From aaafc788c89f35be65308188fdfa5725fcef3716 Mon Sep 17 00:00:00 2001 From: Jean Boussier Date: Mon, 12 Oct 2026 15:50:51 +0200 Subject: [PATCH] Fix parsing of unescaped NULL bytes in strings --- ext/json/ext/parser/parser.c | 4 ++-- test/json/json_parser_test.rb | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/ext/json/ext/parser/parser.c b/ext/json/ext/parser/parser.c index 52b6e2250..288521e1c 100644 --- a/ext/json/ext/parser/parser.c +++ b/ext/json/ext/parser/parser.c @@ -1046,13 +1046,13 @@ NOINLINE(static) VALUE json_string_unescape(JSON_ParserState *state, JSON_Parser p = ++pe; break; } - case 0: - return Qundef; default: if ((unsigned char)*pe < 0x20) { if (!config->allow_control_characters) { if (*pe == '\n') { raise_syntax_error_at("Invalid unescaped newline character (\\n) in string: %s", state, pe - 1); + } else if (*pe == '\0') { + raise_syntax_error_at("Invalid unescaped NULL character (\\0) in string: %s", state, pe - 1); } raise_syntax_error_at("invalid ASCII control character in string: %s", state, pe - 1); } diff --git a/test/json/json_parser_test.rb b/test/json/json_parser_test.rb index 0b9d5fc96..75e99904d 100644 --- a/test/json/json_parser_test.rb +++ b/test/json/json_parser_test.rb @@ -239,6 +239,8 @@ def test_parse_control_char_and_backslash end JSON.parse(%("#{'a' * 30}#{backslash_and_control_char}"), allow_control_characters: true, allow_invalid_escape: true) + + assert_equal ["a\u0000b", 2], JSON.parse("[\"a\\\x00b\", 2]", allow_control_characters: true, allow_invalid_escape: true) end def test_parse_invalid_escape