php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #68938 json_decode() decodes empty string without error
Submitted: 2015-01-28 21:51 UTC Modified: 2015-02-02 11:13 UTC
Votes:3
Avg. Score:4.3 ± 0.9
Reproduced:3 of 3 (100.0%)
Same Version:2 (66.7%)
Same OS:3 (100.0%)
From: jeremy at bat-country dot us Assigned: aharvey (profile)
Status: Closed Package: JSON related
PHP Version: 5.6.5 OS:
Private report: No CVE-ID: None
 [2015-01-28 21:51 UTC] jeremy at bat-country dot us
Description:
------------
PHP's json_decode() function accepts an empty string as JSON data and returns NULL without setting json_last_error(). An empty string is not valid JSON; see productions in RFC 4627 <https://tools.ietf.org/html/rfc4627> and RFC 7159 <https://tools.ietf.org/html/rfc7159>, or try decoding an empty string using builtin JSON parsers in Python, Go, or V8: all of them raise syntax errors.

To be consistent with other errors, trying to decode an empty string should return NULL but set json_last_error() to indicate a syntax error. For example, this is what happens when json_decode(" ") is called.

This affects PHP 5.4.32 on RHEL 5, PHP 5.6.5 built from the Git tag on Mac OS X 10.9, and probably any other configuration with the JSON extension.

It looks like this behavior was discovered during the course of bug #54484 <https://bugs.php.net/bug.php?id=54484> but never fixed. I've included a patch that fixes it, a regression test, and an update to the test for bug #54484.

Test script:
---------------
--TEST--
Bug #XXXXX (json_decode() decodes empty string without indicating error)
--SKIPIF--
<?php if (!extension_loaded("json")) print "skip"; ?>
--FILE--
<?php
json_decode("");
var_dump(json_last_error());
?>
--EXPECT--
int(4)


Actual result:
--------------
int(0)

Patches

json-decode-empty-string-error.diff (last revision 2015-01-28 21:51 UTC by jeremy at bat-country dot us)

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-02-02 11:13 UTC] aharvey@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: aharvey
 [2015-02-02 11:13 UTC] aharvey@php.net
Sorry; I dropped the ball on the original bug report, so the least I can do is merge in your quite correct patch. Thanks!
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Oct 10 20:01:26 2024 UTC