Proof Portal

Sign in
Projects

jsonparser

ProbeLabs36 findings · 123 requirements
Back to findings
Known issueKI-9

h2I upper-hex bound off-by-one — byte 'G' decodes as hex 16, so `\uGxxx` is silently accepted

OpenOpenMedium

Medium-severity issue, currently open.

Introduced

When and where this issue first entered the codebase — the commit it traces back to.

Inception (latent from the first version)

Affected requirements

The requirement(s) this issue violates — click through to the spec.

SYS-REQ-014SYS-REQ-060

What this means for you

Plain-language impact — what this issue could mean for your users and your system, before any of the technical detail.

Malformed Unicode escapes that should be rejected are silently decoded to an incorrect character, so downstream data derived from such strings is wrong while the parse reports success. Intentional demo defect on the proof-demo showcase branch; never shipped.

Reachability

Reachable via any Unescape/ParseString/Get* call decoding a `\uXXXX` escape whose first digit is the byte just above ASCII "F"; other malformed hex bytes are still rejected.

Technical description

h2I (escape.go) converts one hex digit to its 0..15 value and returns badHex for any non-hex byte. On the proof-demo showcase branch the uppercase-hex range check was widened from `if c >= 65 && c <= 70` to `c <= 71` (escape.go:71), so byte 71 — ASCII "G" — maps to value 16 instead of returning badHex. A `\uG000` escape is then silently accepted and decoded to a bogus code point rather than being rejected. This is a CWE-20 Improper Input Validation (an off-by-one on the accepted-character bound). Intentional demo defect on the proof-demo showcase branch; never shipped.

Severity, explained

Why this is rated the way it is — and the scoring signals behind the rating (each ⓘ explains the term).

MediumRated severity — the impact if this issue is exploited or hit.
why this rating
Risk-rated
risk area
Correctness
Security classification
Security-relevant
CVSS
CVSS 5.3· Mediumv3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE surface
Unlikely

Where it is

The code the issue lives in — peek the affected function inline to see it in context.

  • h2I

How it's proven

The reproducer — an actual test that drives the real code and shows the issue happening. Run it yourself, or peek the test and the source it covers.

Known issue reproducedprovesSYS-REQ-014
Run it yourself
go test -run TestDemoKI9 -count=1 .
Covers (3)
Last run Aug 3, 2026, 11:00 AM

Reproduction steps

Technical steps for your engineers to confirm the issue by hand.

  1. Check out the proof-demo showcase branch and build the package.
  2. Call jsonparser.GetString on a value containing `\uG000` — or run: go test -run TestDemoKI9 -count=1 .
  3. Observe a decoded (bogus) code point and nil error instead of MalformedStringEscapeError.
go test -run TestDemoKI9 -count=1 .
go test ./... -count=1

How it can be triggered

The input or condition that sets this issue off.

a Unicode escape with an out-of-range hex digit, e.g. {"k":"\uG000"}

What protects you, and the fix

What limits your exposure today, and the planned remediation.

What protects you now

Validate string content against a strict JSON schema/whitelist after parsing until the hex bound is restored; do not treat successfully-parsed escapes as proof of well-formed input.

The fix

Restore the "A".."F" (65..70) upper bound in h2I (escape.go:71, `c <= 71` -> `c <= 70`) so any byte above "F" returns badHex and the enclosing escape is rejected as malformed. Closes CWE-20 Improper Input Validation; cf. RFC 8259 section 7.

Blast radius

If you touch this issue, what else may need re-checking — the requirements it affects and the code and tests that hang off them.

Open in graph
Tracing blast radius…

Touch this finding and you re-check 2 requirements · 3 code files · 8 tests.

Requirements (2)
SYS-REQ-014SYS-REQ-060
Code files (3)
  • escape.go
  • fuzz.go
  • parser.go
Tests (8)
  • dead_code_audit_test.go
  • escape_test.go
  • fuzz_native_test.go
  • mcdc_spec_witnesses_test.go
  • mcdc_supplement_test.go
  • obligation_evidence_test.go
  • parser_test.go
  • deep_spec_test.go

Per-requirement evidence

For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.

SYS-REQ-014
Implementing code (3)
  • escape.go
    Escape
  • fuzz.go
    FuzzParseString
  • parser.go
    ParseString
Tests & evidence (8)
  • README.md
  • dead_code_audit_test.go
  • escape_test.go
  • fuzz_native_test.go
  • mcdc_spec_witnesses_test.go
  • mcdc_supplement_test.go
  • obligation_evidence_test.go
  • parser_test.go
Proof obligations (1)
encoding_safety

Behavior specified for encoding and decoding round-trips.

  • ✓nominal (required) — obligation_evidence_test.go:198
SYS-REQ-060
Implementing code (1)
  • parser.go
    ParseString
Tests & evidence (4)
  • README.md
  • deep_spec_test.go
  • mcdc_spec_witnesses_test.go
  • obligation_evidence_test.go
Proof obligations (1)
truncated_escape_sequence
  • ✓nominal (required) — obligation_evidence_test.go:472

Evidence trail

The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.

  • proof/evidence/KI-9-reproducer.yaml

Discussions

Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.

Sign in to discuss this with the proof team.Sign in