JsonCodec decoder accepts malformed JSON string with extra characters

[guersam]

The JSON codec accepts malformed JSON strings like {}}, "foo"" without error.

Reproducer: https://scastie.scala-lang.org/guersam/IFS2CO8dRGiNpsQhId3u3A/5

[jdegoes]

/bounty $75

[algora-pbc]

💎 $75 bounty • ZIO

Steps to solve:

1. Start working: Comment /attempt #712 with your implementation plan
2. Submit work: Create a pull request including /claim #712 in the PR body to claim the bounty
3. Receive payment: 100% of the bounty is received 2-5 days post-reward. Make sure you are eligible for payouts

❗ Important guidelines:

• To claim a bounty, you need to provide a short demo video of your changes in your pull request
• If anything is unclear, ask for clarification before starting as this will help avoid potential rework
• Low quality AI PRs will not receive review and will be closed
• Do not ask to be assigned unless you've contributed before

Thank you for contributing to zio/zio-schema!

Attempt	Started (UTC)	Solution	Actions
🟢 @ImBIOS	Aug 07, 2024, 03:32:10 PM	#724	Reward
🟢 @CharlesWong	Mar 11, 2026, 07:13:15 PM	#1038	Reward
🟢 @enkae-code	Mar 13, 2026, 04:49:49 AM	#1044	Reward
🔴 @Karfue	Aug 23, 2024, 11:41:17 AM	WIP
🟢 @Dee66	Dec 24, 2025, 01:18:51 PM	#974	Reward
🟢 @selenaalpha77-sketch	Apr 26, 2026, 08:34:15 AM	#1072	Reward

[ImBIOS]

/attempt #712

Problem

1. The JsonDecoder.decode function in JsonCodec likely parse only the necessary portion of the input string and might ignore trailing characters.
2. This behavior is problematic because it can lead to silent errors where malformed JSON is accepted as valid, potentially causing data inconsistencies or unexpected behavior later in the application.

Potential Solutions

1. Strict Parsing: The most robust solution is to enforce strict JSON parsing. This means the decoder should explicitly check if the entire input string has been consumed after parsing the JSON object. If there are any remaining characters, the decoding should fail with an appropriate error. Here are the key changes that should be made:
   1. In the JsonDecoder object, modify the decode method to check for any remaining non-whitespace characters after parsing is complete. If any are found, it should return an error.
   2. In the string parsing logic (likely in the Lexer object), add a check to ensure there are no extra quotes after the closing quote of a string.
   3. In the object parsing logic, add a check to ensure there are no extra closing braces after the object is closed.

Options

• Cancel my attempt

[algora-pbc]

💡 @ImBIOS submitted a pull request that claims the bounty. You can visit your bounty board to reward.

[Karfue]

/attempt #712
The inferSchema method is not correctly handling optional fields in case classes. This needs to be addressed to ensure that optional fields are properly recognized and handled.

Update the method to correctly identify and handle optional fields. This involves checking if a field’s type is an Option and adjusting the schema accordingly.

Objective: Ensure optional fields are recognized.
Approach: Use reflection to check if a field’s type is an Option. Update the schema to reflect this.

Options

• Cancel my attempt

[algora-pbc]

Note

The user @ImBIOS is already attempting to complete issue #712 and claim the bounty. We recommend checking in on @ImBIOS's progress, and potentially collaborating, before starting a new solution.

[algora-pbc]

@Karfue: Reminder that in 7 days the bounty will become up for grabs, so please submit a pull request before then 🙏

[Dee66]

/attempt #712

Implementation Plan:

Reproduce: Add a regression test suite in JsonCodecSpec using the provided Scastie examples (e.g., {"a":1}} and "foo"") to confirm they currently decode successfully.

Lexer Integration: Modify the JsonDecoder implementation within JsonCodec.scala. Instead of allowing the decoder to exit immediately after the primary object is materialized, I will utilize the underlying Lexer to perform a mandatory nextToken check.

Strict EOF Enforcement: After the primary decoding logic completes, I will verify that the next significant token is a Termination / EOF. If any non-whitespace characters remain, the process will fail with a DecodeError.ReadError specifically citing trailing data.

Consistency: Ensure this strictness applies across all schema types (Records, Sequences, and Primitives) to ensure uniform behavior in the JsonCodec.