Proof Portal
jsonparser
ProbeLabs24 findings · 123 requirementsh2I upper-hex bound off-by-one — byte 'G' decodes as hex 16, so `\uGxxx` is silently accepted
Medium-severity issue, currently open.
How well is this finding proven?
- 1.Reported / candidate
Complete
- 2.Reproducer written
Complete
View reproducer - 3.Reproduces (recorded run)
Complete
View evidence - 4.Independently re-run
Not yet established
- 5.Meets quality standard
Complete
- 6.Validated for submission
Not assessed
Recorded runs show whether the issue reproduces. Independent re-runs are shown separately. A later review does not fill in a missing earlier step.
What this means for you
Plain-language impact — what this issue could mean for your users and your system, before any of the technical detail.
Malformed Unicode escapes that should be rejected are silently decoded to an incorrect character, so downstream data derived from such strings is wrong while the parse reports success. Intentional demo defect on the proof-demo showcase branch; never shipped.
Reachable via any Unescape/ParseString/Get* call decoding a \uXXXX escape whose first digit is the byte just above ASCII "F"; other malformed hex bytes are still rejected.
Technical description
h2I (escape.go) converts one hex digit to its 0..15 value and returns badHex for any non-hex byte. On the proof-demo showcase branch the uppercase-hex range check was widened from if c >= 65 && c <= 70 to c <= 71 (escape.go:71), so byte 71 — ASCII "G" — maps to value 16 instead of returning badHex. A \uG000 escape is then silently accepted and decoded to a bogus code point rather than being rejected. This is a CWE-20 Improper Input Validation (an off-by-one on the accepted-character bound). Intentional demo defect on the proof-demo showcase branch; never shipped.
Affected requirements
The requirement(s) this issue violates — click through to the spec.
Severity, explained
Why this is rated the way it is — and the scoring signals behind the rating (each ⓘ explains the term).
- why this rating
- Reproducer-confirmed
- risk area
- Correctness
- CVSS
- CVSS 5.3· Mediumv3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVE surface
- Unlikely
Where it is
The code the issue lives in — peek the affected function inline to see it in context.
- h2I
Reproducer and evidence
The recorded reproducer and its evidence-run outcome. Inspect the test and source, or run the command to check the behavior yourself.
go test -run TestDemoKI9 -count=1 .
Reproduction steps
Technical steps for your engineers to confirm the issue by hand.
- Check out the proof-demo showcase branch and build the package.
- Call jsonparser.GetString on a value containing `\uG000` — or run: go test -run TestDemoKI9 -count=1 .
- Observe a decoded (bogus) code point and nil error instead of MalformedStringEscapeError.
go test -run TestDemoKI9 -count=1 . go test ./... -count=1
How it can be triggered
The input or condition that sets this issue off.
a Unicode escape with an out-of-range hex digit, e.g. {"k":"\uG000"}
What protects you, and the fix
What limits your exposure today, and the planned remediation.
What protects you now
Validate string content against a strict JSON schema/whitelist after parsing until the hex bound is restored; do not treat successfully-parsed escapes as proof of well-formed input.
The fix
Restore the "A".."F" (65..70) upper bound in h2I (escape.go:71, `c <= 71` -> `c <= 70`) so any byte above "F" returns badHex and the enclosing escape is rejected as malformed. Closes CWE-20 Improper Input Validation; cf. RFC 8259 section 7.
Blast radius
If you touch this issue, what else may need re-checking — the requirements it affects and the code and tests that hang off them. Historical view: authored trace links only — automatically derived links aren't reconstructible for past runs.
Touch this finding and you re-check 2 requirements · 3 code files · 8 tests.
- escape.go
- fuzz.go
- parser.go
- dead_code_audit_test.go
- escape_test.go
- fuzz_native_test.go
- mcdc_spec_witnesses_test.go
- mcdc_supplement_test.go
- obligation_evidence_test.go
- parser_test.go
- deep_spec_test.go
Per-requirement evidence
For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.
Per-requirement evidence
For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.
Evidence trail
The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.
Evidence trail
The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.
- proof/evidence/KI-9-reproducer.yaml
- proof_demo_reproducers_test.go:TestDemoKI9_InvalidHexDigitG
Change history
Every recorded revision of this finding's source file — when it was added, edited, or re-classified, with the diff for each change.
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.