php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #68567 JSON_PARTIAL_OUTPUT_ON_ERROR can result in JSON with null key
Submitted: 2014-12-08 12:57 UTC Modified: 2017-10-15 18:43 UTC
Votes:2
Avg. Score:4.0 ± 1.0
Reproduced:2 of 2 (100.0%)
Same Version:1 (50.0%)
Same OS:0 (0.0%)
From: johnhax at gmail dot com Assigned: bukka (profile)
Status: Closed Package: JSON related
PHP Version: 5.6.3 OS:
Private report: No CVE-ID: None
 [2014-12-08 12:57 UTC] johnhax at gmail dot com
Description:
------------
json_encode(array("\x80" => 1)) returns "{null: 1}" in PHP5.3 and PHP5.4. It's not a valid JSON, but at least we could use json_last_error() to catch it. Encoding recursion, INF/NAN or unsupported type results in a VALID json so that json_last_error() returns 0 (no error) and only emit E_WARNING. 
In fact, all JSON_ERROR_* constants are only for json_decode() until 5.3.3.

From PHP 5.5, json_encode() does not emit E_WARNING anymore,  JSON_ERROR_RECURSION/INF_OR_NAN/UNSUPPORTED_TYPE are added and json_last_error() may return them after json_encode(). (And it also possible return JSON_ERROR_DEPTH for the new third param of json_encode.)

The problem is, there is NO way to be tolerant to these cases in PHP 5.5+!
The undocumented option JSON_PARTIAL_OUTPUT_ON_ERROR is USELESS because json_last_error() only returns the last error, means there may be utf-8 error which results in invalid json.


There are two possible solution:
1. When json_encode with JSON_PARTIAL_OUTPUT_ON_ERROR, encode array("\x80" => 1) to {"": 1} or {} (just drop the node) to ensure valid json output.
2. Implement new options like https://bugs.php.net/bug.php?id=65082 , and add more options to allow indicate how to treat recursion, Inf, NaN, unsupported type respectively.

We'd better implement both, 1 for backward compatibility and 2 for drop unreliable json_last_error().




Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-05-15 15:07 UTC] bukka@php.net
-Package: json +Package: JSON related
 [2016-09-04 10:55 UTC] bukka@php.net
-Summary: fix json_encode() +Summary: JSON_PARTIAL_OUTPUT_ON_ERROR can result in JSON with null key -Status: Open +Status: Duplicate
 [2016-09-04 10:56 UTC] bukka@php.net
-Status: Duplicate +Status: Open
 [2016-09-04 10:57 UTC] bukka@php.net
-Type: Feature/Change Request +Type: Bug
 [2017-10-15 18:37 UTC] bukka@php.net
Automatic comment on behalf of bukka
Revision: http://git.php.net/?p=php-src.git;a=commit;h=7c556c44a10bfc53c37295626e61bd99dc4f550c
Log: Fix bug #68567 (JSON_PARTIAL_OUTPUT_ON_ERROR can result in JSON with null key)
 [2017-10-15 18:37 UTC] bukka@php.net
-Status: Open +Status: Closed
 [2017-10-15 18:38 UTC] bukka@php.net
Automatic comment on behalf of bukka
Revision: http://git.php.net/?p=php-src.git;a=commit;h=7c556c44a10bfc53c37295626e61bd99dc4f550c
Log: Fix bug #68567 (JSON_PARTIAL_OUTPUT_ON_ERROR can result in JSON with null key)
 [2017-10-15 18:43 UTC] bukka@php.net
-Assigned To: +Assigned To: bukka
 [2017-10-15 18:43 UTC] bukka@php.net
I just fixed the JSON_PARTIAL_OUTPUT_ON_ERROR part in PHP-7.2. Please note that PHP-7.2 also has new options that allow ignoring or substituting UTF-8 invalid character which can be also used to address this.
 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Sun Nov 19 01:31:42 2017 UTC