Proof Portal
jsonparser
ProbeLabs23 findings · 123 requirementsUnescape lone-Unicode-surrogate mishandling synthesizes bogus non-BMP chars
This defect has been fixed and verified.
Severity, explained
Why this is rated the way it is — and the scoring signals behind the rating (each ⓘ explains the term).
- risk area
- Data Integrity
Root cause
What actually went wrong underneath — how it is classified, and the coverage gap that let it slip through.
escape.go:decodeUnicodeEscape (root cause at escape.go:126 in the pre-fix source) called decodeSingleUnicodeEscape(in[6:]) to read the low surrogate WITHOUT first verifying in[6:8] == "\u". Because decodeSingleUnicodeEscape assumes the "\u" prefix and reads hex at fixed offsets [2:6], any literal bytes following a lone high surrogate were misread as a low surrogate and a bogus non-BMP code point was synthesized. Additionally the lone-low-surrogate and high-then-non-low-surrogate cases returned a hard error instead of the U+FFFD substitution that encoding/json (and RFC 8259/WHATWG interoperability) use.
Disposition: Covered by a requirement
Proof it's fixed
The tests, tightened requirements and new obligations that prove this defect is gone — and can't quietly return.
Blast radius
If you touch this issue, what else may need re-checking — the requirements it affects and the code and tests that hang off them. Historical view: authored trace links only — automatically derived links aren't reconstructible for past runs.
Nothing to trace into
This finding links no requirements, so there is no dependency graph to follow. Everything we know about it is in the evidence above.
Change history
Every recorded revision of this finding's source file — when it was added, edited, or re-classified, with the diff for each change.
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.