json 2.19.1 → 2.19.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 04f1d3824b8119f86068d5c61701115a38fd9b0b37e59fb868baca59cb49fe6c
-  data.tar.gz: f9267f5bf2c12bd5762878b31873052b85022354da9dc347d06f05fa0dd2f5e6
+  metadata.gz: 747237eb2b9348d361e6e93684f81381b4f0dcf0cd36971bc809ac042ce295bc
+  data.tar.gz: 1c6243010258fd2077acf63c5b372babce9a32e789630279bc8b129fc2deef5d
 SHA512:
-  metadata.gz: 03777fe540a81fa223ca8990d4f9128d97ad57e795fda888ad8a8914208ed5950b1c49d90488a58827d252245d624953750142578b13eacfb82843fd17fb409e
-  data.tar.gz: 747625c3e441fe66d20710b4029b0b650e54e60313700d3c849b306c1ce2fac7a94dc9471962ccccea0a64031499adae59270149b4f70ed64795f269939fb6c5
+  metadata.gz: b43b4ca3d570a3c4051a319f9eb2d2807a6b2567f43cedf8bc21d8208289a3f3a275dc650353cd6ef4bd3e2022afcf73f17164fda51081134e11ac5172374459
+  data.tar.gz: 82a96b04fa36bb5b0ab72868d67e95cfcc8cc8d3f0a045a1caf8045b090e5cf46647b664accf7c657073020847cd8ce6ad28535d14536e214dcaab21b6aa4c17

data/CHANGES.md

@@ -2,6 +2,10 @@
 
 ### Unreleased
 
+### 2026-03-08 (2.19.2)
+
+* Fix a format string injection vulnerability in `JSON.parse(doc, allow_duplicate_key: false)`.
+
 ### 2026-03-08 (2.19.1)
 
 * Fix a compiler dependent GC bug introduced in `2.18.0`.

data/ext/json/ext/parser/parser.c

@@ -402,11 +402,9 @@ static void emit_parse_warning(const char *message, JSON_ParserState *state)
 
 #define PARSE_ERROR_FRAGMENT_LEN 32
 
-NORETURN(static) void raise_parse_error(const char *format, JSON_ParserState *state)
+static VALUE build_parse_error_message(const char *format, JSON_ParserState *state, long line, long column)
 {
     unsigned char buffer[PARSE_ERROR_FRAGMENT_LEN + 3];
-    long line, column;
-    cursor_position(state, &line, &column);
 
     const char *ptr = "EOF";
     if (state->cursor && state->cursor < state->end) {
@@ -441,11 +439,23 @@ NORETURN(static) void raise_parse_error(const char *format, JSON_ParserState *st
     VALUE msg = rb_sprintf(format, ptr);
     VALUE message = rb_enc_sprintf(enc_utf8, "%s at line %ld column %ld", RSTRING_PTR(msg), line, column);
     RB_GC_GUARD(msg);
+    return message;
+}
 
+static VALUE parse_error_new(VALUE message, long line, long column)
+{
     VALUE exc = rb_exc_new_str(rb_path2class("JSON::ParserError"), message);
     rb_ivar_set(exc, rb_intern("@line"), LONG2NUM(line));
     rb_ivar_set(exc, rb_intern("@column"), LONG2NUM(column));
-    rb_exc_raise(exc);
+    return exc;
+}
+
+NORETURN(static) void raise_parse_error(const char *format, JSON_ParserState *state)
+{
+    long line, column;
+    cursor_position(state, &line, &column);
+    VALUE message = build_parse_error_message(format, state, line, column);
+    rb_exc_raise(parse_error_new(message, line, column));
 }
 
 NORETURN(static) void raise_parse_error_at(const char *format, JSON_ParserState *state, const char *at)
@@ -895,6 +905,11 @@ NORETURN(static) void raise_duplicate_key_error(JSON_ParserState *state, VALUE d
         rb_inspect(duplicate_key)
     );
 
+    long line, column;
+    cursor_position(state, &line, &column);
+    rb_str_concat(message, build_parse_error_message("", state, line, column)) ;
+    rb_exc_raise(parse_error_new(message, line, column));
+
     raise_parse_error(RSTRING_PTR(message), state);
     RB_GC_GUARD(message);
 }

data/lib/json/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSON
-  VERSION = '2.19.1'
+  VERSION = '2.19.2'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: json
 version: !ruby/object:Gem::Version
-  version: 2.19.1
+  version: 2.19.2
 platform: ruby
 authors:
 - Florian Frank