Proof Portal

jsonparser

ProbeLabs36 findings · 123 requirements

Issue Catalogue

Known issues are the live problems to act on — the default view. Browse fixed defects, accepted risks, trace gaps and failing checks by kind, or switch to All for every finding.

Open known issues by severity

10 open

All36

Known Issues15

Problem Reports8

Accepted Risks0

Checks13

Known Issues: Confirmed, current problems in the system — the open failure modes to act on.

10 open known issues · 5 fixed/withdrawn hidden — toggle All to include.

	Kind	Finding	Status		Context
HighCVSS 7.5	Known issue	decodeSingleUnicodeEscape length guard too small — OOB read + panic on a truncated \uXX escape KI-5	Open	Inception	SYS-REQ-060SYS-REQ-014+1	Investigate
HighCVSS 7.5	Known issue	decodeUnicodeEscape lone-high-surrogate guard reads in[6]/in[7] with a too-small length check — OOB panic KI-8	Open	Inception	SYS-REQ-062SYS-REQ-061	Investigate
HighCVSS 7.5	Known issue	ParseBoolean uses prefix match instead of exact equality — "trueish"/"falsehood" accepted as booleans KI-11	Open	Inception	SYS-REQ-012SYS-REQ-036+1	Investigate
HighCVSS 7.5	Known issue	parseInt fast-path threshold off-by-one — 19-digit integers skip overflow check and wrap silently KI-7	Open	Inception	SYS-REQ-039SYS-REQ-076+2	Investigate
HighCVSS 7.5	Known issue	unescapeToUTF8Config length guard off-by-one — OOB panic reading in[1] on a lone trailing backslash KI-6	Open	Inception	SYS-REQ-063SYS-REQ-038	Investigate
MediumCVSS 5.3	Known issue	arrayEachConfig empty-array sentinel checks for '}' instead of ']' — a valid `[]` is rejected as malformed KI-10	Open	Inception	SYS-REQ-028	Investigate
MediumCVSS 5.3	Known issue	h2I upper-hex bound off-by-one — byte 'G' decodes as hex 16, so `\uGxxx` is silently accepted KI-9	Open	Inception	SYS-REQ-014SYS-REQ-060	Investigate
LowCVSS 3.7	Known issue	nextTokenConfig drops the tab from its whitespace set — parsing fails on tab-formatted JSON KI-13	Open	Inception	SYS-REQ-001SYS-REQ-026	Investigate
LowCVSS 3.7	Known issue	unescapeToUTF8Config drops '/' from the accepted escapes — the valid JSON escape `\/` is rejected as malformed KI-14	Open	Inception	SYS-REQ-014SYS-REQ-038	Investigate
Info	Known issue	arrayEachConfig empty-input guard returns the wrong documented error type (MalformedJsonError vs MalformedObjectError) KI-12	Open	Inception	SYS-REQ-029	Investigate