Proof Portal

Sign in
Projects

jsonparser

ProbeLabs23 findings · 123 requirements

Compare findings

The compared side's slice of new, resolved and changed findings versus its base — read live from git.

Base
96a2d33f41d06ec51ad2b67458a70df9bf98d13896a2d33common ancestor of proof-demo
Partial13 warningsuncommitted changes
116/116 realizable123/123 meet policyverification complete: 123
Compared
96a2d33f41d06ec51ad2b67458a70df9bf98d13896a2d33
Partial13 warningsuncommitted changes
116/116 realizable123/123 meet policyverification complete: 123
+0 new·−0 resolved·0 changed·23 unchanged
New (0)
Findings introduced by the compared side — its own slice of issues.

No new findings on the compared side.

Resolved (0)
Findings present at the base but gone on the compared side.

No findings resolved on the compared side.

Changed (0)
Same finding on both sides, with severity and/or status moved (old → new).

No findings changed severity or status.

▸Still open / unchanged (23)
Delete left dangling trailing comma on array/object element followed by whitespace+commaProblem reportSet with array-index path component under an object parent produces malformed JSON output (silent corruption)Problem reportEmpty-string key path component panics (hazard-sweep finding)Problem reportUnescape lone-Unicode-surrogate mishandling synthesizes bogus non-BMP charsProblem reportSet beyond-length array index on scalar array destroys all elements (SYS-REQ-110 violation)Problem reportParseBoolean uses prefix match instead of exact equality — "trueish"/"falsehood" accepted as booleansKnown issueSet with array-index path component under an object parent produces malformed JSON outputKnown issuedecodeSingleUnicodeEscape length guard too small — OOB read + panic on a truncated \uXX escapeKnown issueunescapeToUTF8Config length guard off-by-one — OOB panic reading in[1] on a lone trailing backslashKnown issueparseInt fast-path threshold off-by-one — 19-digit integers skip overflow check and wrap silentlyKnown issuedecodeUnicodeEscape lone-high-surrogate guard reads in[6]/in[7] with a too-small length check — OOB panicKnown issueArrayEach on non-array root emitted spurious callback before erroringProblem reportSet on top-level array-index beyond length returns KeyPathNotFoundError (SYS-REQ-110 contract gap)Problem reportarrayEachConfig empty-array sentinel checks for '}' instead of ']' — a valid `[]` is rejected as malformedKnown issuedecodeUnicodeEscape lone low surrogate `\uDC00` is substituted with U+FFFD instead of a bogus code pointKnown issueSet on top-level array-index beyond length returns KeyPathNotFoundError instead of appendingKnown issueh2I upper-hex bound off-by-one — byte 'G' decodes as hex 16, so `\uGxxx` is silently acceptedKnown issueParseInt("-") returns (0, nil) — silent false-success on sign-only inputProblem reportnextTokenConfig drops the tab from its whitespace set — parsing fails on tab-formatted JSONKnown issueunescapeToUTF8Config drops '/' from the accepted escapes — the valid JSON escape `\/` is rejected as malformedKnown issueDelete with no key path returns an empty, non-aliasing slice (root-delete contract)Known issueParseInt("-") returns (0, nil) — silent false-success on sign-only inputKnown issuearrayEachConfig empty-input guard returns the wrong documented error type (MalformedJsonError vs MalformedObjectError)Known issue

Comparing findings for jsonparser. Requirement coverage is intentionally not shown here — see Requirements for coverage.