Return error if numeric key starts with whitespace

serde-rs · Jul 10, 2023 · a4e2719 · a4e2719
1 parent 468a94a
commit a4e2719
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 1 deletion.
diff --git a/src/de.rs b/src/de.rs
@@ -2125,7 +2125,12 @@ macro_rules! deserialize_numeric_key {
             V: de::Visitor<'de>,
         {
             self.de.eat_char();
-            let value = self.de.$method(visitor)?;
+
+            if let Some(b' ') | Some(b'\n') | Some(b'\r') | Some(b'\t') = tri!(self.de.peek()) {
+                return Err(self.de.peek_error(ErrorCode::UnexpectedWhitespaceInKey));
+            }
+
+            let value = tri!(self.de.$method(visitor));
 
             match self.de.peek()? {
                 Some(b'"') => self.de.eat_char(),

diff --git a/src/error.rs b/src/error.rs
@@ -72,6 +72,7 @@ impl Error {
             | ErrorCode::ControlCharacterWhileParsingString
             | ErrorCode::KeyMustBeAString
             | ErrorCode::FloatKeyMustBeFinite
+            | ErrorCode::UnexpectedWhitespaceInKey
             | ErrorCode::LoneLeadingSurrogateInHexEscape
             | ErrorCode::TrailingComma
             | ErrorCode::TrailingCharacters
@@ -290,6 +291,9 @@ pub(crate) enum ErrorCode {
     /// Object key is a non-finite float value.
     FloatKeyMustBeFinite,
 
+    /// Unexpected whitespace in a numeric key.
+    UnexpectedWhitespaceInKey,
+
     /// Lone leading surrogate in hex escape.
     LoneLeadingSurrogateInHexEscape,
 
@@ -368,6 +372,9 @@ impl Display for ErrorCode {
             ErrorCode::FloatKeyMustBeFinite => {
                 f.write_str("float key must be finite (got NaN or +/-inf)")
             }
+            ErrorCode::UnexpectedWhitespaceInKey => {
+                f.write_str("unexpected whitespace in object key")
+            }
             ErrorCode::LoneLeadingSurrogateInHexEscape => {
                 f.write_str("lone leading surrogate in hex escape")
             }

diff --git a/tests/test.rs b/tests/test.rs
@@ -1900,6 +1900,15 @@ fn test_integer_key() {
     test_parse_err::<BTreeMap<i32, ()>>(&[(j, "expected value at line 1 column 3")]);
 }
 
+#[test]
+fn test_integer_key_leading_whitespace() {
+    let j = r#"{" 123":null}"#;
+    test_parse_err::<BTreeMap<i32, ()>>(&[(
+        j,
+        "unexpected whitespace in object key at line 1 column 3",
+    )]);
+}
+
 #[test]
 fn test_integer128_key() {
     let map = treemap! {