Proof Portal
jsonparser
ProbeLabs36 findings · 123 requirementsLibrary users shall parse raw JSON scalar tokens into Go boolean, integer, float, and decoded string values with deterministic error behavior on malformed input.
Specification
The requirement exactly as authored — its complete prose text and, where present, the formal FRETish sentence it compiles to.
Library users shall parse raw JSON scalar tokens into Go boolean, integer, float, and decoded string values with deterministic error behavior on malformed input.
Rationale & tags
Why this requirement exists, and how it is categorised.
Rationale & tags
Why this requirement exists, and how it is categorised.
The Parse* helpers are public token-level conversion utilities and their malformed-input behavior is part of the callable API surface.
Verification & provenance
How this requirement was checked: the review trail, edit history, and the machine-analysis status terms (each ⓘ explains what it means).
Review
- Status
- approved
- Reviewer
- human:leonidbugaev
- Reviewed
- Apr 23, 2026, 00:00 UTC
History
- Created
- Apr 13, 2026, 17:21 UTC · human:cli
- Modified
- Jul 26, 2026, 12:54 UTC · human:cli
Obligations
What this requirement must witness to be considered satisfied — the required evidence, and the tests that discharge each one.
10 obligations · 9 discharged · 1 not yet witnessed
Browse the catalogueBehavior at limits, thresholds, and edge-of-range values.
ParseInt on input like 9223372036854775808 (int64 max+1) must return OverflowIntegerError; if parseInt overflow flag regresses the result silently wraps to a negative int64.
- nominalrecommendedpresentCovered by 1 test
Output identical regardless of collection ordering or runtime conditions.
ParseFloat on the same numeric token must return the same float64 across calls; a regression in parseFloat rounding direction produces non-deterministic results across calls.
- nominalrecommendedpresentCovered by 1 test
Behavior for unusual but valid input combinations.
ParseBoolean on the empty token []byte returns (false, MalformedValueError); a regression returns (false,nil) and silently misreads empty input as boolean false.
- nominalrecommendedpresentCovered by 1 test
Behavior when inputs are absent, nil, zero-length, or blank.
ParseInt on a zero-length []byte drives parseInt to ok=false; the caller receives MalformedValueError but a regression silently returns 0 instead, masking the empty-input case.
- nominalrecommendedpresentCovered by 1 test
Behavior specified for encoding and decoding round-trips.
ParseString on a JSON string containing invalid UTF-8 bytes passes them through Unescape; the returned Go string contains invalid UTF-8, corrupting downstream rendering and string operations.
- nominalrecommendedpresentCovered by 1 test
Behavior when inputs are syntactically or structurally invalid.
ParseFloat on a token like 1.2.3 drives parseFloat to error; a regression in the malformed check returns 1.2 (the partial parse) instead of MalformedValueError, silently corrupting numeric output.
- negativerequiredpresentCovered by 3 tests
- nominalrecommendedpresentCovered by 2 tests
Behavior specified when inputs are nil, null, or zero-value.
ParseString(nil) flows into Unescape(b, stackbuf[:]); the b[i] dereference inside Unescape panics with nil-slice index-out-of-range on the nil token.
- negativerequiredpresentCovered by 2 tests
- nominalrecommendedpresentCovered by 1 test
Happy-path behavior with valid inputs.
ParseBoolean on a truncated tru or fals token fails bytes.Equal and returns MalformedValueError; a regression in the partial-literal check feeds the truncated bytes to a downstream consumer that panics on the short slice.
- nominalrecommendedpresentCovered by 1 test
ParseString on a token ending in a truncated u-escape like abc\u31 drives Unescape hex-digit scan past the token end; if the bounds check regresses the parser reads past len(b) and panics.
- nominalrecommendedpresentCovered by 1 test
Acceptance criteria
Stakeholder conditions for satisfaction, traced to the derived requirements and evidence that discharge them.
Acceptance criteria
Stakeholder conditions for satisfaction, traced to the derived requirements and evidence that discharge them.
Stakeholder-authored conditions defining when the requirement is satisfied, traced to derived requirements / evidence.
- AC-1verify: test
A caller can parse raw boolean tokens through ParseBoolean and receive the expected bool value or the documented malformed-token error.
Derived requirements - AC-2verify: test
A caller can parse raw floating-point tokens through ParseFloat and receive the expected float64 value or the documented malformed-token error.
Derived requirements - AC-3verify: test
A caller can parse raw string tokens through ParseString and receive the expected decoded Go string value or the documented malformed-token error.
Derived requirements - AC-4verify: test
A caller can parse raw integer tokens through ParseInt and receive the expected int64 value, the documented overflow error, or the documented malformed-token error.
Its place
This requirement shown inside its trace neighbourhood — the parents it satisfies, the code and tests attached to it, and its findings.
Loading graph…
Trace evidence
The concrete artifacts linked to this requirement — implementing code, verifying tests, documents, and the findings raised against it.
No implementation linked
No source files are traced to this requirement yet.
Impact
Blast radius — if you change this requirement, what else may need re-checking, and what it in turn depends on.
Impact
Blast radius — if you change this requirement, what else may need re-checking, and what it in turn depends on.
If you change this
Requirements (24)
- When ParseBoolean receives a valid raw boolean token, the…parser · SYS
- When ParseFloat receives a well-formed floating-point…parser · SYS
- When ParseString receives a well-formed raw JSON string…parser · SYS
- When ParseInt receives a syntactically well-formed integer…parser · SYS
- When ParseBoolean receives an invalid boolean token, the…parser · SYS
- When ParseFloat receives a malformed numeric token, the…parser · SYS
- When ParseString receives a malformed encoded string…parser · SYS
- When ParseInt receives an integer token whose magnitude…parser · SYS
- When ParseInt receives a non-integer or otherwise malformed…parser · SYS
- When ParseBoolean receives a partial boolean literal (eparser · SYS
- When ParseInt receives integer tokens at the exact int64…parser · SYS
- When ParseInt receives an integer token that is exactly one…parser · SYS
- When ParseString receives a string literal containing a…parser · SYS
- When ParseString encounters a UTF-16 high surrogate escape…parser · SYS
- When ParseString encounters a UTF-16 high surrogate escape…parser · SYS
- When ParseString encounters a string literal ending with a…parser · SYS
- When ParseInt receives an empty byte slice, the parser…parser · SYS
- When ParseFloat receives an empty byte slice, the parser…parser · SYS
- When ParseBoolean receives an empty byte slice, the parser…parser · SYS
- When ParseString receives an empty byte slice, the parser…parser · SYS
- When ParseBoolean, ParseInt, ParseFloat, or ParseString is…parser · SYS
- When ParseBoolean, ParseInt, ParseFloat, or ParseString is…parser · SYS
- When ParseString is called on a byte slice containing…parser · SYS
- When ParseInt is called on edge-case numeric tokens such as…parser · SYS
Files to re-check (3)
- fuzz.gofuzz.go
- parser.goparser.go
- escape.goescape.go
Tests to re-run (14)
- benchmark_medium_payload_test.gobenchmark/benchmark_medium_payload_test.go
- benchmark_small_payload_test.gobenchmark/benchmark_small_payload_test.go
- obligation_evidence_test.goobligation_evidence_test.go
- parser_test.goparser_test.go
- fuzz_native_test.gofuzz_native_test.go
- mcdc_spec_witnesses_test.gomcdc_spec_witnesses_test.go
- mcdc_supplement_test.gomcdc_supplement_test.go
- reference_oracle_test.goreference_oracle_test.go
- dead_code_audit_test.godead_code_audit_test.go
- escape_test.goescape_test.go
- bytes_test.gobytes_test.go
- property_test.goproperty_test.go
- deep_spec_test.godeep_spec_test.go
- obligation_property_test.goobligation_property_test.go
What this rests on
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.