[fix] json: validate a single JSON document, rejecting trailing content (LET-27)#166
Conversation
prepareValidation decoded the data text with a json.Decoder and called
Decode once, with no check that the input was exhausted. encoding/json
reads only the first JSON value and discards the rest, so trailing
content passed validation silently:
try_validate('{"a":1} {"b":2}', {'type':'object'}) -> (True, None)
try_validate('5 "x"', {'type':'number'}) -> (True, None)
In the second case the trailing "x" would fail {'type':'number'} but was
never checked — a validation bypass. A caller believed the whole text
conformed when only the first document did.
Require EOF after the first document (dec.More(); trailing whitespace
still passes). This routes through the cannot-run path, so try_validate
returns (None, error), not (False, ...).
Test-first: new sections in json_test cover validate and try_validate.
Requirement: LET-27.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 0 |
| Duplication | 0 |
🟢 Coverage 100.00% diff coverage · +0.02% coverage variation
Metric Results Coverage variation ✅ +0.02% coverage variation (-1.00%) Diff coverage ✅ 100.00% diff coverage Coverage variation details
Coverable lines Covered lines Coverage Common ancestor commit (433eae0) 7692 7276 94.59% Head commit (11d7b08) 7695 (+3) 7280 (+4) 94.61% (+0.02%) Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch:
<coverage of head commit> - <coverage of common ancestor commit>Diff coverage details
Coverable lines Covered lines Diff coverage Pull request (#166) 3 3 100.00% Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified:
<covered lines added or modified>/<coverable lines added or modified> * 100%
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #166 +/- ##
==========================================
+ Coverage 93.39% 93.41% +0.01%
==========================================
Files 49 49
Lines 6177 6179 +2
==========================================
+ Hits 5769 5772 +3
+ Misses 260 258 -2
- Partials 148 149 +1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
1 participant
What
prepareValidationdecoded thedatatext with ajson.Decoderand calledDecodeonce, with no check that the input was exhausted.encoding/jsonreads only the first JSON value and discards the rest, so trailing content passed validation silently:In the second case the trailing
"x"would fail{'type':'number'}but was never checked — a validation bypass. A caller believed the whole text conformed when only the first document did.Fix
Require EOF after the first document (
dec.More(); trailing whitespace still passes). Trailing content routes through the cannot-run path, sotry_validatereturns(None, error)— not(False, …).Test-first
New sections in
json_test.gocover bothvalidate(raises) andtry_validate(returns cannot-run), including that pure trailing whitespace still passes. Fails before the fix.Verification
go test -race -count=2 ./...,go vet,gofmt -lclean, Dockergolang:1.19race run green.Requirement: LET-27