[Security] JSON Pointer ~1 decoding error vulnerability inside decode_pointer_inplace
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 75/100
Research direction
Start in decode_pointer_inplace(), using the linked research repository's reproduction to observe how a ~1 escape is decoded. Check the behavior through cJSONUtils_GetPointer() and cJSONUtils_ApplyPatches(); done means ~1 resolves to / and patch operations target the intended key.
Written by the indexing model from the issue text.
Description
Title: JSON Pointer ~1 decoding error in cJSON decode_pointer_inplace
Description
A logic error in cJSON's JSON Pointer decoder. When decode_pointer_inplace() processes a ~1 escape sequence (which should decode to / per RFC 6901), it writes the decoded / to an incorrect position — decoded_string[1] instead of the current output cursor. As a result, ~1 is decoded as ~/ instead of /, causing cJSONUtils_ApplyPatches() to target the wrong key.
Impact
cJSONUtils_GetPointer()/cJSONUtils_ApplyPatches()resolve incorrect keys- Data integrity issue when processing JSON Patch operations from untrusted sources
Reproduction
All materials are available in my research repository:
- Dominant language
- C
- Stars
- 13k
- Forks
- 3.5k
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from DaveGamble/cJSON
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
DaveGamble/cJSON#1082 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
DaveGamble/cJSON#1081 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
DaveGamble/cJSON#1074 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
DaveGamble/cJSON#1071 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
DaveGamble/cJSON#1067 ·
All issues in DaveGamble/cJSON
Similar issues
-
level/task module/gcp type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
docs
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
P3 sonic-vpp
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
sonic-net/sonic-buildimage#29662 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 94/100
spack/spack-packages#6586 ·
-
category:port-update
Difficulty 2/5 1-3 hours Newbie friendliness 72/100