDisabledNamespaces()
 		}
+		if err == io.EOF {
+			offset := in.InputOffset() + int64(len(in.UnreadBuffer()))
+			return &jsontext.SyntacticError{ByteOffset: offset, Err: io.ErrUnexpectedEOF}
+		}
 		return err
 	}
+	if last {
+		return export.Decoder(in).CheckEOF()
+	}
 	return nil
 }

Change information

Files:
  • M src/encoding/json/jsontext/decode.go
  • M src/encoding/json/v2/arshal.go
Change size: S
Delta: 2 files changed, 24 insertions(+), 19 deletions(-)
Open in Gerrit

Related details

Attention set is empty
Submit Requirements:
  • requirement is not satisfiedCode-Review
  • requirement satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
  • requirement is not satisfiedTryBots-Pass
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: newchange
Gerrit-Project: go
Gerrit-Branch: master
Gerrit-Change-Id: I055a606b053fa66b0c766ae205487b8290109285
Gerrit-Change-Number: 689919
Gerrit-PatchSet: 1
Gerrit-Owner: Joseph Tsai <joe...@digital-static.net>
unsatisfied_requirement
satisfied_requirement
open
diffy

Joseph Tsai (Gerrit)

unread,
Jul 24, 2025, 5:40:28 PMJul 24
to goph...@pubsubhelper.golang.org, Damien Neil, golang-co...@googlegroups.com
Attention needed from Damien Neil

Joseph Tsai voted

Auto-Submit+1
Commit-Queue+1
Open in Gerrit

Related details

Attention is currently required from:
  • Damien Neil
Submit Requirements:
  • requirement is not satisfiedCode-Review
  • requirement satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
  • requirement is not satisfiedTryBots-Pass
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: go
Gerrit-Branch: master
Gerrit-Change-Id: I055a606b053fa66b0c766ae205487b8290109285
Gerrit-Change-Number: 689919
Gerrit-PatchSet: 1
Gerrit-Owner: Joseph Tsai <joe...@digital-static.net>
Gerrit-Reviewer: Damien Neil <dn...@google.com>
Gerrit-Reviewer: Joseph Tsai <joe...@digital-static.net>
Gerrit-Attention: Damien Neil <dn...@google.com>
Gerrit-Comment-Date: Thu, 24 Jul 2025 21:40:23 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
unsatisfied_requirement
satisfied_requirement
open
diffy

Joseph Tsai (Gerrit)

unread,
Jul 24, 2025, 5:41:31 PMJul 24
to goph...@pubsubhelper.golang.org, golang-co...@googlegroups.com
Attention needed from Damien Neil and Joseph Tsai

Joseph Tsai uploaded new patchset

Joseph Tsai uploaded patch set #2 to this change.
Open in Gerrit

Related details

Attention is currently required from:
  • Damien Neil
  • Joseph Tsai
Submit Requirements:
  • requirement is not satisfiedCode-Review
  • requirement satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
  • requirement is not satisfiedTryBots-Pass
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: newpatchset
Gerrit-Project: go
Gerrit-Branch: master
Gerrit-Change-Id: I055a606b053fa66b0c766ae205487b8290109285
Gerrit-Change-Number: 689919
Gerrit-PatchSet: 2
Gerrit-Owner: Joseph Tsai <joe...@digital-static.net>
Gerrit-Reviewer: Damien Neil <dn...@google.com>
Gerrit-Reviewer: Joseph Tsai <joe...@digital-static.net>
Gerrit-Attention: Joseph Tsai <joe...@digital-static.net>
Gerrit-Attention: Damien Neil <dn...@google.com>
unsatisfied_requirement
satisfied_requirement
open
diffy

Damien Neil (Gerrit)

unread,
Jul 24, 2025, 6:16:11 PMJul 24
to Joseph Tsai, goph...@pubsubhelper.golang.org, Go LUCI, golang-co...@googlegroups.com
Attention needed from Joseph Tsai

Damien Neil voted Code-Review+2

Code-Review+2
Open in Gerrit

Related details

Attention is currently required from:
  • Joseph Tsai
Submit Requirements:
  • requirement satisfiedCode-Review
  • requirement satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
  • requirement satisfiedTryBots-Pass
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: go
Gerrit-Branch: master
Gerrit-Change-Id: I055a606b053fa66b0c766ae205487b8290109285
Gerrit-Change-Number: 689919
Gerrit-PatchSet: 2
Gerrit-Owner: Joseph Tsai <joe...@digital-static.net>
Gerrit-Reviewer: Damien Neil <dn...@google.com>
Gerrit-Reviewer: Joseph Tsai <joe...@digital-static.net>
Gerrit-Attention: Joseph Tsai <joe...@digital-static.net>
Gerrit-Comment-Date: Thu, 24 Jul 2025 22:16:06 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
satisfied_requirement
unsatisfied_requirement
open
diffy

Michael Knyszek (Gerrit)

unread,
Jul 24, 2025, 11:28:19 PMJul 24
to Joseph Tsai, goph...@pubsubhelper.golang.org, Damien Neil, Go LUCI, golang-co...@googlegroups.com
Attention needed from Joseph Tsai

Michael Knyszek voted Code-Review+1

Code-Review+1
Open in Gerrit

Related details

Attention is currently required from:
  • Joseph Tsai
Submit Requirements:
    • requirement satisfiedCode-Review
    • requirement satisfiedNo-Unresolved-Comments
    • requirement satisfiedReview-Enforcement
    • requirement satisfiedTryBots-Pass
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: go
    Gerrit-Branch: master
    Gerrit-Change-Id: I055a606b053fa66b0c766ae205487b8290109285
    Gerrit-Change-Number: 689919
    Gerrit-PatchSet: 2
    Gerrit-Owner: Joseph Tsai <joe...@digital-static.net>
    Gerrit-Reviewer: Damien Neil <dn...@google.com>
    Gerrit-Reviewer: Joseph Tsai <joe...@digital-static.net>
    Gerrit-Reviewer: Michael Knyszek <mkny...@google.com>
    Gerrit-Attention: Joseph Tsai <joe...@digital-static.net>
    Gerrit-Comment-Date: Fri, 25 Jul 2025 03:28:16 +0000
    Gerrit-HasComments: No
    Gerrit-Has-Labels: Yes
    satisfied_requirement
    open
    diffy

    Michael Knyszek (Gerrit)

    unread,
    Jul 24, 2025, 11:28:56 PMJul 24
    to Joseph Tsai, goph...@pubsubhelper.golang.org, Damien Neil, Go LUCI, golang-co...@googlegroups.com
    Attention needed from Joseph Tsai

    Michael Knyszek voted Auto-Submit+1

    Auto-Submit+1
    Open in Gerrit

    Related details

    Attention is currently required from:
    • Joseph Tsai
    Submit Requirements:
    • requirement satisfiedCode-Review
    • requirement satisfiedNo-Unresolved-Comments
    • requirement satisfiedReview-Enforcement
    • requirement satisfiedTryBots-Pass
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: go
    Gerrit-Branch: master
    Gerrit-Change-Id: I055a606b053fa66b0c766ae205487b8290109285
    Gerrit-Change-Number: 689919
    Gerrit-PatchSet: 2
    Gerrit-Owner: Joseph Tsai <joe...@digital-static.net>
    Gerrit-Reviewer: Damien Neil <dn...@google.com>
    Gerrit-Reviewer: Joseph Tsai <joe...@digital-static.net>
    Gerrit-Reviewer: Michael Knyszek <mkny...@google.com>
    Gerrit-Attention: Joseph Tsai <joe...@digital-static.net>
    Gerrit-Comment-Date: Fri, 25 Jul 2025 03:28:53 +0000
    Gerrit-HasComments: No
    Gerrit-Has-Labels: Yes
    satisfied_requirement
    open
    diffy

    Gopher Robot (Gerrit)

    unread,
    Jul 24, 2025, 11:30:33 PMJul 24
    to Joseph Tsai, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Michael Knyszek, Damien Neil, Go LUCI, golang-co...@googlegroups.com

    Gopher Robot submitted the change

    Change information

    Commit message:
    encoding/json: fix extra data regression under goexperiment.jsonv2

    When operating under v1 semantics in the v2 implementation,
    a extra data error should take precedence over any semantic error

    that could theoretically occur within the value itself.

    This change only affects code compiled under goexperiment.jsonv2.

    Fixes #74614
    Change-Id: I055a606b053fa66b0c766ae205487b8290109285
    Reviewed-by: Damien Neil <dn...@google.com>
    Reviewed-by: Michael Knyszek <mkny...@google.com>
    Auto-Submit: Michael Knyszek <mkny...@google.com>
    Files:
    • M src/encoding/json/jsontext/decode.go
    • M src/encoding/json/v2/arshal.go
    Change size: S
    Delta: 2 files changed, 24 insertions(+), 19 deletions(-)
    Branch: refs/heads/master
    Submit Requirements:
    • requirement satisfiedCode-Review: +2 by Damien Neil, +1 by Michael Knyszek
    • requirement satisfiedTryBots-Pass: LUCI-TryBot-Result+1 by Go LUCI
     Open in Gerrit
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    


     Gerrit-MessageType: merged 
    

     Gerrit-Project: go 
    

     Gerrit-Branch: master 
    

     Gerrit-Change-Id: I055a606b053fa66b0c766ae205487b8290109285 
    

     Gerrit-Change-Number: 689919 
    

     Gerrit-PatchSet: 3 
    

     Gerrit-Owner: Joseph Tsai <joe...@digital-static.net> 
    

     Gerrit-Reviewer: Damien Neil <dn...@google.com> 
    


     Gerrit-Reviewer: Gopher Robot <go...@golang.org> 
    open
    diffy
    satisfied_requirement
    Joseph Tsai (Gerrit)
    unread,
    Aug 8, 2025, 6:13:08 PMAug 8
    to Gopher Robot, goph...@pubsubhelper.golang.org, Damien Neil, Go LUCI, golang-co...@googlegroups.com
    Joseph Tsai has created a revert of this change
    Related details
    Attention set is empty
    Submit Requirements:
    • requirement satisfiedCode-Review
    • requirement satisfiedNo-Unresolved-Comments
    • requirement satisfiedReview-Enforcement
    • requirement satisfiedTryBots-Pass
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    


     Gerrit-MessageType: revert 
    satisfied_requirement
    open
    diffy
    Funda Secgin (Gerrit)
    unread,
    Aug 9, 2025, 6:55:53 PMAug 9
    to Joseph Tsai, Gopher Robot, goph...@pubsubhelper.golang.org, Damien Neil, Go LUCI, golang-co...@googlegroups.com
    Funda Secgin added 2 comments
    File src/encoding/json/jsontext/decode.go
    Line 779, Patchset 1 (Parent):func (d *decoderState) CheckNextValue() error {
    Funda Secgin . resolved
    Marked as resolved.
    ```suggestion

    // If last, it verifies that the stream cleanly terminates with [io.EOF].
    ```
    File src/encoding/json/v2/arshal.go
    Line 412, Patchset 1 (Parent):	err = unmarshalFull(dec, out, &xd.Struct)
    Funda Secgin . resolved
    Marked as resolved.
    ```suggestion

    	err = unmarshalDecode(dec, out, &xd.Struct, true)
    Related details
    Attention set is empty
    Submit Requirements:
    • requirement satisfiedCode-Review
    • requirement satisfiedNo-Unresolved-Comments
    • requirement satisfiedReview-Enforcement
    • requirement satisfiedTryBots-Pass
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    


     Gerrit-MessageType: comment 
    

     Gerrit-Project: go 
    

     Gerrit-Branch: master 
    

     Gerrit-Change-Id: I055a606b053fa66b0c766ae205487b8290109285 
    

     Gerrit-Change-Number: 689919 
    

     Gerrit-PatchSet: 3 
    

     Gerrit-Owner: Joseph Tsai <joe...@digital-static.net> 
    

     Gerrit-Reviewer: Damien Neil <dn...@google.com> 
    


     Gerrit-Reviewer: Gopher Robot <go...@golang.org> 
    

     Gerrit-Reviewer: Joseph Tsai <joe...@digital-static.net> 
    

     Gerrit-Reviewer: Michael Knyszek <mkny...@google.com> 
    

     Gerrit-CC: Funda Secgin <fundas...@gmail.com> 
    

     Gerrit-Comment-Date: Sat, 09 Aug 2025 22:55:45 +0000 
    

     Gerrit-HasComments: Yes 
    

     Gerrit-Has-Labels: No 
    


    satisfied_requirement
    open
    diffy
    Reply all
    Reply to author
    Forward
    0 new messages