Proof Portal

Sign in
Projects

jsonparser

ProbeLabs36 findings · 123 requirements
Back to findings
Known issueKI-14

unescapeToUTF8Config drops '/' from the accepted escapes — the valid JSON escape `\/` is rejected as malformed

OpenOpenLow

Low-severity issue, currently open.

Introduced

When and where this issue first entered the codebase — the commit it traces back to.

Inception (latent from the first version)

Affected requirements

The requirement(s) this issue violates — click through to the spec.

SYS-REQ-014SYS-REQ-038

What this means for you

Plain-language impact — what this issue could mean for your users and your system, before any of the technical detail.

Strings containing the valid `\/` escape (common when JSON is embedded in HTML/JS or produced by escaping-heavy encoders) fail to decode, breaking otherwise-valid documents. Intentional demo defect on the proof-demo showcase branch; never shipped.

Reachability

Reachable via any Unescape/ParseString/Get* call on a string value containing `\/`; other escapes still decode, only the forward-slash escape is affected.

Technical description

unescapeToUTF8Config (escape.go) decodes the basic two-character escapes via a switch. On the proof-demo showcase branch the switch case lost its `/` entry (escape.go:203), so `\/` falls through to the error return even though RFC 8259 explicitly permits the escaped solidus and backslashCharEscapeTable already maps it. The result is a CWE-20 Improper Input Validation: a spec-valid escape is rejected as MalformedStringEscapeError. Intentional demo defect on the proof-demo showcase branch; never shipped.

Severity, explained

Why this is rated the way it is — and the scoring signals behind the rating (each ⓘ explains the term).

LowRated severity — the impact if this issue is exploited or hit.
why this rating
Risk-rated
risk area
Correctness
Security classification
Security-relevant
CVSS
CVSS 3.7· Lowv3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE surface
None

Where it is

The code the issue lives in — peek the affected function inline to see it in context.

  • unescapeToUTF8Config

How it's proven

The reproducer — an actual test that drives the real code and shows the issue happening. Run it yourself, or peek the test and the source it covers.

Known issue reproducedprovesSYS-REQ-014
Run it yourself
go test -run TestDemoKI14 -count=1 .
Covers (3)
Last run Aug 3, 2026, 11:00 AM

Reproduction steps

Technical steps for your engineers to confirm the issue by hand.

  1. Check out the proof-demo showcase branch and build the package.
  2. Call jsonparser.GetString on a value containing `a\/b` — or run: go test -run TestDemoKI14 -count=1 .
  3. Observe MalformedStringEscapeError instead of the decoded value `a/b`.
go test -run TestDemoKI14 -count=1 .
go test ./... -count=1

How it can be triggered

The input or condition that sets this issue off.

any JSON string containing an escaped forward slash, e.g. {"k":"a\/b"}

What protects you, and the fix

What limits your exposure today, and the planned remediation.

What protects you now

Pre-process untrusted JSON to replace `\/` with `/` (both are valid), or ensure producers do not escape forward slashes, until the escape case is restored.

The fix

Re-add `'/'` to the basic-escape case in unescapeToUTF8Config (escape.go:203) so `\/` decodes to `/`. RFC 8259 section 7 permits the escaped solidus; closes CWE-20 Improper Input Validation.

Blast radius

If you touch this issue, what else may need re-checking — the requirements it affects and the code and tests that hang off them.

Open in graph
Tracing blast radius…

Touch this finding and you re-check 2 requirements · 3 code files · 7 tests.

Requirements (2)
SYS-REQ-014SYS-REQ-038
Code files (3)
  • escape.go
  • fuzz.go
  • parser.go
Tests (7)
  • dead_code_audit_test.go
  • escape_test.go
  • fuzz_native_test.go
  • mcdc_spec_witnesses_test.go
  • mcdc_supplement_test.go
  • obligation_evidence_test.go
  • parser_test.go

Per-requirement evidence

For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.

SYS-REQ-014
Implementing code (3)
  • escape.go
    Escape
  • fuzz.go
    FuzzParseString
  • parser.go
    ParseString
Tests & evidence (8)
  • README.md
  • dead_code_audit_test.go
  • escape_test.go
  • fuzz_native_test.go
  • mcdc_spec_witnesses_test.go
  • mcdc_supplement_test.go
  • obligation_evidence_test.go
  • parser_test.go
Proof obligations (1)
encoding_safety

Behavior specified for encoding and decoding round-trips.

  • ✓nominal (required) — obligation_evidence_test.go:198
SYS-REQ-038
Implementing code (1)
  • parser.go
    ParseString
Tests & evidence (3)
  • README.md
  • mcdc_spec_witnesses_test.go
  • parser_test.go

Evidence trail

The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.

  • proof/evidence/KI-14-reproducer.yaml

Discussions

Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.

Sign in to discuss this with the proof team.Sign in