Repository navigation
null, true, and false parsing accepts bad input #357
Description
Various places in this library that parse null will see 'n' and then skip the next three characters without validating that the next three characters are 'u' 'l' 'l'. So this is parsed as null: nope.
See for example https://github.com/json-iterator/java/blob/master/src/main/java/com/jsoniter/IterImplObject.java#L10-L12
public static final String readObject(JsonIterator iter) throws IOException {
byte c = IterImpl.nextToken(iter);
switch (c) {
case 'n':
IterImpl.skipFixedBytes(iter, 3);
return null;
Edit: also note that this same issue is present for true and false.
Activity
tdila commentedon Aug 12, 2024
Hello, I'm new to open-source contribution and I would like to help. Are you working on this? if not, can you please assign this to me?
mtdowling commentedon Aug 13, 2024
I’m not working on this, please feel free.
tdila commentedon Aug 13, 2024
@mtdowling thanks 👍
bodasiddartha commentedon Aug 26, 2024
@mtdowling I'm new to open source and I would love to give it a try(even if it does not help).
ChristoJobyAntony commentedon Oct 11, 2024
Hey, we are a team of 5 university students working on contributing to OSS projects. We would love to work on this issue if it is still unassigned. Thank you for your time.
MurilloTox commentedon Dec 18, 2025
@mtdowling I have resolved this issue, can you give the permission to cratemy branch and make a push?
mtdowling commentedon Dec 18, 2025
I am not a maintainer of this repo, so I can't give any permissions to this repo.
[-]Null parsing accepts bad input[/-][+]null, true, and false parsing accepts bad input[/+]abhisheks-gh commentedon Dec 31, 2025
Hi @mtdowling , thanks for the above given details. Could you please assign this issue to me. Would be happy to implement the fix.
Thanks.
Add fix for issue json-iterator#357 - strick parsing of null, true an…
abhisheks-gh commentedon Jan 27, 2026
Hi @mtdowling , I have opened a MR for this issue - PR #367 .
Could you please check and approve that? Thanks.