json 2.17.0 → 2.17.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a35454680e80a622fb539155325b2f693e90b352aad3f24b7f9eafc5ca797963
-  data.tar.gz: 9eee4f7ce5348a1eb44100766d5a7b326a4e76691fbfd3db8a2410020fb75ec1
+  metadata.gz: 6a9a3645975d3e5df1aee69354bb7cefe81940009e677758de0f52617e82e871
+  data.tar.gz: 4dfdd1d03081d3a714798c7f9ac89d58285b9d6f7aa82edd430d6118120faad2
 SHA512:
-  metadata.gz: 0771fad39331fe9d47dbd855a02f662053a79ff08679c8bc76855dcfd3edbcdb32746cc0db435e6ea14815eacdbe97bf1152b704eacb7ddf1423917eb2545923
-  data.tar.gz: 742dc87f4cc0306e613cfb65824aaee600aa53f0715135190ffaa4ca1f25aa6820a10b1860befcf90f3dcf6676bd5bb304f0e2858ec1e5933f66b089fca82e78
+  metadata.gz: 85cce8ba1edd888d298eebf4279c3381dbbe103b48f59a998db05026028b388317c39fc3c306d32f3e0ada010f0cdff42c978c1173b0af90c93e42d16e78246f
+  data.tar.gz: 8dd8ecf39713290c9fbaf0d1d574636e7c8392252edd7accd4fb2d0bf679f7eeb89efdd099e3d20a57df91ff96bf7bf0b30338d71a22f7cf666799713a3dd3e3

data/CHANGES.md

@@ -2,6 +2,14 @@
 
 ### Unreleased
 
+### 2026-03-18 (2.17.1.2)
+
+* Fix a format string injection vulnerability in JSON.parse(doc, allow_duplicate_key: false).
+
+### 2025-12-04 (2.17.1)
+
+* Fix a regression in parsing of unicode surogate pairs (`\uXX\uXX`) that could cause an invalid string to be returned.
+
 ### 2025-12-03 (2.17.0)
 
 * Improve `JSON.load` and `JSON.unsafe_load` to allow passing options as second argument.

data/ext/json/ext/parser/parser.c

@@ -399,14 +399,9 @@ static void emit_parse_warning(const char *message, JSON_ParserState *state)
 
 #define PARSE_ERROR_FRAGMENT_LEN 32
 
-#ifdef RBIMPL_ATTR_NORETURN
-RBIMPL_ATTR_NORETURN()
-#endif
-static void raise_parse_error(const char *format, JSON_ParserState *state)
+static VALUE build_parse_error_message(const char *format, JSON_ParserState *state, long line, long column)
 {
     unsigned char buffer[PARSE_ERROR_FRAGMENT_LEN + 3];
-    long line, column;
-    cursor_position(state, &line, &column);
 
     const char *ptr = "EOF";
     if (state->cursor && state->cursor < state->end) {
@@ -441,11 +436,23 @@ static void raise_parse_error(const char *format, JSON_ParserState *state)
     VALUE msg = rb_sprintf(format, ptr);
     VALUE message = rb_enc_sprintf(enc_utf8, "%s at line %ld column %ld", RSTRING_PTR(msg), line, column);
     RB_GC_GUARD(msg);
+    return message;
+}
 
+static VALUE parse_error_new(VALUE message, long line, long column)
+{
     VALUE exc = rb_exc_new_str(rb_path2class("JSON::ParserError"), message);
     rb_ivar_set(exc, rb_intern("@line"), LONG2NUM(line));
     rb_ivar_set(exc, rb_intern("@column"), LONG2NUM(column));
-    rb_exc_raise(exc);
+    return exc;
+}
+
+NORETURN(static) void raise_parse_error(const char *format, JSON_ParserState *state)
+{
+    long line, column;
+    cursor_position(state, &line, &column);
+    VALUE message = build_parse_error_message(format, state, line, column);
+    rb_exc_raise(parse_error_new(message, line, column));
 }
 
 #ifdef RBIMPL_ATTR_NORETURN
@@ -651,7 +658,9 @@ static inline const char *json_next_backslash(const char *pe, const char *string
         positions->size--;
         const char *next_position = positions->positions[0];
         positions->positions++;
-        return next_position;
+        if (next_position >= pe) {
+            return next_position;
+        }
     }
 
     if (positions->has_more) {
@@ -887,6 +896,11 @@ static void raise_duplicate_key_error(JSON_ParserState *state, VALUE duplicate_k
         rb_inspect(duplicate_key)
     );
 
+    long line, column;
+    cursor_position(state, &line, &column);
+    rb_str_concat(message, build_parse_error_message("", state, line, column)) ;
+    rb_exc_raise(parse_error_new(message, line, column));
+
     raise_parse_error(RSTRING_PTR(message), state);
     RB_GC_GUARD(message);
 }

data/lib/json/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSON
-  VERSION = '2.17.0'
+  VERSION = '2.17.1.2'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: json
 version: !ruby/object:Gem::Version
-  version: 2.17.0
+  version: 2.17.1.2
 platform: ruby
 authors:
 - Florian Frank
@@ -84,7 +84,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.3
 specification_version: 4
 summary: JSON Implementation for Ruby
 test_files: []