alibaba / alibaba/fastjson2

[BUG] parsing a string containing escaped double quotes during polymorphic deserialization

Open
#7,634 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
4.4k
Forks
613
Avg merge
1d 22h
Merged PRs (30d)
6

Description

### Problem Description

* Parsing a string containing escaped double quotes throws exception during polymorphic deserialization if the string comes before a field defining the object's type.

### Environment Information

- JDK: Eclipse Temurin 25.0.1
- Version Information: Fastjson2 2.0.61

### Reproduction Steps
Example code:
```java
@JSONType(typeKey = "objectType")
sealed interface Animal {
@JSONType(typeName = "cat")
record Cat(String field) implements Animal {
}
}

String json = "{\"field\": \"some\\\"text\", \"objectType\": \"cat\"}";
// Actual JSON to parse: {"field": "some\"text", "objectType": "cat"}
JSON.parseObject(json, Animal.class); // throws com.alibaba.fastjson2.JSONException
```

Output:
```
com.alibaba.fastjson2.JSONException: illegal fieldName input116, offset 18, character t, line 1, column 18, fastjson-version 2.0.61 {"field": "some\"text", "objectType": "cat"}

at com.alibaba.fastjson2.JSONReader.readFieldNameHashCodeError(JSONReader.java:6885)
at com.alibaba.fastjson2.JSONReaderASCII.readFieldNameHashCode(JSONReaderASCII.java:129)
at com.alibaba.fastjson2.reader.ObjectReaderNoneDefaultConstructor.readObject(ObjectReaderNoneDefaultConstructor.java:310)
at com.alibaba.fastjson2.reader.ORG_1_1_Cat.readObject(Unknown Source)
at com.alibaba.fastjson2.reader.ObjectReaderSeeAlso.readObject(ObjectReaderSeeAlso.java:312)
at com.alibaba.fastjson2.JSON.parseObject(JSON.java:992)
```

### Expected Correct Result
String in the field must be deserialized correctly as: `some"text`

Contributor guide

Open the contributing guide

Research direction

Start with JSON.parseObject and follow the stack trace through JSONReaderASCII.readFieldNameHashCode, ObjectReaderNoneDefaultConstructor.readObject, and ObjectReaderSeeAlso.readObject. Reproduce the sealed Animal example with the escaped quote before objectType, then verify that polymorphic deserialization returns the Cat with field equal to some\"text instead of throwing JSONException.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.