From fca00f44f19dad8763e34502718a2bb90d98bdc1 Mon Sep 17 00:00:00 2001
From: komika <komika@komika.org>
Date: Wed, 7 Oct 2020 19:59:05 +0200
Subject: [PATCH] jlexer skipped json value validation added (#309)

* jlexer skipped json value validation added

* jlexer skipping invalid json tests added

Co-authored-by: michael <michael@tutti.ch>
---
 jlexer/lexer.go      | 9 +++++++++
 jlexer/lexer_test.go | 4 ++++
 2 files changed, 13 insertions(+)

diff --git a/jlexer/lexer.go b/jlexer/lexer.go
index 02ea0f2..ef0aa61 100644
--- a/jlexer/lexer.go
+++ b/jlexer/lexer.go
@@ -529,6 +529,7 @@ func (r *Lexer) Skip() {
 func (r *Lexer) SkipRecursive() {
 	r.scanToken()
 	var start, end byte
+	startPos := r.start
 
 	switch r.token.delimValue {
 	case '{':
@@ -554,6 +555,14 @@ func (r *Lexer) SkipRecursive() {
 			level--
 			if level == 0 {
 				r.pos += i + 1
+				if !json.Valid(r.Data[startPos:r.pos]) {
+					r.pos = len(r.Data)
+					r.fatalError = &LexerError{
+						Reason: "skipped array/object json value is invalid",
+						Offset: r.pos,
+						Data:   string(r.Data[r.pos:]),
+					}
+				}
 				return
 			}
 		case c == '\\' && inQuotes:
diff --git a/jlexer/lexer_test.go b/jlexer/lexer_test.go
index 981caa5..cc60179 100644
--- a/jlexer/lexer_test.go
+++ b/jlexer/lexer_test.go
@@ -201,6 +201,10 @@ func TestSkipRecursive(t *testing.T) {
 
 		// object with double slashes at the end of string
 		{toParse: `{"a":"hey\\"}, 4`, left: ", 4"},
+
+		// make sure skipping an invalid json results in an error
+		{toParse: `{"a": [ ##invalid json## ]}, 4`, wantError: true},
+		{toParse: `{"a": [ [1], [ ##invalid json## ]]}, 4`, wantError: true},
 	} {
 		l := Lexer{Data: []byte(test.toParse)}