Proof Portal
jsonparser
ProbeLabs36 findings · 123 requirementsParseBoolean uses prefix match instead of exact equality — "trueish"/"falsehood" accepted as booleans
High-severity issue, currently open.
Introduced
When and where this issue first entered the codebase — the commit it traces back to.
Affected requirements
The requirement(s) this issue violates — click through to the spec.
What this means for you
Plain-language impact — what this issue could mean for your users and your system, before any of the technical detail.
Malformed boolean tokens with trailing bytes are silently accepted as true/false, so authorization flags, feature toggles, or state derived from GetBoolean can be driven to the wrong value by crafted input. Intentional demo defect on the proof-demo showcase branch; never shipped.
Reachable via ParseBoolean/GetBoolean on attacker-controlled JSON; any token beginning with "true"/"false" is accepted, so trailing-garbage payloads decode as valid booleans.
Technical description
ParseBoolean (parser.go) decides a boolean by comparing the token bytes to the "true"/"false" literals. On the proof-demo showcase branch both comparisons were changed from `bytes.Equal(b, trueLiteral)` / `bytes.Equal(b, falseLiteral)` to `bytes.HasPrefix(...)` (parser.go:2137-2139), so any value that merely begins with "true" or "false" — "trueish", "falsehood" — now parses successfully as the corresponding boolean instead of erroring. This is a CWE-20 Improper Input Validation (prefix match where exact equality is required), admitting malformed tokens as valid data. Intentional demo defect on the proof-demo showcase branch; never shipped.
Severity, explained
Why this is rated the way it is — and the scoring signals behind the rating (each ⓘ explains the term).
- why this rating
- Risk-rated
- risk area
- Data Integrity
- CVSS
- CVSS 7.5· Highv3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVE surface
- Unlikely
Where it is
The code the issue lives in — peek the affected function inline to see it in context.
- ParseBoolean
How it's proven
The reproducer — an actual test that drives the real code and shows the issue happening. Run it yourself, or peek the test and the source it covers.
go test -run TestDemoKI11 -count=1 .
Reproduction steps
Technical steps for your engineers to confirm the issue by hand.
- Check out the proof-demo showcase branch and build the package.
- Call jsonparser.GetBoolean on a value of "trueish" — or run: go test -run TestDemoKI11 -count=1 .
- Observe the value decode as true with a nil error instead of MalformedValueError.
go test -run TestDemoKI11 -count=1 . go test ./... -count=1
How it can be triggered
The input or condition that sets this issue off.
a Boolean token with trailing bytes after the literal, e.g. "trueish" or "falsehood"
What protects you, and the fix
What limits your exposure today, and the planned remediation.
What protects you now
Re-validate boolean fields against exact "true"/"false" tokens in caller code, or use a strict schema validator, until the exact comparison is restored.
The fix
Restore exact-equality comparison in ParseBoolean (parser.go:2137 and 2139, `bytes.HasPrefix` -> `bytes.Equal`) so only the literal "true"/"false" tokens parse and any trailing garbage returns MalformedValueError. Closes CWE-20 Improper Input Validation.
Blast radius
If you touch this issue, what else may need re-checking — the requirements it affects and the code and tests that hang off them.
Touch this finding and you re-check 3 requirements · 2 code files · 7 tests.
- fuzz.go
- parser.go
- fuzz_native_test.go
- mcdc_spec_witnesses_test.go
- mcdc_supplement_test.go
- obligation_evidence_test.go
- parser_test.go
- reference_oracle_test.go
- deep_spec_test.go
Per-requirement evidence
For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.
Per-requirement evidence
For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.
Evidence trail
The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.
Evidence trail
The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.
- proof/evidence/KI-11-reproducer.yaml
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.