Proof Portal

Sign in
Projects

jsonparser

ProbeLabs36 findings · 123 requirements
Back to findings
Known issueKI-10

arrayEachConfig empty-array sentinel checks for '}' instead of ']' — a valid `[]` is rejected as malformed

OpenOpenMedium

Medium-severity issue, currently open.

Introduced

When and where this issue first entered the codebase — the commit it traces back to.

Inception (latent from the first version)

Affected requirements

The requirement(s) this issue violates — click through to the spec.

SYS-REQ-028

What this means for you

Plain-language impact — what this issue could mean for your users and your system, before any of the technical detail.

Callers iterating arrays with ArrayEach get a spurious MalformedArrayError on the perfectly valid empty array `[]`, breaking otherwise-correct code paths that handle empty collections. Intentional demo defect on the proof-demo showcase branch; never shipped.

Reachability

Reachable via ArrayEach/ArrayEachErr on any empty array value; every empty-array input is affected, so it surfaces immediately on valid data rather than needing a crafted payload.

Technical description

arrayEachConfig (parser.go) fast-paths an empty array by checking whether the first significant byte is the closing bracket. On the proof-demo showcase branch the sentinel was mutated from `if data[offset] == ']'` to `if data[offset] == '}'` (parser.go:1763), so a valid empty array `[]` no longer matches the empty-array sentinel; the loop then runs against the closing bracket and returns MalformedArrayError. This is a CWE-20 Improper Input Validation: well-formed input is rejected because the sentinel compares against the wrong delimiter. Intentional demo defect on the proof-demo showcase branch; never shipped.

Severity, explained

Why this is rated the way it is — and the scoring signals behind the rating (each ⓘ explains the term).

MediumRated severity — the impact if this issue is exploited or hit.
why this rating
Risk-rated
risk area
Correctness
Security classification
Security-relevant
CVSS
CVSS 5.3· Mediumv3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE surface
None

Where it is

The code the issue lives in — peek the affected function inline to see it in context.

  • arrayEachConfig

How it's proven

The reproducer — an actual test that drives the real code and shows the issue happening. Run it yourself, or peek the test and the source it covers.

Known issue reproducedprovesSYS-REQ-028
Run it yourself
go test -run TestDemoKI10 -count=1 .
Covers (3)
Last run Aug 3, 2026, 11:00 AM

Reproduction steps

Technical steps for your engineers to confirm the issue by hand.

  1. Check out the proof-demo showcase branch and build the package.
  2. Call jsonparser.ArrayEach on the document `[]` — or run: go test -run TestDemoKI10 -count=1 .
  3. Observe MalformedArrayError instead of a clean zero-iteration success.
go test -run TestDemoKI10 -count=1 .
go test ./... -count=1

How it can be triggered

The input or condition that sets this issue off.

a well-formed empty JSON array, []

What protects you, and the fix

What limits your exposure today, and the planned remediation.

What protects you now

Special-case/short-circuit empty arrays in caller code, or treat MalformedArrayError on known array fields as "empty", until the sentinel is corrected.

The fix

Restore the `']'` closing-bracket comparison in the empty-array fast path of arrayEachConfig (parser.go:1763, `data[offset] == '}'` -> `data[offset] == ']'`) so `[]` iterates zero times with a nil error. Closes CWE-20 Improper Input Validation.

Blast radius

If you touch this issue, what else may need re-checking — the requirements it affects and the code and tests that hang off them.

Open in graph
Tracing blast radius…

Touch this finding and you re-check 1 requirements · 2 code files · 3 tests.

Requirements (1)
SYS-REQ-028
Code files (2)
  • aliases.go
  • parser.go
Tests (3)
  • mcdc_spec_witnesses_test.go
  • obligation_evidence_test.go
  • parser_test.go

Per-requirement evidence

For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.

SYS-REQ-028
Implementing code (2)
  • aliases.go
    EachArray
  • parser.go
    ArrayEach
Tests & evidence (4)
  • README.md
  • mcdc_spec_witnesses_test.go
  • obligation_evidence_test.go
  • parser_test.go
Proof obligations (2)
empty_input

Behavior when inputs are absent, nil, zero-length, or blank.

  • ✓nominal (required) — obligation_evidence_test.go:286
nil_safety

Behavior specified when inputs are nil, null, or zero-value.

  • ✓negative (required) — obligation_evidence_test.go:288
  • ✓nominal (required) — obligation_evidence_test.go:287

Evidence trail

The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.

  • proof/evidence/KI-10-reproducer.yaml

Discussions

Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.

Sign in to discuss this with the proof team.Sign in