archives

« Bugzilla Issues Index

#101 — Coverage: make sure differences between Object literal and JSON grammar are tested

• bug_id: 101
• creation_ts: 2011-05-16 10:12:00 -0700
• short_desc: Coverage: make sure differences between Object literal and JSON grammar are tested
• delta_ts: 2012-01-13 15:42:58 -0800
• product: Test262
• component: ECMA-262 Tests
• version: unspecified
• rep_platform: All
• op_sys: All
• bug_status: CONFIRMED
• priority: Normal
• bug_severity: normal
• everconfirmed: true
• reporter: David Bruant
• assigned_to: Dave Fugate

---

• commentid: 214
• comment_count: 0
• who: David Bruant
• bug_when: 2011-05-16 10:12:08 -0700

http://timelessrepo.com/json-isnt-a-javascript-subset points a subtle difference between the object literal grammar and the JSON grammar.
The test suite should make sure this difference is properly handled in ECMAScript implementations.

---

• commentid: 226
• comment_count: 1
• who: David Bruant
• bug_when: 2011-06-01 00:51:15 -0700

This page (http://www.thespanner.co.uk/2011/05/30/json-hijacking/) also points out a couple of security issues that could come out of JSON being interpreted as ObjectLitteral. I'm not really sure the issues are really directed to misinterpreted JSON, but it might be worth making sure these issues are handled correctly by ES engines by using tests.

---

• commentid: 603
• comment_count: 2
• who: Dave Fugate
• bug_when: 2012-01-13 15:42:58 -0800

Did a little bit of digging. We have ch15/15.12/15.12.1/15.12.1.1/15.12.1.1-0-8.js, but it's not really testing what it purports to. That is:
JSON.parse('\u2028\u20291234');
will throw even without the '\u2028\u2029'.

Definitely need coverage here.