wavefnd / wavefnd/Wave

Reject out-of-range JSON numbers instead of silently serializing them as null

Open
#541 0 comments 0 reactions 0 assignees View on GitHub
bug good first issue
Dominant language
Rust
Stars
53
Forks
16
Avg merge
4h 22m
Merged PRs (30d)
46

Description

`parse_number` accepts the result of Rust's f64 parser without checking finiteness. A syntactically valid large exponent such as `1e9999` can produce infinity. The writer replaces non-finite `Json::Num` values with `null`, so parse/write can silently change a number into a different JSON type. The existing f64 representation needs a clear unsupported-range error rather than silent conversion.

Source evidence at the head of #520:

- [utils/src/json.rs:220](https://github.com/wavefnd/Wave/blob/2ae0a91c57fd76323124c0e4dff552adbfadbe1b/utils/src/json.rs#L220) — `s.parse::()`
- [utils/src/json.rs:289](https://github.com/wavefnd/Wave/blob/2ae0a91c57fd76323124c0e4dff552adbfadbe1b/utils/src/json.rs#L289) — `if n.is_finite()`

Acceptance:

- [ ] Reject a parsed non-finite numeric result with an actionable range error; a new arbitrary-precision dependency is not required.
- [ ] Cover positive/negative overflowing exponents and the largest supported finite values.
- [ ] Verify accepted finite number round trips remain numeric, including negative zero according to the current writer policy.
- [ ] Do not expand this patch into changing the public Json representation or all number formatting.

API/reference context: [JSON permits implementations to bound numeric range, section 6](https://www.rfc-editor.org/rfc/rfc8259.html#section-6).

Related: #351 is independent string-decoding work.

Audit status: identified by static source inspection; the scenarios above have not been executed during this audit. The permalink fixes the reviewed revision; this report does not claim the defect was introduced by #520.

Contributor guide

Open the contributing guide

Research direction

Start in utils/src/json.rs at parse_number around line 220, then inspect the writer's non-finite-number handling around line 289. Run or add focused JSON parser tests for positive and negative overflowing exponents, largest finite values, finite round trips, and negative zero; done means non-finite results produce an actionable range error without changing the public Json representation.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
76/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.